Azure / Azure/azure-cli-extensions

[containerapp] "az containerapp job create" does not recognize *.azurecr.us registry domain as one that can use identity instead of username:password for auth

Open
#10,016 2 comments 1 reaction 2 assignees Claimed by @a0x1ab View on GitHub
Auto-Assign ContainerApp Service Attention
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

Source: https://github.com/Azure/azure-cli/issues/32194 (by @bitdeft)
Affected extension: `containerapp` (`src/containerapp/`)

---

<<>>
# Issue #32194 (by @bitdeft)
## Title
"az containerapp job create" does not recognize *.azurecr.us registry domain as one that can use identity instead of username:password for auth

## Body
### Describe the bug

When invoking the command, if you supply an ACR domain with *azurecr.us, which is used in usgov / GCCH tenants for Azure Container Registry, it requires --registry-username and --registry-password instead of allowing the use of --registry-identitiy for auth with an MSI.

### Related command

`az containerapp job create`

### Errors

`Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry`

### Issue script & Debug output

It doesn't pass validation, likely the domain for the usgov regions azurecr.us needs to be added.

'''
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 654, in execute
self._validation(expanded_arg)
File "/usr/lib64/az/lib/python3.12/site-packages/knack/invocation.py", line 113, in _validation
self._validate_arg_level(parsed_ns)
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 925, in _validate_arg_level
validator(**self._build_kwargs(validator, ns))
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/containerapp/_validators.py", line 110, in validate_registry_server
raise ValidationError("Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry")
azure.cli.core.azclierror.ValidationError: Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry
'''

### Expected behavior

This is targeting an azure container registry, not a docker one. It should accept managed identity for auth.

### Environment Summary

From Azure Cloud Shell:

'''
azure-cli 2.76.0 *

core 2.76.0 *
telemetry 1.1.0

Extensions:
ml 2.38.0
ssh 2.0.6

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Python location '/usr/bin/python3.12'
Config directory '/home/bryce/.azure'
Extensions directory '/home/bryce/.azure/cliextensions'
Extensions system directory '/usr/lib/python3.12/site-packages/azure-cli-extensions'
'''

### Additional context

I am fairly certain that using an identity for pulling the image is supported in these tenants, but if I am wrong, and that is not the case then this is expected behavior. Thanks!

## Comments
### Comment by @azure-client-tools-bot-prd[bot]
Hi @bitdeft,

2.76.0 is not the latest Azure CLI(2.77.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

### Comment by @yonzhan

Thank you for opening this issue, we will look into it.

### Comment by @microsoft-github-policy-service[bot]
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @howang-ms, @Greedygre.

### Comment by @Greedygre
Thanks for reporting this issue. We will have a look and fix it.
<<>>

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.