Skip to content

Commit f8fde04

Browse files
pankajagrawal16pankajagrawal16
committed
chore: use identity instead of password for ACR
1 parent 1de2d7b commit f8fde04

8 files changed

Lines changed: 52 additions & 106 deletions

File tree

‎bicep/main.bicep‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -100,17 +100,6 @@ param keyVaultName string = '${prefix}kv-${uniqueString(resourceGroup().id)}${su
100100
@description('The name of the container registry.')
101101
param containerRegistryName string
102102

103-
@description('The username of the container registry user.')
104-
param containerRegistryUsername string
105-
106-
@description('The password name of the container registry.')
107-
// We disable lint of this line as it is not a secret
108-
#disable-next-line secure-secrets-in-params
109-
param containerRegistryPasswordRefName string
110-
111-
@secure()
112-
param containerRegistryPassword string
113-
114103
@description('The image for the backend processor service.')
115104
param backendProcessorServiceImage string
116105

@@ -212,9 +201,6 @@ module containerApps 'modules/container-apps.bicep' = {
212201
backendApiServiceName: backendApiServiceName
213202
frontendWebAppServiceName: frontendWebAppServiceName
214203
containerAppsEnvironmentName: containerAppsEnvironmentName
215-
containerRegistryUsername: containerRegistryUsername
216-
containerRegistryPasswordRefName: containerRegistryPasswordRefName
217-
containerRegistryPassword: containerRegistryPassword
218204
keyVaultId: keyVault.outputs.keyVaultId
219205
serviceBusName: serviceBus.outputs.serviceBusName
220206
serviceBusTopicName: serviceBus.outputs.serviceBusTopicName

‎bicep/main.parameters.json‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -62,15 +62,6 @@
6262
"containerRegistryName": {
6363
"value": "<CONTAINER_REGISTRY_NAME>"
6464
},
65-
"containerRegistryUsername": {
66-
"value": "<CONTAINER_REGISTRY_ADMIN>"
67-
},
68-
"containerRegistryPasswordRefName": {
69-
"value": "acaworkshopacrazurecrio-acaworkshopacr"
70-
},
71-
"containerRegistryPassword": {
72-
"value": "<CONTAINER_REGISTRY_PASSWORD>"
73-
},
7465
"backendProcessorServiceImage": {
7566
"value": "<CONTAINER_REGISTRY_NAME>.azurecr.io/tasksmanager/tasksmanager-backend-processor:latest"
7667
},

‎bicep/modules/container-apps.bicep‎

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -65,16 +65,6 @@ param externalStorageAccountName string
6565
@description('The name of the container registry.')
6666
param containerRegistryName string
6767

68-
@description('The username of the container registry user.')
69-
param containerRegistryUsername string
70-
71-
// We disable lint of this line as it is not a secret
72-
#disable-next-line secure-secrets-in-params
73-
param containerRegistryPasswordRefName string
74-
75-
@secure()
76-
param containerRegistryPassword string
77-
7868
@description('The image for the backend api service.')
7969
param backendApiServiceImage string
8070

@@ -87,6 +77,9 @@ param frontendWebAppServiceImage string
8777
@description('The name of the application insights.')
8878
param applicationInsightsName string
8979

80+
var containerRegistryPullRoleGuid='7f951dda-4ed3-4680-a7ca-43fe172d538d'
81+
82+
9083
// ------------------
9184
// RESOURCES
9285
// ------------------
@@ -100,6 +93,26 @@ resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing
10093
name: applicationInsightsName
10194
}
10295

96+
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' existing = {
97+
name: containerRegistryName
98+
}
99+
100+
resource containerRegistryUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
101+
name: 'aca-user-identity-${uniqueString(resourceGroup().id)}'
102+
location: location
103+
tags: tags
104+
}
105+
106+
resource containerRegistryPullRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if(!empty(containerRegistryName)) {
107+
name: guid(subscription().id, containerRegistry.id, containerRegistryUserAssignedIdentity.id)
108+
scope: containerRegistry
109+
properties: {
110+
principalId: containerRegistryUserAssignedIdentity.properties.principalId
111+
roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', containerRegistryPullRoleGuid)
112+
principalType: 'ServicePrincipal'
113+
}
114+
}
115+
103116
module frontendWebAppService 'container-apps/webapp-frontend-service.bicep' = {
104117
name: 'frontendWebAppService-${uniqueString(resourceGroup().id)}'
105118
params: {
@@ -108,11 +121,10 @@ module frontendWebAppService 'container-apps/webapp-frontend-service.bicep' = {
108121
tags: tags
109122
containerAppsEnvironmentId: containerAppsEnvironment.id
110123
containerRegistryName: containerRegistryName
111-
containerRegistryUsername: containerRegistryUsername
112-
containerRegistryPasswordRefName: containerRegistryPasswordRefName
113-
containerRegistryPassword: containerRegistryPassword
124+
containerRegistryUserAssignedIdentityId: containerRegistryUserAssignedIdentity.id
114125
frontendWebAppServiceImage: frontendWebAppServiceImage
115126
appInsightsInstrumentationKey: applicationInsights.properties.InstrumentationKey
127+
116128
}
117129
}
118130

@@ -126,9 +138,7 @@ module backendApiService 'container-apps/webapi-backend-service.bicep' = {
126138
serviceBusName: serviceBusName
127139
serviceBusTopicName: serviceBusTopicName
128140
containerRegistryName: containerRegistryName
129-
containerRegistryUsername: containerRegistryUsername
130-
containerRegistryPasswordRefName: containerRegistryPasswordRefName
131-
containerRegistryPassword: containerRegistryPassword
141+
containerRegistryUserAssignedIdentityId: containerRegistryUserAssignedIdentity.id
132142
backendApiServiceImage: backendApiServiceImage
133143
cosmosDbName: cosmosDbName
134144
cosmosDbDatabaseName: cosmosDbDatabaseName
@@ -149,9 +159,7 @@ module backendProcessorService 'container-apps/processor-backend-service.bicep'
149159
serviceBusTopicName: serviceBusTopicName
150160
serviceBusTopicAuthorizationRuleName: serviceBusTopicAuthorizationRuleName
151161
containerRegistryName: containerRegistryName
152-
containerRegistryUsername: containerRegistryUsername
153-
containerRegistryPasswordRefName: containerRegistryPasswordRefName
154-
containerRegistryPassword: containerRegistryPassword
162+
containerRegistryUserAssignedIdentityId: containerRegistryUserAssignedIdentity.id
155163
sendGridKeySecretName: sendGridKeySecretName
156164
sendGridKeySecretValue: sendGridKeySecretValue
157165
externalStorageAccountName: externalStorageAccountName

‎bicep/modules/container-apps/processor-backend-service.bicep‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,8 @@ param externalStorageAccountName string
5454
@description('The name of the container registry.')
5555
param containerRegistryName string
5656

57-
@description('The username of the container registry user.')
58-
param containerRegistryUsername string
59-
60-
@description('The password name of the container registry.')
61-
// We disable lint of this line as it is not a secret
62-
#disable-next-line secure-secrets-in-params
63-
param containerRegistryPasswordRefName string
64-
65-
@secure()
66-
param containerRegistryPassword string
57+
@description('The resource ID of the user assigned managed identity for the container registry to be able to pull images from it.')
58+
param containerRegistryUserAssignedIdentityId string
6759

6860
@description('The image for the backend processor service.')
6961
param backendProcessorServiceImage string
@@ -106,7 +98,10 @@ resource backendProcessorService 'Microsoft.App/containerApps@2022-06-01-preview
10698
location: location
10799
tags: tags
108100
identity: {
109-
type: 'SystemAssigned'
101+
type: 'SystemAssigned,UserAssigned'
102+
userAssignedIdentities: {
103+
'${containerRegistryUserAssignedIdentityId}': {}
104+
}
110105
}
111106
properties: {
112107
managedEnvironmentId: containerAppsEnvironmentId
@@ -129,16 +124,11 @@ resource backendProcessorService 'Microsoft.App/containerApps@2022-06-01-preview
129124
name: 'appinsights-key'
130125
value: appInsightsInstrumentationKey
131126
}
132-
{
133-
name: containerRegistryPasswordRefName
134-
value: containerRegistryPassword
135-
}
136127
]
137128
registries: !empty(containerRegistryName) ? [
138129
{
139130
server: '${containerRegistryName}.azurecr.io'
140-
username: containerRegistryUsername
141-
passwordSecretRef: containerRegistryPasswordRefName
131+
identity: containerRegistryUserAssignedIdentityId
142132
}
143133
] : []
144134
}

‎bicep/modules/container-apps/webapi-backend-service.bicep‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,8 @@ param cosmosDbCollectionName string
3737
@description('The name of the container registry.')
3838
param containerRegistryName string
3939

40-
@description('The username of the container registry user.')
41-
param containerRegistryUsername string
42-
43-
@description('The password name of the container registry.')
44-
// We disable lint of this line as it is not a secret
45-
#disable-next-line secure-secrets-in-params
46-
param containerRegistryPasswordRefName string
47-
48-
@secure()
49-
param containerRegistryPassword string
40+
@description('The resource ID of the user assigned managed identity for the container registry to be able to pull images from it.')
41+
param containerRegistryUserAssignedIdentityId string
5042

5143
@description('The image for the backend api service.')
5244
param backendApiServiceImage string
@@ -87,7 +79,10 @@ resource backendApiService 'Microsoft.App/containerApps@2022-06-01-preview' = {
8779
location: location
8880
tags: tags
8981
identity: {
90-
type: 'SystemAssigned'
82+
type: 'SystemAssigned,UserAssigned'
83+
userAssignedIdentities: {
84+
'${containerRegistryUserAssignedIdentityId}': {}
85+
}
9186
}
9287
properties: {
9388
managedEnvironmentId: containerAppsEnvironmentId
@@ -108,19 +103,14 @@ resource backendApiService 'Microsoft.App/containerApps@2022-06-01-preview' = {
108103
registries: !empty(containerRegistryName) ? [
109104
{
110105
server: '${containerRegistryName}.azurecr.io'
111-
username: containerRegistryUsername
112-
passwordSecretRef: containerRegistryPasswordRefName
106+
identity: containerRegistryUserAssignedIdentityId
113107
}
114108
] : []
115109
secrets: [
116110
{
117111
name: 'appinsights-key'
118112
value: appInsightsInstrumentationKey
119113
}
120-
{
121-
name: containerRegistryPasswordRefName
122-
value: containerRegistryPassword
123-
}
124114
]
125115
}
126116
template: {

‎bicep/modules/container-apps/webapp-frontend-service.bicep‎

Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,8 @@ param frontendWebAppServiceName string
2020
@description('The name of the container registry.')
2121
param containerRegistryName string
2222

23-
@description('The username of the container registry user.')
24-
param containerRegistryUsername string
25-
26-
@description('The password name of the container registry.')
27-
// We disable lint of this line as it is not a secret
28-
#disable-next-line secure-secrets-in-params
29-
param containerRegistryPasswordRefName string
30-
31-
@secure()
32-
param containerRegistryPassword string
23+
@description('The resource ID of the user assigned managed identity for the container registry to be able to pull images from it.')
24+
param containerRegistryUserAssignedIdentityId string
3325

3426
@description('The image for the frontend web app service.')
3527
param frontendWebAppServiceImage string
@@ -46,6 +38,12 @@ resource frontendWebAppService 'Microsoft.App/containerApps@2022-06-01-preview'
4638
name: frontendWebAppServiceName
4739
location: location
4840
tags: tags
41+
identity: {
42+
type: 'UserAssigned'
43+
userAssignedIdentities: {
44+
'${containerRegistryUserAssignedIdentityId}': {}
45+
}
46+
}
4947
properties: {
5048
managedEnvironmentId: containerAppsEnvironmentId
5149
configuration: {
@@ -67,16 +65,11 @@ resource frontendWebAppService 'Microsoft.App/containerApps@2022-06-01-preview'
6765
name: 'appinsights-key'
6866
value: appInsightsInstrumentationKey
6967
}
70-
{
71-
name: containerRegistryPasswordRefName
72-
value: containerRegistryPassword
73-
}
7468
]
7569
registries: !empty(containerRegistryName) ? [
7670
{
7771
server: '${containerRegistryName}.azurecr.io'
78-
username: containerRegistryUsername
79-
passwordSecretRef: containerRegistryPasswordRefName
72+
identity: containerRegistryUserAssignedIdentityId
8073
}
8174
] : []
8275
}

‎docs/aca/10-aca-iac-bicep/index.md‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -344,17 +344,11 @@ Next, we will prepare container images for the three container apps and update t
344344

345345
3. Update the `main.parameters.jsonc` file with the container registry name and the container images names as shown below:
346346

347-
```json hl_lines="3 6 9 12 15 18"
347+
```json hl_lines="3 6 9 12"
348348
{
349349
"containerRegistryName": {
350350
"value": "<CONTAINER_REGISTRY_NAME>"
351351
},
352-
"containerRegistryUsername": {
353-
"value": "<CONTAINER_REGISTRY_ADMIN>"
354-
},
355-
"containerRegistryPassword": {
356-
"value": "<CONTAINER_REGISTRY_PASSWORD>"
357-
},
358352
"backendProcessorServiceImage": {
359353
"value": "<CONTAINER_REGISTRY_NAME>.azurecr.io/tasksmanager/<BACKEND_API_NAME>:latest"
360354
},
@@ -405,17 +399,11 @@ Next, we will prepare container images for the three container apps and update t
405399

406400
3. Update the `main.parameters.jsonc` file with the container registry name and the container images names as shown below:
407401

408-
```json hl_lines="3 6 9 12 15 18"
402+
```json hl_lines="3 6 9 12"
409403
{
410404
"containerRegistryName": {
411405
"value": "<CONTAINER_REGISTRY_NAME>"
412406
},
413-
"containerRegistryUsername": {
414-
"value": "<CONTAINER_REGISTRY_ADMIN>"
415-
},
416-
"containerRegistryPassword": {
417-
"value": "<CONTAINER_REGISTRY_PASSWORD>"
418-
},
419407
"backendProcessorServiceImage": {
420408
"value": "<CONTAINER_REGISTRY_NAME>.azurecr.io/tasksmanager/tasksmanager-backend-processor:latest"
421409
},

‎docs/assets/images/10-aca-iac-bicep/aca-rescources.jpg‎

-81.2 KB
Loading

0 commit comments

Comments
 (0)