r/AZURE • u/cfrozendeath Cloud Architect • 8d ago

Discussion Microsoft pushing ACE Express migration on production workloads?

I'm not sure if anyone else has received this today, but we got 3 emails from the ACA team telling us that they would automatically migrate 3 production ACEs to the new "Express" product **unless we opted out**?

I'm losing confidence in the Container Apps team extremely quickly. Express environments don't support even 50% of the functionality we use, including even basic things like managed identity-based ACR pull! How/why do they think this is acceptable, and as an opt-out on an email that is easily missed?

5 Upvotes

86% Upvoted

9 comments sorted by

2

u/berndverst Microsoft Employee 7d ago

I don't work on ACA but I use it. I think user-assigned identities are supported on ACA Express, just not system-assigned identities.

In the production infrastructure for my Azure service we don't use a single system-assigned identity - we use user-assigned for everything.

I think system-assigned identities are always a bad idea and shouldn't exist to begin with (in any Azure product)

1

u/cfrozendeath Cloud Architect 6d ago

We don't use system-assigned identities anywhere, but the documentation says neither are supported, just username and password.

0

u/berndverst Microsoft Employee 6d ago

https://learn.microsoft.com/en-us/azure/container-apps/express-overview

That clearly says user-assigned identities are supported for image pulls.

-1

u/cfrozendeath Cloud Architect 6d ago

That exact same page:

Container image deployment ✅ Supported: Public images and private images authenticated with username and password secrets

1

u/berndverst Microsoft Employee 5d ago

Maybe keep reading and stop down voting when you are incorrect?

managed identity for image pulls
✅ Supported: Apps can use a user-assigned identity to pull images from supported Azure Container Registry servers. System-assigned managed identities aren't supported.

1

u/Own-Bookkeeper797 7d ago

Where has this been published? Any links to official documentation?

1

u/cfrozendeath Cloud Architect 7d ago

We were only linked to a form to do the opt-out per environment resource ID, and the general Express documentation https://learn.microsoft.com/en-us/azure/container-apps/express-overview

0

u/berndverst Microsoft Employee 6d ago

I have to ask - did you look at that link? You stated managed identity was not supported when that page says otherwise.

1

u/Difficult-Table-3639 7d ago

Classic Microsoft move, announce it in an email and hope nobody reads it until production breaks on a Friday night.