Feature flags were calling CreateIfNotExists to get the container reference for the FF container ('content'). This container already exists, so we don't need to write anything, but the CreateIfNotExists call meant that we would need to have read-write permissions enabled regardless, and jobs/services using this path would need the MSI to be over-provisioned (eg. SearchService)
I've made changes so we avoid that call for Feature Flags. I've tested it for the SearchService and it worked, but I haven't tested anything else. Let me know if there's anything else I should try to test.
Feature flags were calling
CreateIfNotExists
to get the container reference for the FF container ('content'). This container already exists, so we don't need to write anything, but theCreateIfNotExists
call meant that we would need to have read-write permissions enabled regardless, and jobs/services using this path would need the MSI to be over-provisioned (eg. SearchService)I've made changes so we avoid that call for Feature Flags. I've tested it for the SearchService and it worked, but I haven't tested anything else. Let me know if there's anything else I should try to test.
Related to/Part of https://github.com/NuGet/Engineering/issues/5439