Azure / Azure/azure-powershell

Import-AzContainerRegistryImage returns bad request

Open
#17,348 7 comments 2 reactions 0 assignees View on GitHub
act-observability-squad bug Container Registry customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Import-AzContainerRegistryImage returns bad request but running `az acr import` with a similar parameter set succeeds.

`Import-AzContainerRegistryImage -ResourceGroupName my-shared-rg -SourceRegistryUri mysharedcr.azurecr.io -SourceImage blogifier:latest -RegistryName mysharedcrtemp` fails

`az acr import --name mysharedcrtemp --source mysharedcr.azurecr.io/blogifier:latest --image blogifier:latest` succeeds

`Login-AzAccount` and `az login` both used the same account.

`Import-AzContainerRegistryImage` should successfully import the image if `az acr import` is able to.

The debug logs indicate an authentication error but `Resolve-AzError` says `Input string was not in a correct format.`. Where the parameter values for the PowerShell cmdlet are different to the az cli this is in accordance with the [docs](https://docs.microsoft.com/en-us/powershell/module/az.containerregistry/import-azcontainerregistryimage?view=azps-7.3.0).

### Issue script & Debug output

```PowerShell
DEBUG: 20:11:23 - ImportAzureContainerRegistryImage begin processing with ParameterSet 'ImportImageByRegistryUri'.
DEBUG: 20:11:23 - using account id 'my.admin@mytenant.onmicrosoft.com'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'my.admin@mytenant.onmicrosoft.com', environment: 'AzureCloud', tenant: '69120d36-5433-403f-9d0b-d1af3ac0baee'
DEBUG: 20:11:25 - [SilentAuthenticator] Calling SharedTokenCacheCredential.GetTokenAsync - TenantId:'69120d36-5433-403f-9d0b-d1af3ac0baee', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'my.admin@mytenant.onmicrosoft.com'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Azure region was not configured or could not be discovered. Not using a regional authority.
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25] Found 2 cache accounts and 0 broker accounts
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25] Returning 2 accounts
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] MSAL MSAL.NetCore with assembly version '4.30.1.0'. CorrelationId(63441bc2-e6ee-43e6-bbbe-cb5ff6ca35a4)
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] === AcquireTokenSilent Parameters ===
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] LoginHint provided: False
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Account provided: True
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] ForceRefresh: False
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - 63441bc2-e6ee-43e6-bbbe-cb5ff6ca35a4

DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] === Token Acquisition (SilentRequest) started:

Authority Host: login.microsoftonline.com
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Azure region was not configured or could not be discovered. Not using a regional authority.
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Access token is not expired. Returning the found cache entry. [Current time (03/03/2022 20:11:25) - Expiration Time (03/03/2022 20:20:27 +00:00) - Extended Expiration Time (03/03/2022 20:20:27 +00:00)]
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Returning access token found in cache. RefreshOn exists ? False
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] Fetched access token from host login.microsoftonline.com.
DEBUG: (False) MSAL 4.30.1.0 MSAL.NetCore Microsoft Windows 10.0.19043 [03/03/2022 20:11:25 - ] === Token Acquisition finished successfully. An access token was returned with Expiration Time: 03/03/2022 20:20:27 +00:00 and Scopes https://management.core.windows.net//user_impersonation https://management.core.windows.net//.default
DEBUG: SharedTokenCacheCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2022-03-03T20:20:27.0000000+00:00
DEBUG: [Common.Authentication]: Received token with LoginType 'User', Tenant: '69120d36-5433-403f-9d0b-d1af3ac0baee', UserId: 'my.admin@mytenant.onmicrosoft.com'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-shared-rg/providers/Microsoft.ContainerRegistry/registries/mysharedcrtemp/importImage?api-version=2019-05-01

Headers:
x-ms-client-request-id : 80918b03-8184-4e8a-ad8a-2d0d98460a59
Accept-Language : en-US

Body:
{
"source": {
"registryUri": "mysharedcr.azurecr.io",
"sourceImage": "azureml/azureml_83cea8d8015ba343d5ee43f9b331c069:1"
},
"targetTags": [
"azureml/azureml_83cea8d8015ba343d5ee43f9b331c069:1"
]
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Accepted

Headers:
Cache-Control : no-cache
Pragma : no-cache
Location : https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.ContainerRegistry/locations/WESTEUROPE/operationResults/registries-80918b03-8184-4e8a-ad8a-2d0d98460a59?api-version=2019-05-01
Retry-After : 10
api-supported-versions : 2017-10-01, 2019-05-01, 2019-12-01-preview, 2020-11-01-preview, 2021-06-01-preview, 2021-08-01-preview, 2021-09-01, 2021-12-01-preview
Strict-Transport-Security : max-age=31536000; includeSubDomains
Server : Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-request-id : d774d887-bb4c-412c-84ae-fe6d27ee7b58
x-ms-correlation-request-id : d774d887-bb4c-412c-84ae-fe6d27ee7b58
x-ms-routing-request-id : UKSOUTH:20220303T201126Z:d774d887-bb4c-412c-84ae-fe6d27ee7b58
X-Content-Type-Options : nosniff
Date : Thu, 03 Mar 2022 20:11:25 GMT

Body:
null

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.ContainerRegistry/locations/WESTEUROPE/operationResults/registries-80918b03-8184-4e8a-ad8a-2d0d98460a59?api-version=2019-05-01

Headers:
x-ms-client-request-id : 80918b03-8184-4e8a-ad8a-2d0d98460a59

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Pragma : no-cache
Strict-Transport-Security : max-age=31536000; includeSubDomains
Server : Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11998
x-ms-request-id : 5354a63f-fcf5-424c-8602-96fc7e42acf1
x-ms-correlation-request-id : 5354a63f-fcf5-424c-8602-96fc7e42acf1
x-ms-routing-request-id : UKSOUTH:20220303T201136Z:5354a63f-fcf5-424c-8602-96fc7e42acf1
X-Content-Type-Options : nosniff
Date : Thu, 03 Mar 2022 20:11:35 GMT

Body:
{
"error": {
"code": "InvalidParameters",
"message": "Operation registries-80918b03-8184-4e8a-ad8a-2d0d98460a59 failed. Resource /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-shared-rg/providers/Microsoft.ContainerRegistry/registries/mysharedcrtemp Remote registry returned 401 unauthorized, Unauthorized Unauthorized {\"errors\":[{\"code\":\"UNAUTHORIZED\",\"message\":\"authentication required, visit https://aka.ms/acr/authorization for more information.\"}]}"
},
"status": "Failed"
}

Import-AzContainerRegistryImage: C:\Users\me\source\repos\gandt-devops\PSScripts\Backup-ContainerRegistry.ps1:36:9
Line |
36 | Import-AzContainerRegistryImage -ResourceGroupName $Container …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Long running operation failed with status 'BadRequest'.

DEBUG: AzureQoSEvent: Module: Az.ContainerRegistry:2.2.3; CommandName: Import-AzContainerRegistryImage; PSVersion: 7.2.1; IsSuccess: False; Duration: 00:00:12.8464352; Exception: Long running operation failed with status 'BadRequest'.;
DEBUG: Finish sending metric.
DEBUG: 20:11:36 - ImportAzureContainerRegistryImage end processing.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.2.1
PSEdition Core
GitCommitId 7.2.1
OS Microsoft Windows 10.0.19043
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.7.1 Az.Accounts {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script 2.2.3 Az.ContainerRegistry {Connect-AzContainerRegistry, Get-AzContainerRegistry, Get-AzContainerRegistryCredential, Get-AzContainerRegistryManifest…}
```

### Error output

```PowerShell
Resolve-AzError: Input string was not in a correct format.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.