[pragatikushwaha]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️appservice

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_auth_type
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_identity
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_password_setting
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image_username_setting
⚠️ 1006 - ParaAdd	functionapp create	cmd functionapp create added parameter deployment_image
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_auth_type
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_identity
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_password_setting
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image_username_setting
⚠️ 1006 - ParaAdd	functionapp deployment config set	cmd functionapp deployment config set added parameter deployment_image

Related command
az functionapp create
az functionapp deployment config set
az functionapp deployment config show
az functionapp show

Description
Flex Consumption apps can run a container image by setting functionAppConfig.deployment.storage.type to Registry (Microsoft.Web API version 2025-05-01). This PR adds CLI support for configuring it.

New arguments, in a Flex Registry Deployment argument group on az functionapp create and az functionapp deployment config set:

Argument	Alias	Notes
--deployment-image		Image reference (tag, digest, or tag and digest). Sent unchanged.
--deployment-image-auth-type	--diat	Anonymous, SystemAssignedIdentity, UserAssignedIdentity, or Basic.
--deployment-image-identity	--dii	User-assigned identity resource ID. UserAssignedIdentity only.
--deployment-image-username-setting	--dius	Name of the app setting that stores the registry username. Basic only.
--deployment-image-password-setting	--dips	Name of the app setting that stores the registry password. Basic only.

Behavior:

• Each authentication mode sends exactly its own fields. Arguments that don't apply to the selected mode are rejected before any request is sent. Basic takes username and password app-setting names; the CLI never accepts a registry password and never reads app settings.
• As requested in review, neither create nor config set accepts --deployment-image-server-url/--diurl. A newly constructed Basic authentication object contains only type, usernameSettingName, and passwordSettingName (no serverUrl). A site that already has a service-set serverUrl may still show it and preserve it when authentication is not replaced; explicitly replacing authentication writes only the supplied mode's fields. This narrows the CLI from the current ADO task/GitHub Add missing pyyaml dependency in setup.py #86/Provide TSV (tab separated values) output formatter  #88 optional-field criterion, without changing the Microsoft.Web API schema; owner confirmation and task-criterion alignment are pending.
• The CLI requires a non-empty image but doesn't parse or validate OCI syntax. Service validation errors are surfaced as returned.
• az functionapp create --deployment-image ... builds a Registry functionAppConfig without a runtime and explicitly sends siteUpdateStrategy.type = Recreate, matching the service default. --runtime, --runtime-version, --environment, --deployment-storage-*, and the legacy --registry-* arguments are rejected. --maximum-instance-count defaults to 1000 for Registry creates (per review request, with owner sign-off still needed), and --instance-memory defaults to 2048 MB; existing Blob create defaults are unchanged. --always-ready-instances is supported, and Application Insights is created unless --disable-app-insights is set. Registry image configuration does not automatically assign identities or grant registry access; use --assign-identity, --role AcrPull, and --scope for that.
• az functionapp deployment config set --deployment-image ... reads the site at 2025-05-01, updates only deployment.storage, removes functionAppConfig.runtime, and writes the site back with a single PUT at 2025-05-01, so other properties are preserved. Switching from blob storage requires both the image and the authentication type; on an app that already uses Registry storage, either can be updated alone only when the retained counterpart is non-empty. The merged configuration must contain a non-empty image and authentication type before any PUT; supplying valid values can repair missing stored configuration. Blob and Registry arguments can't be combined, and blob arguments are rejected on Registry apps.
• az functionapp show and az functionapp deployment config show use their existing raw 2023-12-01 reads, without a Registry-specific second GET. The full returned JSON preserves Registry authentication and unknown fields without older-schema projection. show_functionapp matches the baseline implementation exactly; non-Flex apps and slots retain their existing SDK/configuration/publishing-information path. Credential values are never retrieved; Basic shows only the app setting names.
• Existing Flex scale, always-ready, and update-strategy writes also preserve Registry authentication: they use the existing raw 2023-12-01 GET, remove response-only null fields/runtime for Registry, and PUT Registry configuration at 2025-05-01. Blob apps keep their original GET/PUT requests at 2023-12-01. az functionapp runtime config set rejects Registry apps because they have no runtime. The explicit newer API remains on new Registry deployment writes to honor the published contract; redundant read/identity version switching has been removed.
• Registry az functionapp identity assign and az functionapp identity remove use normal SDK API selection, without Registry-specific GET/PUT overrides, and preserve Basic authentication setting names and unknown configuration. The unused runtime and other modes' null fields are still omitted in the identity PUT. Real-SDK transport tests cover default-version requests for Registry Basic, Blob, and non-Flex apps; Blob and non-Flex requests remain unchanged.
• Existing blob storage behavior and legacy Linux container settings (az functionapp config container) are unchanged.

Testing Guide

# Create a Flex Consumption app that pulls from Azure Container Registry with its system-assigned identity
az functionapp create -g MyResourceGroup -n MyApp -s MyStorageAccount --flexconsumption-location eastus \
    --deployment-image myregistry.azurecr.io/myimage@sha256:<digest> --deployment-image-auth-type SystemAssignedIdentity \
    --assign-identity [system] --role AcrPull --scope <acr-resource-id>

# Switch an existing Flex Consumption app to a container image pulled with a user-assigned identity
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image myregistry.azurecr.io/myimage:v1 \
    --deployment-image-auth-type UserAssignedIdentity --deployment-image-identity <identity-resource-id>

# On the existing Registry app, change only the authentication to Basic, with the credentials stored in app settings
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image-auth-type Basic \
    --deployment-image-username-setting REGISTRY_USERNAME --deployment-image-password-setting REGISTRY_PASSWORD

# A subsequent scale update preserves the Registry Basic authentication references
az functionapp scale config set -g MyResourceGroup -n MyApp --maximum-instance-count 50
az functionapp deployment config show -g MyResourceGroup -n MyApp
az functionapp show -g MyResourceGroup -n MyApp --query properties.functionAppConfig

Tests:

• test_functionapp_commands_thru_mock.py: TestFlexRegistryDeploymentConfigMocked, TestFlexRegistryIdentityMocked, TestFlexRegistryCreateMocked, and TestFlexRegistryArgumentParsing cover exact request payloads and API versions for every authentication mode and image form, set/show round-trips through both show commands (blob requests unchanged), partial updates, missing/null/empty merged image/authentication rejection without writing, repair of invalid stored configuration, non-Flex app/slot routing, rejection of invalid arguments without writing, a service rejection followed by a show that returns the previous configuration, absence of secrets in debug logs and in set/show output, preservation of Registry authentication across scale/always-ready/update-strategy and real-SDK identity assign/remove writes with Blob HTTP requests unchanged, runtime-set rejection, create conflicts and defaults, legacy container markers never set on create (container kind, linuxFxVersion, DOCKER_* settings), and argument aliases, including rejection of both removed server URL flags.
• test_functionapp_commands.py: live scenario test_functionapp_flex_registry_deployment (FunctionAppFlex is a LiveScenarioTest) covers create, both show commands, identity and Basic updates, digest and tag-plus-digest images, and a rejected update followed by show.

Review and rollout

• Owner sign-off is needed for argument names/aliases, the Registry-only 1000 scale default (1000 is a documented scale-out ceiling, while the existing Blob default is 100), default Application Insights behavior, and this CLI-only omission of the optional service serverUrl. The complete mocked command test file passes against the actual CLI 2.91 source (68 tests, 58 subtests); full App Service pylint/PEP8 and the command/help linter with CI exclusions pass. Changed Python compilation, help YAML parsing, baseline show-implementation comparison, and whitespace checks also pass. Full remote CI and live Registry E2E are separate release gates. On this head, the repo-wide style jobs fail on the same pre-existing ACS, SQL, and CLI-core diagnostics seen on the prior head, with no App Service style diagnostics; live E2E has not run on this head and requires a Registry-enabled region and the published 2025-05-01 contract.
• Preservation is validated for this CLI and its current SDK models; other CLI/SDK versions and other full-site writers require separate compatibility validation. No migration, new dependency, feature flag, or telemetry is introduced; rollback is a revert commit. The current task contract accepts explicit tag-only, digest-only, and tag-plus-digest references; the CLI transmits them unchanged for service validation.

History Notes
[App Service] az functionapp create: Add --deployment-image and related arguments to create Flex Consumption apps that run a container image
[App Service] az functionapp deployment config set: Add --deployment-image and related arguments to configure container image deployment for Flex Consumption apps
[App Service] az functionapp show, az functionapp deployment config show: Return the container image deployment configuration of Flex Consumption apps
[App Service] az functionapp scale config set, az functionapp scale config always-ready set, az functionapp scale config always-ready delete, az functionapp update-strategy config set: Preserve Registry authentication in Flex configuration updates
[App Service] az functionapp identity assign, az functionapp identity remove: Preserve Registry authentication through identity changes
[App Service] az functionapp runtime config set: Explain that Registry-based Flex apps have no runtime to update

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Copilot review overview

🟡 Changes recommended

A post-create identity update can erase Basic Registry authentication fields by rewriting the site through an older API.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve Basic Registry credentials during identity assignment · New
• Add deployment images to Registry authentication examples · New

What changed in this PR

Adds Flex Consumption Registry deployment storage support to App Service commands.

Changes:

• Adds Registry image/authentication arguments and validation.
• Uses API 2025-05-01 while preserving Registry configuration.
• Adds help, mocked tests, and a live scenario.

File	Description
utils.py	Supports explicit API versions for raw reads.
custom.py	Implements Registry create, update, show, and preservation logic.
_params.py	Registers Registry deployment arguments.
_help.py	Documents Registry workflows and examples.
_constants.py	Defines auth modes, API version, and defaults.
test_functionapp_commands.py	Adds live Registry coverage.
test_functionapp_commands_thru_mock.py	Adds request, validation, and preservation tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[JaysonTaiMicrosoft]

pragatikushwaha As live only scenario tests are not run in CI. Please provide evidence of live tests passing azdev test test_functionapp_flex_registry_deployment --live --discover i.e screenshot. I pulled the branch and was unable to have a successful test run.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

pragatikushwaha

Agent review: Registry creation failed live validation

Upstream CI succeeded, but the new Registry create scenario failed on this head; service compatibility and end-to-end coverage are not established.

Failure groups: 1 PR-related, 0 not PR-related, 0 uncertain. The failure exercises changed behavior; its underlying cause (request contract versus regional feature enablement) remains uncertain. No additional deterministic findings, lesson matches, or pending Copilot reviewer comments were returned.

Upstream CI

Upstream CI succeeded: 52/52 passed; 0 failed; 0 pending. Latest completion: 2026-10-16T12:01:03Z.

Test validation

• Live test: Failed with conclusion failure. Workflow run
• Regression coverage: For appservice: 2 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. Changed tests invoke az functionapp create, but invocation alone does not verify the required scenario or output. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Agent live-test evidence: Reused run 38892834955, completed with failure from 2026-10-16T11:17:52Z to 11:22:16Z, tested 1dbc022fea015c36ebec80e2ed3d7f5b77db4e1b. Its sanitized results.xml reports 1 executed, 1 failed, 0 passed; output says "collecting ... collected 71 items" and "stopping after 1 failures". The mocked file was selected, but this run does not establish that its tests executed. Playback verification and recording publication were skipped.

Author/mocked evidence: tests/latest/test_functionapp_commands_thru_mock.py checks exact authentication payloads, preservation, argument rejection and service-error propagation using a synthetic ARM responder; create mocks the SDK operation. These assertions are meaningful but do not validate the live service accepting a runtime-less Registry payload. Author-reported local passes are distinct from both upstream CI and this failed Agent run.

Confirmed finding

P1 — Registry creation is rejected in the tested region. In src/azure-cli/azure/cli/command_modules/appservice/custom.py:1771-1789, the new builder omits runtime; create_functionapp:10680-10704 passes that config to the 2025-05-01 site-create operation. The added tests/latest/test_functionapp_commands.py:1782 call using UserAssignedIdentity and --assign-identity fails before its assertions in eastasia (the test-region constant at line 33).

Failed job, artifact live-test-pr-34147 / results.xml:

Site.FunctionAppConfig.Runtime is invalid. Runtime name and version must be provided.

Relevance: PR-related because the failing test invokes the newly added deployment-image create path. This is not evidence of an authentication/quota failure or of a pre-existing flake. The trace does not identify whether initial creation or a subsequent full-site write returned the service error, and does not prove whether Registry support is enabled in this region.

Next action / focused verification: The App Service owner should confirm the Registry-enabled region and published API contract, then inspect the sanitized failed request and response to identify the rejected write. If the region lacks the feature, use a supported test region; otherwise align that write with the supported contract. Do not blindly add runtime or change unrelated source based on this error. Rerun only azdev test appservice.test_functionapp_flex_registry_deployment --live at the reviewed head in the verified region, then azdev test appservice.test_functionapp_commands_thru_mock and the complete changed live scenario; no rerun was dispatched here.

Recording/coverage attention: No recordings changed. The new scenario is a LiveScenarioTest; the first create failure leaves show, Basic updates, digest updates and Blob-to-Registry conversion unvalidated live. The outgoing Registry GET/PUT API-version and runtime/authentication-field changes need service-backed evidence. For durable playback coverage, add a recording-capable scenario alongside src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_functionapp_commands.py, with its cassette under tests/latest/recordings/test_functionapp_flex_registry_deployment.yaml, and verify focused playback after recording. Do not treat synthetic ARM responses or passing CI as proof of this service contract.

Risk assessment

60/100 · High

The High rating is driven by security-sensitive behavior, public CLI behavior, failure-handling behavior.

• Change scope: 7 changed files, 989 changed lines (+950 / -39), including 5 production files.
• Affected components: appservice
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); failure-handling behavior (+12)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for appservice before merge.

Posted by x-engineering-agent (Reviewer)

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[JaysonTaiMicrosoft]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[pragatikushwaha]

pragatikushwaha As live only scenario tests are not run in CI. Please provide evidence of live tests passing azdev test test_functionapp_flex_registry_deployment --live --discover i.e screenshot. I pulled the branch and was unable to have a successful test run.

Could you please consider an exception for this test as no region is fully ready for this yet, this feature is in preview?

Registry deployment storage is not yet enabled in East US 2 EUAP, so we cannot complete the managed-identity test there. NCUS Stage has Registry enabled, but Managed Identity is unavailable in that Stage region, so identity assignment fails for an environment reason unrelated to the CLI change.

We are targeting Public Preview for Ignite in mid-November. We need the CLI changes merged to validate the beta tooling flow. Waiting for EUAP enablement would delay this testing.

To limit exposure, all five new Registry arguments are marked Preview, while the existing App Service service-side flag remains the actual availability gate. We will remove the Preview designation in a follow-up PR when service-side end-to-end validation is complete and the feature is GA-ready.

[x-engineering-agent]

Automated sensitive-information remediation ran on this pull request.

Known credential formats (structurally valid; automation stays paused until they are removed or a maintainer disputes them):

• PR comment 42 by pragatikushwaha — jwt (expired token)

X Engineering Agent cannot edit another user's text, so these authors should edit their own comments: pragatikushwaha

The detected tokens have expired, but a real token from a recording should still be replaced with a sanitized value.

If this is not sensitive, react 👎 on this comment. A 👎 from anyone clears possible secrets; known credential formats need a maintainer's 👎. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

[JaysonTaiMicrosoft]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).