az containerapp env update --dns-suffix is silently ignored (dnsSuffix never sent in PATCH)

Read src/containerapp/azext_containerapp/containerapp_env_decorator.py, especially ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration(), and compare it with the create decorator. Run the documented az containerapp env update command, inspect the PATCH body, and verify with az containerapp env show that customDomainConfiguration.dnsSuffix contains the supplied value.

Describe the bug

az containerapp env update --dns-suffix <suffix> --certificate-file <pfx> --certificate-password <pwd>
reports success (HTTP 200) but the custom DNS suffix is never applied. After the command,
az containerapp env show ... --query properties.customDomainConfiguration returns
dnsSuffix: null (and certificateValue/thumbprint also null).

Inspecting the outgoing PATCH request body shows customDomainConfiguration contains
certificateValue / certificatePassword / certificateKeyVaultProperties, but no dnsSuffix —
so the --dns-suffix value is silently dropped on update.

Root cause (source)

In src/containerapp/azext_containerapp/containerapp_env_decorator.py:

• The create decorator ContainerappEnvPreviewCreateDecorator._set_up_custom_domain_configuration()
  correctly sets custom_domain["dnsSuffix"] = self.get_argument_hostname().
• The update decorator ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration()
  only does:

  safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificateValue", value=blob)
  safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificatePassword", value=...)
  safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificateKeyVaultProperties", value=None)
  

  It never sets dnsSuffix and never reads --dns-suffix (the hostname argument). As a result
  --dns-suffix is a no-op on env update.

This is still present on the main branch as of 2026-06-17.

To Reproduce

1. Create a Container Apps environment (e.g. internal or external).
2. Run:

   az containerapp env update \
     --name <env> --resource-group <rg> \
     --dns-suffix example.contoso.com \
     --certificate-file ./cert.pfx \
     --certificate-password <pwd>
   

3. Check the result:

   az containerapp env show --name <env> --resource-group <rg> \
     --query properties.customDomainConfiguration
   

   dnsSuffix is null (the certificate fields are also not effectively applied because the
   configuration is incomplete).

Expected behavior

customDomainConfiguration.dnsSuffix is set to the value passed via --dns-suffix, exactly as it is
on az containerapp env create.

Suggested fix

In ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration(), set the suffix when
provided, e.g.:

if self.get_argument_hostname():
    safe_set(self.managed_env_def, "properties", "customDomainConfiguration",
             "dnsSuffix", value=self.get_argument_hostname())

Environment

• containerapp extension: 1.3.0b4 (bug also present on main)
• azure-cli: 2.87.0
• OS: Windows

Workaround

Set the custom DNS suffix at az containerapp env create time, or via a direct REST PATCH:

az rest --method patch \
  --url "https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.App/managedEnvironments/<env>?api-version=2024-03-01" \
  --body '{"properties":{"customDomainConfiguration":{"dnsSuffix":"example.contoso.com","certificateValue":"<base64-pfx>","certificatePassword":"<pwd>"}}}'