Azure.Core 1.57.0 => 1.59.0 stops Aspire app talking to Azure resources
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
Upgrading various packages today, I found during debug my aspire apps would start but after a long duration of trying to access them, I'd eventually see failures in connecting to azure resources and I'd see exceptions of this nature:
```
Azure.Identity.AuthenticationFailedException: 'ManagedIdentityCredential authentication failed: All Managed Identity sources are unavailable. The Azure Instance Metadata Service (IMDS) that runs on VMs was not detected: IMDSv2: IMDSv2 probe failed.
```
After a lot of troubleshooting with co-pilot and trial error with options configuring 'DefaultAzureCredential', I learned the following:
- Co-pilot thinks the IP range it refers to in the full exception is being routed through my Azure VPN connection and not resolving, hence the error.
- That it's probably always done this, but a change in a package somewhere has changed the behavior/exceptions from DefaultAzureCredential() in such a way that causes this exception rather than it moving through to the next AzureCredential type.
I eventually figured out that the packaged making the difference was 'Azure.Core'. While I've changed a number of things to alter how DefaultAzureCredential behaves locally with some success, it was downgrading/pinning Azure.Core to [1.57.0] that blanket resolved things.
Other factors that may be involved:
I use centralized package management, and recently 'CentralPackageTransitivePinningEnabled', which I've set to 'true' recently to work around the 'MessagePack' warnings that have appeared.
I don't know where in the stack of things this issue sits, if it's Aspire specific i.e. it's handling of exceptions from DefaultAzureCredential(), or if it's a bug that's been introduced in the 'Azure.Core' or 'Azure.Identity' packages. But it explodes everything.
### Expected Behavior
Referencing 'Azure.Core' 1.59.0 shouldn't break code that talks to azure resources and uses 'DefaultAzureCredential()'
### Steps To Reproduce
So I was seeing this on code that would connect to azure resources like blob storage, e.g.
```csharp
string? keyVaultUri = $"{builder.Configuration[$"ConnectionStrings:{keyVaultName}"]!}";
tokenCredentials = new DefaultAzureCredential();
var keyClient = new KeyClient(new Uri(keyVaultUri), tokenCredentials);
var keyName = $"{applicationName}-dataprotection";
Azure.Response key;
try
{
key = keyClient.GetKey(keyName);
}
catch (Azure.RequestFailedException ex)
{
if (ex.Status == 404)
{
Console.Error.WriteLine($"Key '{keyName}' not found in Key Vault. Creating a new key.");
key = keyClient.CreateKey(keyName, KeyType.Rsa);
}
else
{
Console.Error.WriteLine($"Error retrieving key '{keyName}' from Key Vault ({keyVaultUri}): {ex.Message}");
throw;
}
}
catch (Exception ex)
{
Console.Error.WriteLine($"Unexpected error while accessing Key Vault ({keyVaultUri}): {ex.Message}");
throw;
}
Uri keyUri = (key?.Value?.Id) ?? throw new InvalidOperationException($"Error creating dataprotection key in {keyVaultUri}");
builder.Services.AddDataProtection()
.SetApplicationName(applicationName)
.PersistKeysToAzureBlobStorage(services =>
{
var blobServiceClient = services.GetRequiredService();
var containerClient = blobServiceClient.GetBlobContainerClient($"{applicationName}-dataprotection");
containerClient.CreateIfNotExists();
var blobClient = containerClient.GetBlobClient("keys.xml");
return blobClient;
})
.ProtectKeysWithAzureKeyVault(keyUri, tokenCredentials);
```
### Exceptions (if any)
Azure.Identity.AuthenticationFailedException: 'ManagedIdentityCredential authentication failed: All Managed Identity sources are unavailable. The Azure Instance Metadata Service (IMDS) that runs on VMs was not detected: IMDSv2: IMDSv2 probe failed. Exception: Retry failed after 5 tries. Retry settings can be adjusted in ClientOptions.Retry or by configuring a custom retry policy in ClientOptions.RetryPolicy. (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (The operation was canceled.). IMDSv1: IMDSv1 probe failed. Exception: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80).
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot'
### Aspire doctor output
Aspire Environment Check
========================
Aspire
✅ Aspire CLI version 13.4.4 (channel: stable)
AppHost
✅ AppHost version 13.4.4 (ecoDriverWeb.AppHost\ecoDriverWeb.AppHost.csproj)
.NET SDK
✅ .NET 10.0.301 installed (x64)
Container Runtime
✅ Docker v29.5.3: running (auto-detected (default)) ← active
Environment
✅ HTTPS development certificate is trusted
Summary: 5 passed, 0 warnings, 0 failed
Aspire CLI Installations
========================
╭───────────────────────────────────────────────┬──────────────────────────────────────────────┬──────────────┬──────────────┬─────────────╮
│ Path │ Version │ Channel │ Route │ PATH status │
├───────────────────────────────────────────────┼──────────────────────────────────────────────┼──────────────┼──────────────┼─────────────┤
│ C:\Users\MatthewPaul\.aspire\bin\aspire.exe │ 13.4.4+ccc566c5ab3285c9beb8f38ede34734bb477c │ stable │ script │ active │
│ (current) │ 029 │ │ │ │
│ C:\Users\MatthewPaul\.dotnet\tools\aspire.EXE │ (not probed) │ (not probed) │ (not probed) │ shadowed │
╰────────────────────
### Anything else?
Visual Studio 2026 preview, .NET 10
Contributor guide
Assessment
This issue has not been assessed yet.