azurerm_container_app - Error details: Operation expired."

[moryoskorot]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

Hi,

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

v1.4.5

AzureRM Provider Version

3.63.0

Affected Resource(s)/Data Source(s)

azurerm_container_app

Terraform Configuration Files

# What i'm suggesting is to increase the timeout of the resource creation

resource "azurerm_container_app" "dev" {
  name                         = "dev-server"
  container_app_environment_id = azurerm_container_app_environment.dev.id
  resource_group_name          = azurerm_resource_group.dev.name # West Europe
  revision_mode                = "Single"
  tags                         = var.tags

  template {
    container {
      name   = "examplecontainerapp"
      image  = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }

Debug Output/Panic Output

Container App Name: "dev-server"): polling after CreateOrUpdate: Code="ContainerAppOperationError" Message="Failed to provision revision for container app 'dev-server'. Error details: Operation expired."

# After the fail

│ Error: A resource with the ID "/subscriptions/aaaa-aaaaa-aaaaa-aaaaa/resourceGroups/aaaaa-RG/providers/Microsoft.App/containerApps/dev-server" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_container_app" for more information.

Expected Behaviour

The resource should get created and imported into the state successfully.

Actual Behaviour

Operation expired,
But the resource actually gets created, and I had to manually Import it.
This occurred 4 times (every time I had to deploy).
( What i'm suggesting is to increase the timeout of the resource creation )

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[ngfarjad]

• This happens even after you run import command to import the newly created resource.
• The resource created doesn't have any container/revision in it.
• The resource created doesn't have any secrets. If you try to create a new container, you can see the secrets but in Secrets blade is empty, and you can't add any new secrets with the following error:
  Failed to update secrets: SecretRef 'connection-str' defined for container 'worker-container' not found.
• When trying to create a container/revision from Azure UI. It gives the following error:
  Failed to deploy new revision: PasswordSecretRef 'pwd' defined for registry server 'x.azurecr.io' not found.
  even though you can see these secrets when creating a new container.

[MarcBuch]

I would advise to use the azapi implementation. The error messages from the azurerm API are not properly displayed with this Terraform provider. See Microsoft.App/containerApps - Bicep, ARM template & Terraform AzAPI reference | Microsoft Learn

[moryoskorot]

Thank you for the suggestion, I moved on to an other project, for now having the two resources imported resolves it we are not planning to add new apps any time soon.

…

On Wed, Aug 16, 2023 at 10:46 PM Marc Buch ***@***.***> wrote: I would advise to use the azapi implementation. The error messages from the azurerm API are not properly displayed with this Terraform provider. — Reply to this email directly, view it on GitHub <#22432 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APPHML6V3VVOS6T4SNK64RLXVUPSLANCNFSM6AAAAAA2EAV4AA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[DuncanvR]

Could be related to #21022 & #20435. The suggestion in this comment worked for me.

[mpenndev]

I encountered this error when using SystemAssigned identity to try and pull my container image from Azure Container Registry (ACR).

On initial creation the container app would be created without a revision. It wouldn't be possible to create a revision either.

I found 2 workarounds:

1. Terraform twice, once with a public image (for example the hello-world in the Microsoft docs) and the registry block commented out. Then again with the private registry & image.
2. Use the admin credentials from the ACR.

I presume using a UserAssigned identity would also solve this issue.

My guess would be an issue around the timing of creating the container app & setting the RBAC permissions to its identity. Presumably it tries to pull the image before the role is assigned and gets an unauthorised response and then becomes stuck.

[moryoskorot]

Thanks marcus, I appreciate your time and effort replying , I hope it would be corrected on the provider level if its your guess about querying the ACR before Rbac are in place. I'll keep the first workaround in mind on future ContainerApps Projects. Appreciated, Mor Yosef

…

On Wed, Jan 10, 2024 at 11:21 AM Marcus Penn ***@***.***> wrote: I encountered this error when using SystemAssigned identity to try and pull my container image from Azure Container Registry (ACR). On initial creation the container app would be created without a revision. It wouldn't be possible to create a revision either. I found 2 workarounds: 1. Terraform twice, once with a public image (for example the hello-world in the Microsoft docs) and the registry block commented out. Then again with the private registry & image. 2. Use the admin credentials from the ACR. I presume using a UserAssigned identity would also solve this issue. My guess would be an issue around the timing of creating the container app & setting the RBAC permissions to its identity. Presumably it tries to pull the image before the role is assigned and gets an unauthorised response and then becomes stuck. — Reply to this email directly, view it on GitHub <#22432 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APPHML6VUG46PGTEKTTWDGLYNZMQ3AVCNFSM6AAAAAA2EAV4ACVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOBUGQ3DSNZVGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Matthew0x]

I had a similar issue when pulling a public image with User-assigned Managed Identity defined on the Container App for accessing a specific Container Registry later on (yet it worked with the same configuration if that image was within the Container Registry).

The workaround in my case was to pull the public image into the Container Registry first (with the same configuration), then the 'Operation expired' timeout would be gone. So something similar to what mpenndev mentioned:

"Terraform twice, once with a public image (for example the hello-world in the Microsoft docs) and the registry block commented out. Then again with the private registry & image."

Also

"On initial creation the container app would be created without a revision. It wouldn't be possible to create a revision either."

Yes, it was also my case.

PS: This issue seems related to (just in the opposite way):
microsoft/azure-container-apps#646

Quote:
"The container app with registry specification fails after 10 minutes with ContainerAppOperationError and error Operation expired while creating a container app resource with failed state."