microsoft / microsoft/aspire

Azure.Core 1.57.0 => 1.59.0 stops Aspire app talking to Azure resources

Open
#18,214 2 comments 0 reactions 0 assignees View on GitHub
area-integrations azure triage:bot-seen
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Upgrading various packages today, I found during debug my aspire apps would start but after a long duration of trying to access them, I'd eventually see failures in connecting to azure resources and I'd see exceptions of this nature:

```
Azure.Identity.AuthenticationFailedException: 'ManagedIdentityCredential authentication failed: All Managed Identity sources are unavailable. The Azure Instance Metadata Service (IMDS) that runs on VMs was not detected: IMDSv2: IMDSv2 probe failed.
```

After a lot of troubleshooting with co-pilot and trial error with options configuring 'DefaultAzureCredential', I learned the following:

- Co-pilot thinks the IP range it refers to in the full exception is being routed through my Azure VPN connection and not resolving, hence the error.
- That it's probably always done this, but a change in a package somewhere has changed the behavior/exceptions from DefaultAzureCredential() in such a way that causes this exception rather than it moving through to the next AzureCredential type.

I eventually figured out that the packaged making the difference was 'Azure.Core'. While I've changed a number of things to alter how DefaultAzureCredential behaves locally with some success, it was downgrading/pinning Azure.Core to [1.57.0] that blanket resolved things.

Other factors that may be involved:

I use centralized package management, and recently 'CentralPackageTransitivePinningEnabled', which I've set to 'true' recently to work around the 'MessagePack' warnings that have appeared.

I don't know where in the stack of things this issue sits, if it's Aspire specific i.e. it's handling of exceptions from DefaultAzureCredential(), or if it's a bug that's been introduced in the 'Azure.Core' or 'Azure.Identity' packages. But it explodes everything.

### Expected Behavior

Referencing 'Azure.Core' 1.59.0 shouldn't break code that talks to azure resources and uses 'DefaultAzureCredential()'

### Steps To Reproduce

So I was seeing this on code that would connect to azure resources like blob storage, e.g.

```csharp

string? keyVaultUri = $"{builder.Configuration[$"ConnectionStrings:{keyVaultName}"]!}";
tokenCredentials = new DefaultAzureCredential();

var keyClient = new KeyClient(new Uri(keyVaultUri), tokenCredentials);
var keyName = $"{applicationName}-dataprotection";

Azure.Response key;

try
{
key = keyClient.GetKey(keyName);
}
catch (Azure.RequestFailedException ex)
{
if (ex.Status == 404)
{
Console.Error.WriteLine($"Key '{keyName}' not found in Key Vault. Creating a new key.");
key = keyClient.CreateKey(keyName, KeyType.Rsa);
}
else
{
Console.Error.WriteLine($"Error retrieving key '{keyName}' from Key Vault ({keyVaultUri}): {ex.Message}");
throw;
}
}
catch (Exception ex)
{
Console.Error.WriteLine($"Unexpected error while accessing Key Vault ({keyVaultUri}): {ex.Message}");
throw;
}

Uri keyUri = (key?.Value?.Id) ?? throw new InvalidOperationException($"Error creating dataprotection key in {keyVaultUri}");

builder.Services.AddDataProtection()
.SetApplicationName(applicationName)
.PersistKeysToAzureBlobStorage(services =>
{
var blobServiceClient = services.GetRequiredService();
var containerClient = blobServiceClient.GetBlobContainerClient($"{applicationName}-dataprotection");
containerClient.CreateIfNotExists();
var blobClient = containerClient.GetBlobClient("keys.xml");

return blobClient;
})
.ProtectKeysWithAzureKeyVault(keyUri, tokenCredentials);

```

### Exceptions (if any)

Azure.Identity.AuthenticationFailedException: 'ManagedIdentityCredential authentication failed: All Managed Identity sources are unavailable. The Azure Instance Metadata Service (IMDS) that runs on VMs was not detected: IMDSv2: IMDSv2 probe failed. Exception: Retry failed after 5 tries. Retry settings can be adjusted in ClientOptions.Retry or by configuring a custom retry policy in ClientOptions.RetryPolicy. (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80)) (The operation was canceled.). IMDSv1: IMDSv1 probe failed. Exception: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (169.254.169.254:80).
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot'

### Aspire doctor output

Aspire Environment Check
========================

Aspire
✅ Aspire CLI version 13.4.4 (channel: stable)

AppHost
✅ AppHost version 13.4.4 (ecoDriverWeb.AppHost\ecoDriverWeb.AppHost.csproj)

.NET SDK
✅ .NET 10.0.301 installed (x64)

Container Runtime
✅ Docker v29.5.3: running (auto-detected (default)) ← active

Environment
✅ HTTPS development certificate is trusted

Summary: 5 passed, 0 warnings, 0 failed

Aspire CLI Installations
========================

╭───────────────────────────────────────────────┬──────────────────────────────────────────────┬──────────────┬──────────────┬─────────────╮
│ Path │ Version │ Channel │ Route │ PATH status │
├───────────────────────────────────────────────┼──────────────────────────────────────────────┼──────────────┼──────────────┼─────────────┤
│ C:\Users\MatthewPaul\.aspire\bin\aspire.exe │ 13.4.4+ccc566c5ab3285c9beb8f38ede34734bb477c │ stable │ script │ active │
│ (current) │ 029 │ │ │ │
│ C:\Users\MatthewPaul\.dotnet\tools\aspire.EXE │ (not probed) │ (not probed) │ (not probed) │ shadowed │
╰────────────────────

### Anything else?

Visual Studio 2026 preview, .NET 10

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.