Managed identity image pull failure on replica restart 24 hours after initial start

This issue is a: (mark with an x)

• bug report -> please search issues before submitting
• documentation issue or request
• regression (a behavior that used to work and stopped in a new release)

Issue description

ACA with (user assigned) managed identity authorized with AcrPull to ACR. Initial container startup is fine, and also works if the replica crashes and restarts within a day. If the replica crashes and restarts 24 hours after initial start, the restart fails with an image pull error.

Microsoft.App/containerApps/revisions state:

• provisioningState is Failed
• runningState is Failed
• runningStateDetails is 1/3 Failed:xxxContainerCrashing | 1/3 Pending:ImagePullBackOff on legion | 1/3 Running

ContainerAppSystemLogs show repeating logs every 5 minutes:

• Pulling image 'xxx.azurecr.io/xxx:xxx'
• Container 'xxx' was terminated with exit code '' and reason 'ImagePullFailure'

In ACR ContainerRegistryRepositoryEvents there are no Pull operations logged as part of restart.

After restarting the revision things start working again, and this can be also seen as a successful image pull in ACR ContainerRegistryRepositoryEvents.

My assumption is that ACA is authenticating using MSI and acquiring a token for ACR authentication valid for 24 hours, but is not renewing the token after 24 hours has passed. Restarting the revision forces reacquisition of this token and image pull works.

Steps to reproduce

1. ACA with managed identity authenticated image pull against ACR
2. Wait 24 hours after initial start
3. Container restart fails to pull image

Expected behavior
Managed identity based image pull should work on replica restart regardless of how much time has passed since initial start.

Actual behavior
Managed identity based image pull on replica restart fails 24 hours after initial start.

Reproduce the failure with an Azure Container App using a user-assigned managed identity and AcrPull access, then inspect the revision state and ContainerAppSystemLogs after a replica restarts 24 hours later. Compare ACR ContainerRegistryRepositoryEvents for the failed restart and a manually restarted revision; done means image pulls continue to work after the 24-hour boundary without manually restarting the revision.