Fix VLW container cleanup in Resource-Helpers to handle soft-deleted blob versions#14973
Fix VLW container cleanup in Resource-Helpers to handle soft-deleted blob versions#14973
Conversation
ibrandes
changed the title
|
The following pipelines have been queued for testing: |
There was a problem hiding this comment.
Pull request overview
This PR improves storage account cleanup in Resource-Helpers.ps1 by adding VLW (versioned immutable) container-specific blob deletion that can see and delete soft-deleted blobs and non-current versions, preventing container deletion failures when soft-delete is enabled.
Changes:
- Route VLW containers through a new version-aware cleanup path in
RemoveStorageAccount. - Add
Remove-VlwContainerBlobsto enumerate-IncludeVersion -IncludeDeleted, clear legal hold/immutability, and delete blobs over multiple passes.
| $blobs = @($Container | Get-AzStorageBlob -IncludeVersion -IncludeDeleted -ErrorAction SilentlyContinue) | ||
|
|
There was a problem hiding this comment.
Get-AzStorageBlob is invoked with -ErrorAction SilentlyContinue. If listing fails (auth/network/unsupported flags), this function will silently do nothing and container deletion will still fail later with minimal diagnostics. Consider using -ErrorAction Stop with a try/catch that emits a warning/error (or at least logs when listing fails) so failures are actionable.
| $blobs = @($Container | Get-AzStorageBlob -IncludeVersion -IncludeDeleted -ErrorAction SilentlyContinue) | |
| try { | |
| $blobs = @($Container | Get-AzStorageBlob -IncludeVersion -IncludeDeleted -ErrorAction Stop) | |
| } catch { | |
| Write-Warning "Failed to list blobs for VLW container '$($Container.Name)' in storage account '$StorageAccountName'. Cleanup cannot continue for this container. $($_.Exception.Message)" | |
| break | |
| } |
| try { | ||
| $blob | Remove-AzStorageBlob -Force | ||
| } catch { | ||
| # Deleting the current version by version ID returns 403 | ||
| # (OperationNotAllowedOnRootBlob); fall back to base blob deletion. | ||
| try { | ||
| Remove-AzStorageBlob -Container $Container.Name -Blob $blob.Name -Context $Container.Context -Force | ||
| } catch { } |
There was a problem hiding this comment.
The catch around versioned deletion falls back to deleting the base blob for any exception, not just the expected 403 OperationNotAllowedOnRootBlob scenario. This can mask real failures (e.g., permission/timeout) and still attempt a different destructive operation. Consider narrowing the fallback to the specific error code/message you expect and logging/rethrowing unexpected errors.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
The following pipelines have been queued for testing: |
Summary
Remove-VlwContainerBlobsfunction that lists blobs with-IncludeVersion -IncludeDeletedand clears immutability policies / legal holds before deleting each version across multiple passesRemoveStorageAccount, leaving non-VLW containers on the existingEnableBlobDeletionpathProblem
When soft-delete is enabled on a storage account, deleting a blob in a VLW container creates a non-current version instead of truly removing it. The existing cleanup in
RemoveStorageAccountuses a basicGet-AzStorageBloblisting that can't see these leftover versions. They silently block container deletion, causing the management planeDELETEto return 409 Conflict.Approach
The new
Remove-VlwContainerBlobsfunction:-IncludeVersion -IncludeDeleted)OperationNotAllowedOnRootBlob)