How can I use a SystemAssigned identity when pulling an image from Azure Container Registry into Azure Container Instances?

Question

I want to create a container (or container group) in Azure Container Instances, pulling the image(s) from Azure Container Registry - but with using a SystemAssigned identity. With that I want to avoid using ACR login credentials, a service principal or a UserAssigned identity.

When I run this script (Azure CLI in PowerShell) ...

$LOC = "westeurope"
$RG = "myresourcegroup"
$ACRNAME = "myacr"

az configure --defaults location=$LOC group=$RG

$acr = az acr show -n $ACRNAME -o json | ConvertFrom-Json -Depth 10

az container create --name app1 --image $($acr.loginServer+"/app1") `
    --assign-identity --role acrpull --scope $acr.id `
    --debug

... ACI does not seem to recognize that it should be already authorized for ACR and shows this prompt:

Image registry username:

Azure CLI version: 2.14.0

Does this make sense? Is the ACI managed identity supported for ACR?

Nancy Xiong Nancy Xiong · Accepted Answer · 2020-11-02T07:55:17

In your code, when you create an Azure container with a managed identity that is being created at the ACI creating time to authenticate to ACR. I am afraid that you can not do that because there are limitations

You can't use a managed identity to pull an image from Azure Container Registry when creating a container group. The identity is only available within a running container.

How can I use a SystemAssigned identity when pulling an image from Azure Container Registry into Azure Container Instances?

1 Answers