Azure Pipeline : ACR could not found in subscription

Question

Hi im trying to deploy an Azure Container Instance from Azure Container Registry

im using this stage :

- stage: 'Deploy_ACI'  
  displayName: 'Deploy to ACI'  
  condition: variables['ACI_DEPLOYMENT_NAME_DEV']  
  jobs:  
  - job: "Deploy_ACI"  
    displayName: "Deploy to ACI"  
    pool:  
      vmImage: 'windows-latest'  
    timeoutInMinutes: 0  
    steps:  
    - task: AzureCLI@2  
      inputs:  
        scriptType: ps  
        azureSubscription: '$(WORKSPACE_SVC_CONNECTION)'  
        scriptLocation: inlineScript  
        inlineScript: |  
          $BNAME = '$(BASE_NAME)'  
          $ACR = $BNAME+'amlcr'  
          echo 'getting credentials'  
          $ACRS = $ACR+'.azurecr.io/package:20220729161615'  
          $Ruser = $(az acr credential show -n $ACR --query username)  
          $Rpassword = $(az acr credential show -n $ACR --query passwords[0].value)  
          az container create --resource-group $(RESOURCE_GROUP) --name $(ACI_DEPLOYMENT_NAME_DEV) --location centralus --image $ACRS --registry-username $Ruser --registry-password $Rpassword --restart-policy never --vnet VNetDigi --subnet aci  

the problem is the commands :

          $Ruser = $(az acr credential show -n $ACR --query username)  
          $Rpassword = $(az acr credential show -n $ACR --query passwords[0].value)  

they return :

ERROR: The resource with name 'name' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'Abonnement Azure 1 (id)'.

the SP that im using have Owner permession and i don't know why it can't find the ACR

i checked the name it's correct and everything is set up to work but idk why it's failing
is there an additional permession i need to add to the sp im using ?

Answer 1

Hello @Ossama Assaghir ,

Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.

For your issue, it seems your registry is not in the current subscription. When you use the CLI command az login then you log in with a default subscription. For you, it seems the "'Abonnement Azure 1 (id)" is the default. You should check if your registry is in the current subscription. If not, you should set that subscription as the current subscription through the CLI command:

az account set --subscription subscription_id
Then I suggest you'd better check if the registry exists again with the CLI command:

az acr show -n acr_name
It will show the information of your registry. This time, you can build the image with the CLI command az acr build as you want.

If you have more questions, please let me know. Or if you think it's helpful you can accept it as the answer.

Answer 2

You can always access without the need for an Azure permission using a docker username and password,
just like the one you've listed.

az containerapp up --image --registry-server [full acr FQDN] --registry-username [nameofacr] --registry-password [password]

Test this and let me know.

Answer 3

Is there any way , we can access ACR image from different subscription when azure commands running on different subscription?

az containerapp up --name
[--image]
[--registry-password]
[--registry-server]
[--registry-username]

containerapp is in sub1 and ACR in sub2.

Error- 2022-09-02T07:51:34.9779366Z ERROR: The resource with name 'ACR Name' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'sub1'.

Answer 4

It was a permession problem

the service principal wasn't an owner nor contriburor that's why he didn't have access to the Container Registry

i though the SP was owner but after checking with the team responsibe for permessions we discovered it was not

giving the service principal permmession worked fine