azurerm_container_app - Support pulling container images from ACR using managed identity

[audunsolemdal]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently it does not seem possible to use a managed identity to pull images from an Azure Container Registry.

Using the azapi_resource for type Microsoft.App/containerApps, one could do the following

        registries = [
          {
            identity = <resource id of managed identity>
            server   = "myregistry.azurecr.io"
          }
        ]

While the current config has both username and password_secret_name as required

  registry {
    server               = "myregistry.azurecr.io"
    username             = <resource id of managed identity>
    password_secret_name = "clientsecretname"
  }

New or Affected Resource(s)/Data Source(s)

azurerm_container_app

Potential Terraform Configuration

No response

References

No response

[faheemgani]

This is causing us an issue as well - we rely on managed identity against the container app instance to access services such as key vaults.

Currently there is no way of setting managed identity if you use the azurerm_container_app resource, perhaps it's possible to implement an identity block similar to some of the other azure terraform resources?

e.g. identity { type = "SystemAssigned" }

[audunsolemdal]

This is causing us an issue as well - we rely on managed identity against the container app instance to access services such as key vaults.

Currently there is no way of setting managed identity if you use the azurerm_container_app resource, perhaps it's possible to implement an identity block similar to some of the other azure terraform resources?

e.g. identity { type = "SystemAssigned" }

Actually this is already possible, it just wasn't documented in azurerm version 3.43. I updated the documentation here #20411

[Ivan-L]

We're in the same boat.

It would be great to be able to do this as this option was available to us when we used azapi.

registry {
  server   = "<private_registry>.azurecr.io"
  identity = data.azurerm_user_assigned_identity.container_app.id
}

It is great that @audunsolemdal updated the docs with respect to being able to set a managed identity on a container app.

The core issue however remains that we cannot use managed identity with container apps to pull images from a private registry with the current azurerm version (3.43.0).

[jsok]

I took a stab at adding support for this in #20466

[github-actions]

This functionality has been released in v3.44.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.