[Containerapp] az containerapp env storage set: Support Azure Files storage authentication

[Shichao Qiu (ShichaoQiu)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️containerapp

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_identity
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_key_vault_identity
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_key_vault_secret_url

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️ Azure CLI Extensions Breaking Change Test

⚠️ containerapp

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_identity
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_key_vault_identity
⚠️ 1006 - ParaAdd	containerapp env storage set	cmd containerapp env storage set added parameter azure_file_key_vault_secret_url

Summary

• Add Azure Key Vault secret and managed identity authentication to managed environment Azure Files storage.
• Add preview parameters --azure-file-key-vault-secret-url, --azure-file-key-vault-identity, and --azure-file-identity.
• Use the managed environment storage API version 2026-03-02-preview and enforce mutually exclusive authentication modes.
• Add focused unit tests and live scenarios for account key, Key Vault, UAMI, and system-assigned identity transitions.
• Document Managed Identity for SMB and Storage File Data SMB MI Admin prerequisites.

Testing

• python -m compileall -q azext_containerapp
• python -m unittest discover -s azext_containerapp/tests/latest -p '*_unit.py' -v (29 passed)
• Parsed and validated the workspace help YAML for containerapp env storage set.
• Regenerated every recording changed by this PR with CLITestLocation=northcentralusstage and azdev test {test-selector} --live --series:
  • test_container_app_mount_azurefile_e2e passed.
  • test_container_app_mount_nfsazurefile_e2e passed. The first attempt hit a transient Azure StorageAccountOperationInProgress response while creating Premium FileStorage; a clean retry with new resources passed.
  • test_containerapp_env_storage passed.
  • test_containerapp_env_storage_auth_crud passed.
  • test_containerappjob_create_with_yaml passed.
• Replayed the four playback-enabled cases successfully. test_containerapp_env_storage is decorated with @live_only, so playback skips it by design.
• Verified the five live-generated cassettes contain 566 balanced request/response interactions and byte-accurate Content-Length headers.
• Verified Storage account keys and the Key Vault secret value are replaced by the test framework's deterministic placeholder; no live credential values remain.
• Ran azdev scan at LOW, MEDIUM, and HIGH confidence on all five recordings: no findings.
• Final live-recording commit: e6d1986f3.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az containerapp env storage set

General Guidelines

• Have you run azdev style containerapp locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines. (Not applicable: this is an existing extension.)

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

Hi Shichao Qiu (@ShichaoQiu),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Copilot]

Pull request overview

Adds Azure Files authentication via account keys, Key Vault secrets, and managed identities for managed environment storage.

Changes:

• Adds authentication parameters, validation, and payload construction.
• Updates the storage API version and documentation.
• Adds unit and live scenario coverage.

A blocking issue remains: changing the shared API version causes existing cassette-based scenarios to request a different version. Update affected recordings or mark those scenarios live-only.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Summary
src/containerapp/HISTORY.rst	Records the upcoming feature.
src/containerapp/azext_containerapp/tests/latest/test_containerapp_env_storage_unit.py	Tests validation and payloads.
src/containerapp/azext_containerapp/tests/latest/test_containerapp_env_storage_auth.py	Adds live authentication scenarios.
src/containerapp/azext_containerapp/custom.py	Extends the storage command signature.
src/containerapp/azext_containerapp/containerapp_env_storage_decorator.py	Implements authentication handling.
src/containerapp/azext_containerapp/_params.py	Registers preview CLI arguments.
src/containerapp/azext_containerapp/_models.py	Adds authentication payload fields.
src/containerapp/azext_containerapp/_help.py	Documents usage and prerequisites.
src/containerapp/azext_containerapp/_clients.py	Sets the managed storage API version; existing cassettes require updates or live-only handling.

Suppressed comments (2)

src/containerapp/azext_containerapp/_models.py:515

• These fields are added to the shared AzureFileProperties dict, which connected_env_create_or_update_storage uses directly and serializes without removing null values. That unrelated command never sets the new fields, so its requests now include accountKeyVaultProperties: null and identity: null, diverging from the connected-environment API payload and existing recording. Keep a managed-environment template separate or strip these fields from the connected-env payload.

    "accountKeyVaultProperties": None,
    "identity": None,

src/containerapp/azext_containerapp/containerapp_env_storage_decorator.py:77

• Starting from the module-level AzureFileProperties is unsafe here: connected_env_create_or_update_storage uses and mutates the same dictionary (custom.py:2174-2178). If a connected-environment storage command runs earlier in the same process, its accountKey remains set; the Key Vault and managed-identity branches below do not clear it, so this request can contain multiple authentication modes and be rejected. Build from a fresh template or clear all authentication fields before selecting the mode.

            storage_def = deepcopy(AzureFileProperties)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Shichao Qiu (ShichaoQiu)]

Follow-up 2fd4aa612 addresses the active review and PR-specific CI findings:

• Updated all 14 managed-environment storage request URLs in the four affected playback cassettes to 2026-03-02-preview.
• Constructed managed storage payloads from fresh dictionaries so connected-environment model state cannot leak into Key Vault/MI payloads.
• Reduced the decorator to 7 instance attributes, fixing pylint R0902.
• Added --key-vault-secret-url and --key-vault-identity aliases, fixing option_length_too_long while retaining the documented long options.

The rerun now has both azdev-style and azdev-linter green in GitHub Actions and Azure Pipelines. The Python 3.10–3.14 matrix is still running. The previous matrix also contained broad cassette drift from current Azure CLI core Storage/Network API versions across 47 existing Container Apps tests; the storage requests introduced by this PR have been updated independently.

[Yong Zhang (yonzhan)]

Containerapp