[AVM Module Issue]: Azure Container Instance Deployment Fails to Create Container Registry Repository (400 Bad Request)

[AErmie]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

(Optional) Module Version

0.2.0

(Optional) Correlation Id

No response

Description

When deploying a net-new implementation of the GitHub Runners module, including Azure Container Instances, the deployment fails with the error: "unable to pull image using Managed identity" due to the Repository not actually having been created.

Terraform code:

module "github_runners" {
  source                                       = "Azure/avm-ptn-cicd-agents-and-runners/azurerm"
  version                                      = "~> 0.2"

  postfix                                      = "my-runners"
  location                                     = "Canada Central"

  compute_types = ["azure_container_app", "azure_container_instance"]

  version_control_system_type                  = "github"
  version_control_system_personal_access_token = var.github_personal_access_token
  version_control_system_organization          = "bcgov-c"
  version_control_system_repository            = "ecf-azure-startup-sample-app-serverless"
  virtual_network_address_space                = "10.0.0.0/16"

  container_registry_name = "basicavmcr"

  tags                  = local.tags
}

Terraform Error:

│ Error: Failed to create/update resource
│ 
│   with module.github_runners.module.container_app_job[0].azapi_resource.job,
│   on .terraform/modules/github_runners/modules/container-app-job/main.tf line 1, in resource "azapi_resource" "job":
│    1: resource "azapi_resource" "job" {
│ 
│ creating/updating Resource: (ResourceId
│ "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-my-runners/providers/Microsoft.App/jobs/caj-my-runners" / Api Version
│ "2023-05-01"): PUT
│ https://management.azure.com/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-my-runners/providers/Microsoft.App/jobs/caj-my-runners
│ --------------------------------------------------------------------------------
│ RESPONSE 400: 400 Bad Request
│ ERROR CODE: InvalidParameterValueInContainerTemplate
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "InvalidParameterValueInContainerTemplate",
│     "message": "The following field(s) are either invalid or missing. Field 'template.containers.caj-my-runners.image' is invalid with details: 'Invalid value: \"basicavmcr.azurecr.io/github-runner:bc4087f\": unable to pull image using Managed identity /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-my-runners/providers/Microsoft.ManagedIdentity/userAssignedIdentities/uami-my-runners for registry basicavmcr.azurecr.io';."
│   }
│ }
│ --------------------------------------------------------------------------------

When checking the Azure Container Registry (from within the VNet, since it is configured for private-only access), although the Container Registry was successfully created, the Repositories view show the following error:

So the repository is not actually provisioned.

Troubleshooting

When running az acr check-health -n yourRegistry (per the Why does the Azure portal fail to fetch repositories or tags? documentation), I get the following output:

PS /home/adin_ermie> az acr check-health -n basicavmcr
Environment checks are not supported in Azure Cloud Shell.
DNS lookup to basicavmcr.azurecr.io at IP 20.48.192.138 : OK
Challenge endpoint https://basicavmcr.azurecr.io/v2/ : OK
2024-12-27 19:02:42.335009 An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'basicavmcr.azurecr.io' was denied. Response code: 403. Please try running 'az login' again to refresh permissions.

Please refer to https://aka.ms/acr/errors#connectivity_refresh_token_error for more information.

Re-running the deployment completes successfully, but the Azure portal still shows the same error for the Repository, which is still not deployed.

[AErmie]

This has also been tested when deploying only the Container Instance compute_type, without the Container Apps option. The results are the same.

compute_types = ["azure_container_instance"]

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-terraform) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-terraform) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-terraform) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-terraform) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-terraform) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-terraform) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-terraform) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.