ImagePullFailure on App Service with Managed Identity

Question

I have an App Service that is configured to deploy a Docker image from a private Azure Container Registry. I have seen the other three questions about this same problem and have gone through the proposed solutions and am still getting the ImagePullFailure in my App Service.

Relevant configuration:

• Azure Container Registry
  • No admin credentials
  • No public access
  • Private link/Private endpoint enabled
  • Image and tag exist
  • authentication-as-arm is enabled
• App Service
  • In the same vnet as the ACR private endpoint
  • no outbound traffic restrictions
  • uses managed identity to authenticate to ACR
• Managed identity
  • Has AcrPull role on the ACR resource
  • Is assigned to the App Service

Steps I have taken to verify connection:

• In the App Service's advanced tools I was able to resolve the dns and tcping the ACR, confirming that the App Service can reach the registry
• The user assigned managed identity is also assigned to an ACR task that builds and pushes the image, and is given the AcrPush role as well. The task is successful in pushing the image, confirming that the managed identity permissions are working
• I have manually removed and re-attached the container settings on the App Service

Answer 1

Hi @Ian Branda ,
I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: ImagePullFailure on App Service with Managed Identity

Solution:
I'm managing my infrastructure using Terraform and according to the documentation, A records for private DNS are handled automatically by Azure when creating private endpoints. The one caveat is that the data endpoint (<acr-name>.<region>.data.orivatelink.azurecr.io) DIDN'T have an automatically created A record, so even though I was able to ping and resolve the registry DNS, the pull was failing due to not having the A record for the data endpoint. I am now managing all of my A records explicitly in Terraform.

Please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.

Answer 2

Hi Laxman,

I have confirmed all of the above multiple times. I actually finally found the problem and as I haven't seen it posted here, I'll post an answer for others to reference itn the future.

I'm managing my infrastructure using Terraform and according to the documentation, A records for private DNS are handled automatically by Azure when creating private endpoints. The one caveat is that the data endpoint (<acr-name>.<region>.data.orivatelink.azurecr.io) DIDN'T have an automatically created A record, so even though I was able to ping and resolve the registry DNS, the pull was failing due to not having the A record for the data endpoint. I am now managing all of my A records explicitly in Terraform.