If you service has an env var pointing to a @sercret, but that @secret doesn’t exist, the instance will hang on re-deployment, forever, with no explanation that something is wrong.
For example, if a service has
MY_VAR=@MY_SECRET_VAR
Now, delete MY_SECRET_VAR from the secrets area. Now re-deploy the instance and see that it hangs. No log messages…no warning that @secret went away.