Azure / Azure/bicep

Support OCI-compliant alternative container registry for bicep publish

Open
#4,884 28 comments 36 reactions 0 assignees View on GitHub
enhancement Needs: Upvote story: registry
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

Hi everyone,

with the lastest version of bicep, we can now publish bicep modules in the ACR. This works very fine:

```
bicep publish secure.bicep --target 'br:dirien.azurecr.io/bicep/modules/app-service-plan:v1.0'
```
![image](https://user-images.githubusercontent.com/38325136/137595732-1406ca0a-cd5e-4880-83ce-c7155b317daa.png)

If i want to use, for example Artifactory its not working.

```
➜ flw-controlplane-azure git:(initial) ✗ bicep publish secure.bicep --target 'br:schwarzit-xx-sit-aebi-playground-docker-local.jfrog.io/bicep/modules/app-service-plan:v1.0'
Unhandled exception. Azure.RequestFailedException: Service request failed.
Status: 404 (Not Found)

Content:
404 page not found

Headers:
Date: Sat, 16 Oct 2021 16:39:28 GMT
Connection: keep-alive
X-Content-Type-Options: nosniff
Strict-Transport-Security: REDACTED
Content-Type: text/plain; charset=utf-8
Content-Length: 19

at Bicep.Core.RegistryClient.AuthenticationRestClient.ExchangeAadAccessTokenForAcrRefreshTokenAsync(String service, String accessToken, CancellationToken cancellationToken)
at Bicep.Core.RegistryClient.ContainerRegistryRefreshTokenCache.GetRefreshTokenFromCredentialAsync(TokenRequestContext context, String service, Boolean async, CancellationToken cancellationToken)
at Bicep.Core.RegistryClient.ContainerRegistryRefreshTokenCache.GetAcrRefreshTokenAsync(HttpMessage message, TokenRequestContext context, String service, Boolean async)
at Bicep.Core.RegistryClient.ContainerRegistryRefreshTokenCache.GetAcrRefreshTokenAsync(HttpMessage message, TokenRequestContext context, String service, Boolean async)
at Bicep.Core.RegistryClient.ContainerRegistryChallengeAuthenticationPolicy.AuthorizeRequestOnChallengeAsyncInternal(HttpMessage message, Boolean async)
at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Bicep.Core.RegistryClient.ContainerRegistryBlobRestClient.StartUploadAsync(String name, CancellationToken cancellationToken)
at Bicep.Core.RegistryClient.BicepRegistryBlobClient.UploadBlobAsync(Stream stream, CancellationToken cancellationToken)
at Bicep.Core.Registry.AzureContainerRegistryManager.PushArtifactAsync(RootConfiguration configuration, OciArtifactModuleReference moduleReference, StreamDescriptor config, StreamDescriptor[] layers)
at Bicep.Core.Registry.OciModuleRegistry.PublishModule(RootConfiguration configuration, OciArtifactModuleReference moduleReference, Stream compiled)
at Bicep.Core.Registry.ModuleDispatcher.PublishModule(RootConfiguration configuration, ModuleReference moduleReference, Stream compiled)
at Bicep.Cli.Commands.PublishCommand.RunAsync(PublishArguments args)
at Bicep.Cli.Program.RunAsync(String[] args)
at Bicep.Cli.Program.Main(String[] args)
at Bicep.Cli.Program.(String[] args)
[1] 11253 abort bicep publish secure.bicep --target
```

It would be cool, if we had support for alternative OCP compliant registries. Most of the enterprises, have already a binary repository in place. So it could be difficult to use a different one for "just" modul sharing.

Contributor guide

Open the contributing guide

Research direction

Start with Bicep.Cli.Commands.PublishCommand and follow ModuleDispatcher.PublishModule into AzureContainerRegistryManager.PushArtifactAsync. Review the registry authentication classes named in the stack trace and reproduce the publish command against the Artifactory endpoint. Done means publishing to an OCI-compliant alternative registry succeeds without the ACR-specific authentication failure.

Written by the indexing model from the issue text.

Assessment

Domain
cli, cloud, devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.