Purge task fails with 401 after 3 hours on ABAC-enabled registries

Open
#641 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
azure, go
Domain
authentication, cli, cloud

Research direction

Start at the acr purge entry point and trace refreshAcrCLIClientToken() through GetAcrAccessToken, focusing on the 3-hour refresh-token expiry and the 401 path. Verify the long-running ABAC-enabled ACR Task case; the work is done when purge completes beyond three hours without regressing non-ABAC registries.

Written by the indexing model from the issue text.

Description

bug

Describe the bug
When running acr purge as an ACR Task on an ABAC-enabled registry, the operation fails with HTTP 401 after approximately 3 hours. The ACR refresh token has a 3-hour TTL. The acr-cli's refreshAcrCLIClientToken() only refreshes the short-lived access token using the stored ACR refresh token, when the refresh token itself expires, GetAcrAccessToken returns 401 and there is no recovery path.

Non-ABAC registries are unaffected because they receive a longer self-issued token from the Tasks scheduler.

To Reproduce
Steps to reproduce the behavior:

  1. Create an ACR Task with a purge step targeting an ABAC-enabled registry with a large number of images (requiring >3 hours to complete)
  2. Run the task
  3. After ~3 hours, the task fails with: acr.BaseClient#GetAcrAccessToken: Failure responding to request: StatusCode=401

Expected behavior
The purge operation should complete successfully regardless of duration by renewing the refresh token when it expires.

Any relevant environment information

  • acr-cli version: v0.19 (also affects v0.18 and all prior versions)
  • Registry: ABAC-enabled
  • Task trigger: Timer-triggered scheduled task

Additional context

  • Workaround: Split purge into multiple tasks with --filter patterns (each <3hrs), increase --concurrency, or run more frequently to prevent backlog.
Dominant language
Go
Stars
70
Forks
52
Avg merge
2d 12h
Merged PRs (30d)
10

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure/acr-cli

All issues in Azure/acr-cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.