Use of role assignments in run mode fails with error about adding container apps

[davidfowl]

using Azure.Provisioning.Storage;

var builder = DistributedApplication.CreateBuilder(args);

var storage = builder.AddAzureStorage("storage");

builder.AddNpmApp("app", "hello")
       .WithReference(storage.AddBlobs("images"))
       .WithRoleAssignments(storage, StorageBuiltInRole.StorageBlobDataReader);

builder.Build().Run();

Fails with

Unhandled exception. System.AggregateException: One or more errors occurred. (The application model does not support role assignments. Ensure you are using an environment that supports role assignments, for example AddAzureContainerAppEnvironment.)
 ---> System.InvalidOperationException: The application model does not support role assignments. Ensure you are using an environment that supports role assignments, for example AddAzureContainerAppEnvironment.
   at Aspire.Hosting.Azure.AzureResourcePreparer.EnsureNoRoleAssignmentAnnotations(DistributedApplicationModel appModel) in /_/src/Aspire.Hosting.Azure/AzureResourcePreparer.cs:line 88
   at Aspire.Hosting.Azure.AzureResourcePreparer.BeforeStartAsync(DistributedApplicationModel appModel, CancellationToken cancellationToken) in /_/src/Aspire.Hosting.Azure/AzureResourcePreparer.cs:line 37
   at Aspire.Hosting.DistributedApplication.ExecuteBeforeStartHooksAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting/DistributedApplication.cs:line 462
   at Aspire.Hosting.DistributedApplication.RunAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting/DistributedApplication.cs:line 412
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
   at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
   at System.Threading.Tasks.Task.Wait()
   at Aspire.Hosting.DistributedApplication.Run() in /_/src/Aspire.Hosting/DistributedApplication.cs:line 443
   at Program.<Main>$(String[] args) in C:\dev\git\repros\aspire\kvrole\Program.cs:line 11

This should work in run mode and that error should only occur in publish mode.

cc @eerhardt

[davidfowl]

You can work around this by adding:

builder.Services.Configure<AzureProvisioningOptions>(
    options => options.SupportsTargetedRoleAssignments = builder.ExecutionContext.IsRunMode
);

[eerhardt]

This should work in run mode and that error should only occur in publish mode.

This was an intentional decision to "shift left" the error, so you see it immediately. That way you didn't get too far without addressing the problem.

[joperezr]

Is this something we just need to document in order to close it?

[davidfowl]

I think we should patch it.

[davidfowl]

I can fix it.