microsoft / microsoft/aspire

E2E Deployment Test Failure: Aspire.Deployment.EndToEnd.Tests.KubernetesGatewayTlsDeploymentTests.DeployStarterWithGatewayTlsToKubernetes

Open
#18,203 1 comment 0 reactions 1 assignee Claimed by @mitchdenny View on GitHub
area-deployment test-failure triage:bot-seen triage:needs-human
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

## Failing Test

`Aspire.Deployment.EndToEnd.Tests.KubernetesGatewayTlsDeploymentTests`

## Workflow Runs

- [Deployment E2E Tests — 2026-06-14 (run 27488368792)](https://github.com/microsoft/aspire/actions/runs/27488368792/job/81249105200)
- [Deployment E2E Tests — 2026-06-10 (run 27253322882)](https://github.com/microsoft/aspire/actions/runs/27253322882)

## Symptom

The test invokes `az acr login --name ` shortly after `az acr create` and the login fails with:

```
[6 OK] $ az acr create --resource-group e2e-k8sgwtls-... --name acrgw... --sku Basic --output table
[7 OK] $ az acr login --name acrgw...
Unable to get AAD authorization tokens with message:
An error occurred: CONNECTIVITY_CHALLENGE_ERROR
Registry 'acrgw....azurecr.io' did not issue a challenge.
Unable to get admin user credentials with message: Admin user is disabled.
Username:
```

`az acr login` then drops into an interactive `Username:` prompt (which the test cannot satisfy), the surrounding `WaitForSuccessPromptAsync` times out, and the test fails after ~1m 45s.

## Root Cause

`CONNECTIVITY_CHALLENGE_ERROR` from `az acr login` indicates the CLI could not negotiate an AAD token exchange against the newly-created registry's `/v2/` endpoint. Because the ACR is provisioned without an admin user, the fallback to admin credentials is also unavailable, and the CLI then prompts interactively.

This is the same family of "freshly-provisioned ACR not yet reachable from the runner" race tracked in #17739, #18027, #18028 — but on the inbound side (the GitHub runner reaching ACR) rather than the ACA-side DNS race.

## Notes

- Likely transient / infrastructure-side; would benefit from a retry on `az acr login` (e.g. retry on non-zero exit before falling through to the next step).
- The test has two `az acr login` invocations (lines 129 and 330 of `KubernetesGatewayTlsDeploymentTests.cs`); both are vulnerable.
- Auto-filed by the deployment-test analysis workflow.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.