Comment 1 for bug 1700434

Having a model that's Alive or Dying but without credentials is a problem: that will prevent destroying the model's machines and such. Also, the Azure provider in particular will not be able to call the "Environ.Destroy" method, and so the model's resource group won't be deleted. It may be that we'll want to allow that, but we'll need to be able to clear that the model is disabled.

The other part is that we probably shouldn't block the entire controller upgrade because of one model. An alternative would be to do the environ upgrades later, when the model workers start. We would have to gate any Environ-related operations on the environ being upgraded.