Azure Container Apps image pull with managed identity
Article
You can pull images from private repositories in Microsoft Azure Container Registry using managed identities for authentication to avoid the use of administrative credentials.
You can use a user-assigned or system-assigned managed identity to authenticate with Azure Container Registry.
With a user-assigned managed identity, you create and manage the identity outside of Azure Container Apps. It can be assigned to multiple Azure resources, including Azure Container Apps.
With a system-assigned managed identity, the identity is created and managed by Azure Container Apps. It is tied to your container app and is deleted when your app is deleted.
When possible, you should use a user-assigned managed identity to pull images.
Container Apps checks for a new version of the image whenever a container is started. In Docker or Kubernetes terminology, Container Apps sets each container's image pull policy to always.
This article describes how to use the Azure portal to configure your container app to use user-assigned and system-assigned managed identities to pull images from private Azure Container Registry repositories.
User-assigned managed identity
The following steps describe the process to configure your container app to use a user-assigned managed identity to pull images from private Azure Container Registry repositories.
Create a container app with a public image.
Add the user-assigned managed identity to the container app.
Create a container app revision with a private image and the user-assigned managed identity.
A private Azure Container Registry containing an image you want to pull.
Your Azure Container Registry must allow ARM audience tokens for authentication in order to use managed identity to pull images.
Use the following command to check if ARM tokens are allowed to access your ACR:
Azure CLI
az acr config authentication-as-arm show -r<REGISTRY>
If ARM tokens are disallowed, you can allow them with the following command:
Azure CLI
az acr config authentication-as-arm update -r<REGISTRY>--status enabled
Use the following steps to create a container app with the default quickstart image.
Navigate to the portal Home page.
Search for Container Apps in the top search bar.
Select Container Apps in the search results.
Select the Create button.
In the Basics tab, do the following actions.
Setting
Action
Subscription
Select your Azure subscription.
Resource group
Select an existing resource group or create a new one.
Container app name
Enter a container app name.
Location
Select a location.
Create Container App Environment
Create a new or select an existing environment.
Select the Review + Create button at the bottom of the Create Container App page.
Select the Create button at the bottom of the Create Container App window.
Allow a few minutes for the container app deployment to finish. When deployment is complete, select Go to resource.
Add the user-assigned managed identity
Select Identity from the left menu.
Select the User assigned tab.
Select the Add user assigned managed identity button.
Select your subscription.
Select the identity you created.
Select Add.
Create a container app revision
Create a container app revision with a private image and the system-assigned managed identity.
Select Revision Management from the left menu.
Select Create new revision.
Select the container image from the Container Image table.
Enter the information in the Edit a container dialog.
Field
Action
Name
Enter a name for the container.
Image source
Select Azure Container Registry.
Authentication
Select Managed Identity.
Identity
Select the identity you created from the drop-down menu.
Registry
Select the registry you want to use from the drop-down menu.
Image
Enter the name of the image you want to use.
Image Tag
Enter the name and tag of the image you want to pull.
Note
If the administrative credentials are not enabled on your Azure Container Registry registry, you will see a warning message displayed and you will need to enter the image name and tag information manually.
Select Save.
Select Create from the Create and deploy new revision page.
A new revision will be created and deployed. The portal will automatically attempt to add the acrpull role to the user-assigned managed identity. If the role isn't added, you can add it manually.
You can verify that the role was added by checking the identity from the Identity pane of the container app page.
Select Identity from the left menu.
Select the User assigned tab.
Select the user-assigned managed identity.
Select Azure role assignments from the menu on the managed identity resource page.
Verify that the acrpull role is assigned to the user-assigned managed identity.
Create a container app with a private image
If you don't want to start by creating a container app with a public image, you can also do the following.
Create a user-assigned managed identity.
Add the acrpull role to the user-assigned managed identity.
Create a container app with a private image and the user-assigned managed identity.
This method is typical in Infrastructure as Code (IaC) scenarios.
Clean up resources
If you're not going to continue to use this application, you can delete the Azure Container Apps instance and all the associated services by removing the resource group.
Warning
Deleting the resource group will delete all the resources in the group. If you have other resources in the group, they will also be deleted. If you want to keep the resources, you can delete the container app instance and the container app environment.
Select your resource group from the Overview section.
Select the Delete resource group button at the top of the resource group Overview.
Enter the resource group name in the confirmation dialog.
Select Delete.
The process to delete the resource group may take a few minutes to complete.
System-assigned managed identity
The method for configuring a system-assigned managed identity in the Azure portal is the same as configuring a user-assigned managed identity. The only difference is that you don't need to create a user-assigned managed identity. Instead, the system-assigned managed identity is created when you create the container app.
The method to configure a system-assigned managed identity in the Azure portal is:
Create a container app with a public image.
Create a container app revision with a private image and the system-assigned managed identity.
In the Container tab, enable Use quickstart image. Leave Quickstart image set to Simple hello world container.
Select the Review + Create button at the bottom of the Create Container App page.
Select the Create button at the bottom of the Create Container App page.
Allow a few minutes for the container app deployment to finish. When deployment is complete, select Go to resource.
Edit and deploy a revision
Edit the container to use the image from your private Azure Container Registry, and configure the authentication to use system-assigned identity.
In Application, select Containers.
In the Containers page, select Edit and deploy.
Select the simple-hello-world-container container from the list.
In the Edit a container page, do the following actions.
Setting
Action
Name
Enter the container app name.
Image source
Select Azure Container Registry.
Subscription
Select your Azure subscription.
Registry
Select your container registry.
Image
Enter the image name.
Image tag
Enter the image tag.
Authentication type
Select Managed identity.
Managed identity
Select System assigned.
Select Save at the bottom of the page.
Select Create at the bottom of the Create and deploy new revision page
After a few minutes, select Refresh on the Revision management page to see the new revision.
A new revision will be created and deployed. The portal will automatically attempt to add the acrpull role to the system-assigned managed identity. If the role isn't added, you can add it manually.
You can verify that the role was added by checking the identity in the Identity pane of the container app page.
Select Identity from the left menu.
Select the System assigned tab.
Select Azure role assignments.
Verify that the acrpull role is assigned to the system-assigned managed identity.
Clean up resources
If you're not going to continue to use this application, you can delete the Azure Container Apps instance and all the associated services by removing the resource group.
Warning
Deleting the resource group will delete all the resources in the group. If you have other resources in the group, they will also be deleted. If you want to keep the resources, you can delete the container app instance and the container app environment.
Select your resource group from the Overview section.
Select the Delete resource group button at the top of the resource group Overview.
Enter the resource group name in the confirmation dialog.
Select Delete.
The process to delete the resource group may take a few minutes to complete.
This article describes how to configure your container app to use managed identities to pull images from a private Azure Container Registry repository using Azure CLI and Azure PowerShell.
Prerequisites
Prerequisite
Description
Azure account
An Azure account with an active subscription. If you don't have one, you can create one for free.
If using PowerShell, install the Azure PowerShell on your local machine. Ensure that the latest version of the Az.App module is installed by running the command Install-Module -Name Az.App.
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force
Ignore any warnings about modules currently in use.
Next, install or update the Azure Container Apps extension for the CLI.
If you receive errors about missing parameters when you run az containerapp commands in Azure CLI or cmdlets from the Az.App module in Azure PowerShell, be sure you have the latest version of the Azure Container Apps extension installed.
Starting in May 2024, Azure CLI extensions no longer enable preview features by default. To access Container Apps preview features, install the Container Apps extension with --allow-preview true.
Azure CLI
az extension add --name containerapp --upgrade--allow-previewtrue
Azure PowerShell
Install-Module -Name Az.App
Make sure to update the Az.App module to the latest version.
Azure PowerShell
Update-Module -Name Az.App
Now that the current extension or module is installed, register the Microsoft.App and Microsoft.OperationalInsights namespaces.
To create the environment, run the following command:
Azure CLI
az containerapp env create \
--name$CONTAINERAPPS_ENVIRONMENT \
--resource-group$RESOURCE_GROUP \
--location$LOCATION
A Log Analytics workspace is required for the Container Apps environment. The following commands create a Log Analytics workspace and save the workspace ID and primary shared key to variables.
Copy the identity's resource ID to paste into the <IDENTITY_ID> placeholders in the command below. If your image tag isn't latest, replace 'latest' with your tag.
The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this quickstart exist in the specified resource group, they will also be deleted.
Update the container app with the image from your private container registry and add a system-assigned identity to authenticate the Azure Container Registry pull. You can also include other settings necessary for your container app, such as ingress, scale and Dapr settings.
The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this quickstart exist in the specified resource group, they will also be deleted.
This article describes how to use a Bicep template to configure your container app to use user-assigned managed identities to pull images from private Azure Container Registry repositories.
If using PowerShell, install the Azure PowerShell on your local machine. Ensure that the latest version of the Az.App module is installed by running the command Install-Module -Name Az.App.
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force
Ignore any warnings about modules currently in use.
Next, install or update the Azure Container Apps extension for the CLI.
If you receive errors about missing parameters when you run az containerapp commands in Azure CLI or cmdlets from the Az.App module in Azure PowerShell, be sure you have the latest version of the Azure Container Apps extension installed.
Starting in May 2024, Azure CLI extensions no longer enable preview features by default. To access Container Apps preview features, install the Container Apps extension with --allow-preview true.
Azure CLI
az extension add --name containerapp --upgrade--allow-previewtrue
Azure PowerShell
Install-Module -Name Az.App
Make sure to update the Az.App module to the latest version.
Azure PowerShell
Update-Module -Name Az.App
Now that the current extension or module is installed, register the Microsoft.App and Microsoft.OperationalInsights namespaces.
A Log Analytics workspace associated with the Container Apps environment.
An Application Insights resource for distributed tracing.
A user-assigned managed identity.
A container to store the image.
A container app based on the image.
If you receive the error Failed to parse '<YOUR_BICEP_FILE_NAME>', please check whether it is a valid JSON format, make sure your Bicep template file has the extension .bicep.
Learn how to create and configure an Azure Container Registry, the process of pushing container images to Azure Container Registry and explore different authentication methods and security features for Azure Container Registry.