Image pull error from azure acr after linux_web_app initial deploy

[AndrewJuhasz]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.5

AzureRM Provider Version

3.82.0

Affected Resource(s)/Data Source(s)

azurerm_linux_web_app

Terraform Configuration Files

provider "azurerm" {
  features {}
}

terraform {
  required_version = "1.5.5"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
  }
}

data "azurerm_subscription" "this" {}

locals {
  namespace = "testissue"
  location = "westeurope"
  resource_group_name = "MyResourceGroup"
  subscription_id = data.azurerm_subscription.this.id
}

resource "azurerm_service_plan" "this" {
  name                = "${local.namespace}plan"
  location            = local.location
  resource_group_name = local.resource_group_name
  os_type             = "Linux"
  sku_name            = "B1"
  worker_count        = 1
}

resource "azurerm_linux_web_app" "this" {
  name                = "${local.namespace}appservice"
  resource_group_name = local.resource_group_name
  location            = local.location
  service_plan_id     = azurerm_service_plan.this.id
  https_only          = true

  key_vault_reference_identity_id = azurerm_user_assigned_identity.this.id

  site_config {
    always_on                                     = false
    worker_count                                  = 1
    container_registry_use_managed_identity       = true
    container_registry_managed_identity_client_id = azurerm_user_assigned_identity.this.client_id
    application_stack {
      docker_image_name   = "test/appsvc-tutorial-custom-image:latest"
      docker_registry_url = "https://mytestregistry11.azurecr.io"
    }
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.this.id]
  }
}
resource "azurerm_user_assigned_identity" "this" {
  name                = "${local.namespace}-app-service"
  location            = local.location
  resource_group_name = local.resource_group_name
}

resource "azurerm_role_definition" "acr_access" {
  name        = "${local.namespace}-acr-access-${local.location}"
  scope       = local.subscription_id
  description = "Custom role to access acr"

  permissions {
    actions     = ["Microsoft.ContainerRegistry/registries/pull/read"]
    not_actions = []
  }

  assignable_scopes = [
    local.subscription_id
  ]
}

resource "azurerm_role_assignment" "acr_access" {
  scope = azurerm_linux_web_app.this.id
  role_definition_name = "AcrPull"
  principal_id         = azurerm_user_assigned_identity.this.principal_id
}

Debug Output/Panic Output

-

Expected Behaviour

Image pull from azr should be working both with identity and credentials after the initial deploy

Actual Behaviour

Image pull error

To fix this, I can go to deployment center and change image version to any other one and click "save". After this, everything starts to work

Steps to Reproduce

Setup azure containers registry, push any image
Create resource group
Change corresponding values in terraform code(resource_group_name,docker_image_name, docker_registry_url)
Terraform apply

Check deployment center logs

To fix this, I can go to deployment center and change image version to any other one and click "save". After this, everything starts to work

Important Factoids

No response

References

No response

[xiaxyi]

Thanks @AndrewJuhasz for raising this issue, I suspect the issue is the docker registry related app_settings are not created properly, let me check the provider code first

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.