1

my scenario is like I have shared container registry in one subscription say subscription A, I need to pull image from ACR to ACA through DevOps pipelines. The ACAs are present for each environment like dev, test, UAT & etc which is in another subscription say subscription B. I am using 'az containerapp up' command in azure devops pipelines to pull image of the shared ACR. Getting error 'The resource is not found in the subscription B'. What might be the alternative possible solution because we need to reduce cost of using container registry for each environment. I am using service connections to pull image and the service connections are separate for separate subscriptions.

I know that they are in different subscriptions but I searched on websites to connect two different subscriptions. Is there a possibility that I can connect two different service connections in azure devops & use one service connection to pull that image.

Shree
  • 59
  • 6

2 Answers2

0

Before integrating the Azure CLI command az containerapp up with Azure pipelines, please first confirm you are able to pull the ACR image from Sub B to deploy the container app in Sub A via CloudShell or LocalPowerShell.

I tested to create ARM service connection with Tenant Root Management Group whose referenced service principle had access to both subscriptions; the issue still existed.

FailureWithTenantRootMG

In local PowerShell, I az login with my user account and still could reproduce the issue.

az containerapp up `
    --name XXcontainerapp `
    --image XXacrsubB.azurecr.io/azurecontainerappdemo:XX `
    --resource-group rg-containerapp `
    --environment TestEnv `
    --registry-username XXacrsubB `
    --registry-password XXXXXX

FailureInLocalPowerShell

It seemed to be a limitation with this command az containerapp up. You may consider reporting the issue with Azure CLI.

Alvin Zhao-MSFT
  • 508
  • 2
  • 6
  • I cannot able to use CloudShell or LocalPowershell because I have only read access in the portal. Only service connection has the role to perform pull image. But the error I am getting is same error as in your screenshot. – Shree Jan 06 '23 at 15:43
  • I used my user principle to `az login` who has full access to both subscriptions, the container app and ACR image. Still, this error existed. So far as I tested it would only search the ACR under the current subscription set by this command `az account set`. – Alvin Zhao-MSFT Jan 06 '23 at 15:50
  • 1
    Thanks, I found one solution, this issue can be resolved using az containerapp update specifying subscription option – Shree Jan 16 '23 at 14:30
  • Hi @Shree could you pls. Provide more details about the workaround. I have run to the same issue. Will be appreciated for the details. Maybe it will be cool to place it as an answer to the topic question. Thx ! – AllmanTool Feb 19 '23 at 23:35
  • @AllmanTool I have followed this document where, need to provide azure subscription as the service connection of container registry & use container app update command which provides an option global parameter as subscription which is equal to the subscription id where container app is present. https://learn.microsoft.com/en-us/cli/azure/containerapp?view=azure-cli-latest#az-containerapp-update – Shree Feb 22 '23 at 05:10
0

It looks like, there is some kind of workaround

Steps:

  • Deploy to an azure container app any version of docker 'image-x' manually
  • Then with 'az containerapp update' it possible to update version of the image, without an error, ever if registry and the app container in diff subscriptions

Code snippet:

- task: AzureCLI@2
        inputs:
          azureSubscription: 'service-connection'
          scriptType: 'bash'
          scriptLocation: 'inlineScript'
          inlineScript: |
            az config set extension.use_dynamic_install=yes_without_prompt
            
            az containerapp update \
              --name "app-name" \
              --resource-group "rg" \
              --image 'registry-host/image-x:v' \
        displayName: 'Update azurecontainer app'
AllmanTool
  • 1,384
  • 1
  • 16
  • 26