[App Service] az functionapp create, az functionapp deployment config set: Add Flex Consumption Registry deployment storage support

[pragatikushwaha]

Related command
az functionapp create
az functionapp deployment config set
az functionapp deployment config show
az functionapp show

Description
Flex Consumption apps can run a container image by setting functionAppConfig.deployment.storage.type to Registry (Microsoft.Web API version 2025-05-01). This PR adds CLI support for configuring it.

New arguments, in a Flex Registry Deployment argument group on az functionapp create and az functionapp deployment config set:

Argument	Alias	Notes
--deployment-image		Image reference (tag, digest, or tag and digest). Sent unchanged.
--deployment-image-auth-type	--diat	Anonymous, SystemAssignedIdentity, UserAssignedIdentity, or Basic.
--deployment-image-identity	--dii	User-assigned identity resource ID. UserAssignedIdentity only.
--deployment-image-username-setting	--dius	Name of the app setting that stores the registry username. Basic only.
--deployment-image-password-setting	--dips	Name of the app setting that stores the registry password. Basic only.

Behavior:

• Each authentication mode sends exactly its own fields. Arguments that don't apply to the selected mode are rejected before any request is sent. Basic takes username and password app-setting names; the CLI never accepts a registry password and never reads app settings.
• As requested in review, neither create nor config set accepts --deployment-image-server-url/--diurl. A newly constructed Basic authentication object contains only type, usernameSettingName, and passwordSettingName (no serverUrl). A site that already has a service-set serverUrl may still show it and preserve it when authentication is not replaced; explicitly replacing authentication writes only the supplied mode's fields. This narrows the CLI from the current ADO task/GitHub Add missing pyyaml dependency in setup.py #86/Provide TSV (tab separated values) output formatter  #88 optional-field criterion, without changing the Microsoft.Web API schema; owner confirmation and task-criterion alignment are pending.
• The CLI requires a non-empty image but doesn't parse or validate OCI syntax. Service validation errors are surfaced as returned.
• az functionapp create --deployment-image ... builds a Registry functionAppConfig without a runtime and explicitly sends siteUpdateStrategy.type = Recreate, matching the service default. --runtime, --runtime-version, --environment, --deployment-storage-*, and the legacy --registry-* arguments are rejected. --maximum-instance-count defaults to 1000 for Registry creates (per review request, with owner sign-off still needed), and --instance-memory defaults to 2048 MB; existing Blob create defaults are unchanged. --always-ready-instances is supported, and Application Insights is created unless --disable-app-insights is set. Registry image configuration does not automatically assign identities or grant registry access; use --assign-identity, --role AcrPull, and --scope for that.
• az functionapp deployment config set --deployment-image ... reads the site at 2025-05-01, updates only deployment.storage, removes functionAppConfig.runtime, and writes the site back with a single PUT at 2025-05-01, so other properties are preserved. Switching from blob storage requires both the image and the authentication type; on an app that already uses Registry storage, either can be updated alone only when the retained counterpart is non-empty. The merged configuration must contain a non-empty image and authentication type before any PUT; supplying valid values can repair missing stored configuration. Blob and Registry arguments can't be combined, and blob arguments are rejected on Registry apps.
• az functionapp show and az functionapp deployment config show use their existing raw 2023-12-01 reads, without a Registry-specific second GET. The full returned JSON preserves Registry authentication and unknown fields without older-schema projection. show_functionapp matches the baseline implementation exactly; non-Flex apps and slots retain their existing SDK/configuration/publishing-information path. Credential values are never retrieved; Basic shows only the app setting names.
• Existing Flex scale, always-ready, and update-strategy writes also preserve Registry authentication: they use the existing raw 2023-12-01 GET, remove response-only null fields/runtime for Registry, and PUT Registry configuration at 2025-05-01. Blob apps keep their original GET/PUT requests at 2023-12-01. az functionapp runtime config set rejects Registry apps because they have no runtime. The explicit newer API remains on new Registry deployment writes to honor the published contract; redundant read/identity version switching has been removed.
• Registry az functionapp identity assign and az functionapp identity remove use normal SDK API selection, without Registry-specific GET/PUT overrides, and preserve Basic authentication setting names and unknown configuration. The unused runtime and other modes' null fields are still omitted in the identity PUT. Real-SDK transport tests cover default-version requests for Registry Basic, Blob, and non-Flex apps; Blob and non-Flex requests remain unchanged.
• Existing blob storage behavior and legacy Linux container settings (az functionapp config container) are unchanged.

Testing Guide

# Create a Flex Consumption app that pulls from Azure Container Registry with its system-assigned identity
az functionapp create -g MyResourceGroup -n MyApp -s MyStorageAccount --flexconsumption-location eastus \
    --deployment-image myregistry.azurecr.io/myimage@sha256:<digest> --deployment-image-auth-type SystemAssignedIdentity \
    --assign-identity [system] --role AcrPull --scope <acr-resource-id>

# Switch an existing Flex Consumption app to a container image pulled with a user-assigned identity
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image myregistry.azurecr.io/myimage:v1 \
    --deployment-image-auth-type UserAssignedIdentity --deployment-image-identity <identity-resource-id>

# On the existing Registry app, change only the authentication to Basic, with the credentials stored in app settings
az functionapp deployment config set -g MyResourceGroup -n MyApp --deployment-image-auth-type Basic \
    --deployment-image-username-setting REGISTRY_USERNAME --deployment-image-password-setting REGISTRY_PASSWORD

# A subsequent scale update preserves the Registry Basic authentication references
az functionapp scale config set -g MyResourceGroup -n MyApp --maximum-instance-count 50
az functionapp deployment config show -g MyResourceGroup -n MyApp
az functionapp show -g MyResourceGroup -n MyApp --query properties.functionAppConfig

Tests:

• test_functionapp_commands_thru_mock.py: TestFlexRegistryDeploymentConfigMocked, TestFlexRegistryIdentityMocked, TestFlexRegistryCreateMocked, and TestFlexRegistryArgumentParsing cover exact request payloads and API versions for every authentication mode and image form, set/show round-trips through both show commands (blob requests unchanged), partial updates, missing/null/empty merged image/authentication rejection without writing, repair of invalid stored configuration, non-Flex app/slot routing, rejection of invalid arguments without writing, a service rejection followed by a show that returns the previous configuration, absence of secrets in debug logs and in set/show output, preservation of Registry authentication across scale/always-ready/update-strategy and real-SDK identity assign/remove writes with Blob HTTP requests unchanged, runtime-set rejection, create conflicts and defaults, legacy container markers never set on create (container kind, linuxFxVersion, DOCKER_* settings), and argument aliases, including rejection of both removed server URL flags.
• test_functionapp_commands.py: live scenario test_functionapp_flex_registry_deployment (FunctionAppFlex is a LiveScenarioTest) covers create, both show commands, identity and Basic updates, digest and tag-plus-digest images, and a rejected update followed by show.

Review and rollout

• Owner sign-off is needed for argument names/aliases, the Registry-only 1000 scale default (1000 is a documented scale-out ceiling, while the existing Blob default is 100), default Application Insights behavior, and this CLI-only omission of the optional service serverUrl. The complete mocked command test file passes against the actual CLI 2.91 source (68 tests, 58 subtests); full App Service pylint/PEP8 and the command/help linter with CI exclusions pass. Changed Python compilation, help YAML parsing, baseline show-implementation comparison, and whitespace checks also pass. Full remote CI and live Registry E2E are separate release gates. On this head, the repo-wide style jobs fail on the same pre-existing ACS, SQL, and CLI-core diagnostics seen on the prior head, with no App Service style diagnostics; live E2E has not run on this head and requires a Registry-enabled region and the published 2025-05-01 contract.
• Preservation is validated for this CLI and its current SDK models; other CLI/SDK versions and other full-site writers require separate compatibility validation. No migration, new dependency, feature flag, or telemetry is introduced; rollback is a revert commit. The current task contract accepts explicit tag-only, digest-only, and tag-plus-digest references; the CLI transmits them unchanged for service validation.

History Notes
[App Service] az functionapp create: Add --deployment-image and related arguments to create Flex Consumption apps that run a container image
[App Service] az functionapp deployment config set: Add --deployment-image and related arguments to configure container image deployment for Flex Consumption apps
[App Service] az functionapp show, az functionapp deployment config show: Return the container image deployment configuration of Flex Consumption apps
[App Service] az functionapp scale config set, az functionapp scale config always-ready set, az functionapp scale config always-ready delete, az functionapp update-strategy config set: Preserve Registry authentication in Flex configuration updates
[App Service] az functionapp identity assign, az functionapp identity remove: Preserve Registry authentication through identity changes
[App Service] az functionapp runtime config set: Explain that Registry-based Flex apps have no runtime to update

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Copilot review overview

🟡 Changes recommended

A post-create identity update can erase Basic Registry authentication fields by rewriting the site through an older API.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve Basic Registry credentials during identity assignment · New
• Add deployment images to Registry authentication examples · New

What changed in this PR

Adds Flex Consumption Registry deployment storage support to App Service commands.

Changes:

• Adds Registry image/authentication arguments and validation.
• Uses API 2025-05-01 while preserving Registry configuration.
• Adds help, mocked tests, and a live scenario.

File	Description
utils.py	Supports explicit API versions for raw reads.
custom.py	Implements Registry create, update, show, and preservation logic.
_params.py	Registers Registry deployment arguments.
_help.py	Documents Registry workflows and examples.
_constants.py	Defines auth modes, API version, and defaults.
test_functionapp_commands.py	Adds live Registry coverage.
test_functionapp_commands_thru_mock.py	Adds request, validation, and preservation tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yong Zhang (yonzhan)]

Please fix CI issues

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).