Repository navigation
Azure recipe validation fails: secrets Terraform destroy error and containers delete hang #400
Description
Summary
The Azure recipe validation workflow (validate-azure-recipes.yaml) fails on all branches since about 2026-10-17. The failure is not specific to one PR. Two jobs fail for two different causes.
1. Validate Azure terraform Recipes: secrets destroy fails
The Security/secrets/recipes/azure/terraform test deploys successfully. The cleanup step then fails:
ERROR CODE: RecipeDeletionFailed
terraform destroy failure: exit status 1
Error: Invalid combination of arguments
with module.default.azurerm_key_vault_secret.secrets["password"],
on .terraform/modules/default/main.tf line 45, in resource "azurerm_key_vault_secret" "secrets":
"value_wo": one of `value,value_wo` must be specified
main.tf sets value = each.value.value. During the delete, the value appears to be null. azurerm ~> 5.0 then rejects the configuration. Possible causes: Radius now removes secret values from the recipe context on delete, or a new azurerm 5.x release made this validation more strict.
2. Validate Azure bicep Recipes: containers delete stops responding
The Compute/containers/recipes/azure/bicep test deploys successfully. The cleanup step then stops at:
Deleting .../Radius.Compute/containers/myApp...
Deleting .../Radius.Compute/containers/no-connections-app...
Deleting .../Radius.Compute/persistentVolumes/mypersistentvolume...
Deleting .../Radius.Security/secrets/app-secrets-...
##[error]The operation was canceled.
The job reaches its 30-minute limit, and GitHub Actions cancels it. The log does not show which resource delete stops.
Evidence
| Run | Branch | Terraform job | Bicep job |
|---|---|---|---|
| 39246859429 | Dependabot (github-actions-2fa895ee6d) |
secrets destroy error | delete hang, canceled |
| 39069777843 | nicolejms-add-volume-route-tests (#397) |
secrets destroy error | delete hang, canceled |
| 38976170118 | merge queue for #397 | failure | delete hang, canceled |
The last successful run on main was 38802387050 on 2026-10-15.
Suggested next steps
- Find out what changed after 2026-10-15: the Radius edge release, the azurerm 5.x provider version, or both.
- For the secrets Terraform recipe, make the delete path work when the secret values are not available.
- For the Bicep delete hang, collect the Radius pod logs (the workflow uploads them as an artifact) and find the resource that does not finish deleting.
Activity
nicolejms commentedon Oct 19, 2026
Root cause
The failures started when the Radius edge build changed from
567e652(last passing run, 2026-10-16) to97e14dc(failing runs). The four new commits change only theradCLI. The relevant commit is radius-project/radius#13306 (162d61c), "make rad app commands target Radius.Core without --preview".That change did not add the bugs. It made CI run delete paths that CI did not run before:
.github/scripts/lib-recipe-test.sh(lines 212-228) runsrad app delete. The test apps areRadius.Core/applications.rad app deletelooked only forApplications.Core/applications. The passing logs showApplications.Core/applications/testapp-... not found. The command deleted nothing, so the Azure recipe delete paths never ran.rad app deleteusesRadius.Coreand deletes each resource (Deleting N resource(s) associated with application ...). This shows two bugs that were already in the recipe delete paths:Security/secretsAzure Terraform:terraform destroyfails because the secret value is null during the delete.Compute/containersAzure Bicep: the delete of the app resources stops responding.Side effect
Before this change, the Azure test runs did not delete their resources. Some test resources (for example, Key Vaults and container groups) may still be left in the CI Azure resource group. Examine the resource group and remove these resources.
Print one line for each sweep error in cleanup-azure-resources.sh
Guard Azure secret inputs and remove the deployment script workaround
Fix Azure Terraform secret deletion (radius-project#401)
nicolejms commentedon Oct 20, 2026
radius-project/radius#13342
fix(recipes): delete Key Vault secrets through managed parent vaults (r…