Azure / Azure-Functions

1.1k stars 189 forks source link

[UX] - UseManagedIdentityCreds in Azure Functions on Azure Container Apps #2457

Open nathanblair opened 3 months ago

nathanblair commented 3 months ago

Issue Title

UseManagedIdentityCreds in Azure Functions on Azure Container Apps

Description

Azure Functions on Azure Container Apps is currently in preview and I would like to begin rolling it out for my company. While doing so in the Azure Portal I am prompted to provide the registry to pull our Function Container Image from as well as credentials for accessing the registry.

Our governance policy is such that Azure Functions must have AcrUseManagedIdentityCreds set to true. This works for App Services and Function Apps that are directed at App Service plans rather than App Container Environments. But for Function apps directed at running on Azure Container Environments, when trying to deploy a custom ARM template through Terraform's AzAPI provider, I get this message

AcrUseManagedIdentityCreds is invalid. AcrUseManagedIdentityCreds is not supported for Azure Functions on Azure Container apps. Please retry the operation without AcrUseManagedIdentityCreds.

image

AzAPI template ``` resource "azapi_resource" "function" { type = "Microsoft.Web/sites@2022-09-01" parent_id = "our resource group ID" location = "our target location" response_export_values = ["*"] name = "a function name" identity { type = "UserAssigned" identity_ids = ["an identity with pull access to our registry"] } body = jsonencode({ kind = "functionapp,linux,container,azurecontainerapps" properties = { managedEnvironmentId = "our container app environment ID" virtualNetworkSubnetId = "our subnet id in the container app environment" clientAffinityEnabled = false httpsOnly = true siteConfig = { acrUseManagedIdentityCreds = true acrUserManagedIdentityID = data.azurerm_user_assigned_identity.acr.id linuxFxVersion = "DOCKER|our-docker-registry/our-docker-registry/our-function-name:the-function-tag" appSettings = [ { "name" : "FUNCTIONS_EXTENSION_VERSION", "value" : "~4" }, { "name" : "WEBSITES_ENABLE_APP_SERVICE_STORAGE", "value" : "false" } ] } } }) } ```
btardif commented 3 months ago

@fabiocav can you take a look? this is not a UX issue