[2.32.0] az aks update --enable-secret-rotation fails : 'NoneType' object does not support item assignment

This is autogenerated. Please review and update as needed.

Describe the bug

az aks update --enable-secret-rotation fails with opaque error.

Command Name az aks update

Errors:

The command failed with an unexpected error. Here is the traceback:
'NoneType' object does not support item assignment
Traceback (most recent call last):
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 231, in invoke
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 658, in execute
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 721, in _run_jobs_serially
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 692, in _run_job
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 328, in __call__
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acs/custom.py", line 2298, in aks_update
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acs/decorator.py", line 5886, in update_default_mc_profile
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acs/decorator.py", line 5832, in update_addon_profiles
  File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acs/decorator.py", line 5766, in update_azure_keyvault_secrets_provider_addon_profile
TypeError: 'NoneType' object does not support item assignment

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

Not sure if there are other preconditions unique to my environment. If it is useful, I enabled the plugin via Bicep template as such:

addonProfiles: {
      azureKeyvaultSecretsProvider: {
        enabled: true
      }
    }

• az aks update -g {} -n {} --enable-secret-rotation

Expected Behavior

Autorotation is enabled.

Environment Summary

Windows-10-10.0.22000-SP0
Python 3.8.9
Installer: MSI

azure-cli 2.32.0 *

Extensions:
azure-devops 0.20.0
ssh 1.0.0

```json
{
  "azure-cli": "2.32.0",
  "azure-cli-core": "2.32.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {
    "azure-devops": "0.22.0",
    "ssh": "1.0.0"
  }
}

## Additional Context

<!--Please don't remove this:-->
<!--auto-generated-->

[ianjirka]

I ran into a similar issue as the person on the other thread - I can’t remove because it is in use

>az aks disable-addons -g x --name y -a azure-keyvault-secrets-provider
The behavior of this command has been altered by the following extension: aks-preview
(BadRequest) AzureKeyvaultSecretsProvider addon cannot be disabled due to more than 0 Secret Provider Classes
Code: BadRequest
Message: AzureKeyvaultSecretsProvider addon cannot be disabled due to more than 0 Secret Provider Classes

I don’t want to un-deploy anything to attempt a workaround at the moment - this is a production cluster. Do you have another approach I can try? Does it seem to be a server side or client side state issue, do you know?

Edit: Failed to post my entire thought 😐

[ebbypeter]

Adding the config with a variation of the above approach worked for me… I was running the command from PowerShell and I had to get the contents of the update.json to a variable and pass it to the put method…

So the steps were:

# get current config
az rest --method GET --url 'https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/{resourceName}?api-version=2022-01-01' > update.json

# edit the update.json file as shown in the below section

# get the update.json data. 
$updateContent = = Get-Content -Path .\update.json

# update config
az rest --method PUT --url 'https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/{resourceName}?api-version=2022-01-01' --body $updateContent

update.json

{
  "id": "<RESOURCE_ID>",
  "location": "<LOCATION>",
  "name": "<CLUSTER_NAME>",
  "properties": {
    "addonProfiles": {
      "azureKeyvaultSecretsProvider": {
        "config": {
          "enableSecretRotation": "true",
          "rotationPollInterval": "2m"
        },
        "enabled": true,
        "identity": {
          "clientId": "<CLIENT_ID>",
          "objectId": "<OBJECT_ID>",
          "resourceId": "<RESOURCE_ID>"
        }
      }
    }
  },
  "type": "Microsoft.ContainerService/ManagedClusters"
}

if you are getting ‘Unsupported Media Type’ error, convert the update.json with the following

• escaping the " (double qoute) to " (slash double quote)
• making the json to a single line