az containerapp create parameter --registry-identity, what is it?

Question

Hi, I am trying to create a containerapp with az cli using the following params

az containerapp create --name aca-az2003 --resource-group $RG1 --environment environmentforacontpps --registry-identity $spID --registry-server acraz2003.azurecr.io --image aspnetcorecontainer:latest --ingress external

I used the $spID that I retrived it with

$spID=$(az identity show --resource-group $rg1 --name uai-az2003 --query principalId --output tsv)

where is the user-assigned identity but getting an error

--registry-identity must be an identity resource ID or 'system' or 'system-environment'

So is identity resource ID means the id for the acr? I did but also erroring

Answer 1

Hi,

You need to remove the initial $ in order to set the variable. Your code should look similar to below:

spID=$(az identity show --resource-group $rg1 --name uai-az2003 --query principalId --output tsv)

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

Hi Salam ELIAS,

Thanks for using Q & A forum.

Solution:

• You have to pass valid resource ID of user assigned managed identity to create the container app using --registry-identity parameter.

Use below commands to create container App using --registry-identity.

1. resourcegroup= <resourcegroup_name>

// fetch resourceID of User Assigned Managed Identity

2. spResourceID=$(az identity show --resource-group $resourcegroup --name <user_managed_identity_name> --query id --output tsv)

//Create Container App Environment

3. az containerapp env create --name <containerapp_environment> --resource-group $resourcegroup --location "<Location>"

//Create container registry

4. az acr create --resource-group $resourcegroup --name <registry_name> --sku Basic

// Create Container App using resourceID of managed identity

5. az containerapp create --name <container_app_name> --resource-group $resourcegroup --environment <containerapp_environment> --registry-identity $spResourceID --registry-server <Container_registry>.azurecr.io --image <image:tag> --ingress external

I have created the container app using --registry-identity:

az containerapp create --name <container_app_name> --resource-group $resourcegroup --environment <containerapp_environment> --registry-identity $spResourceID --registry-server <Container_registry>.azurecr.io --image <image:tag> --ingress external

Output:

Container app created. Access your app at https://kpaca06.yellowflower-3354809f.eastus.azurecontainerapps.io/

{

 //Removed excess config

      "registries": [

        {

          "identity": "/subscriptions/d93995eXX9e52bc/resourcegroups/pravrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kpuami",

          "passwordSecretRef": "",

          "server": "kpregistry06.azurecr.io",

          "username": ""

        }

      ],

      "secrets": null,

      "service": null

    },

//Removed excess config

    "provisioningState": "Succeeded",

    "runningStatus": "Running",

    "template": {

      "containers": [

        {

          "image": "mcr.microsoft.com/dotnet/aspnet:latest",

          "name": "kpaca06",

          "resources": {

            "cpu": 0.5,

            "ephemeralStorage": "2Gi",

            "memory": "1Gi"

          }

        }

      ]

//Removed excess config

  "type": "Microsoft.App/containerApps"

}

Container App got created with User Assigned managed identity enabled:

Hope this helps.

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.