Attempting to deploy a Container app - Azure API says no.

Question

Attempting to deploy a Container app - Azure API says no.

TH-4622 40

I am attempting to deploy an Azure Container App via Terraform but the Azure API is returning the following. Can anyone decipher what this means please, or tell me where I can get information on what this issue could be? It's essentially one of the MS demo apps, but being deployed with Terraform instead of Bicep, and using private endpoints. It seems to think there's a invalid name but the name matches exactly. There is a managed identity which is also referenced correctly.

API Response:

{"id":"/subscriptions/

Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-16T21:16:36.26+00:00
Hello TH-4622,

Could you please confirm on this, have you added the AcrPull role on your ACR. If not follow the below steps and please share the update with us.

To assign the AcrPull role to a managed identity via the Azure Portal, start by navigating to your Azure Container Registry (ACR) by searching for "Container Registries" and selecting your registry. In the left-hand menu, go to Access control (IAM) and click Add > Add role assignment. In the role selection screen, search for and choose AcrPull. On the next screen, under "Assign access to," select User, group, or service principal, then click + Select members and choose your managed identity (either user-assigned or system-assigned). Click Select, then proceed to Review + assign to complete the role assignment.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-17T23:02:22.3533333+00:00

Hello TH-4622,

Just checking in to see if you had a chance to review my previous message and confirm on the permissions part so that we can guide you accordingly.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-19T00:09:11.3266667+00:00

Hello TH-4622,

We wanted to follow up on the issue you encountered. Please let us know if it's resolved or if you need further assistance.
TH-4622 40 Reputation points

2025-04-22T09:52:45.33+00:00

We resolved this issue ourselves. It seems that there is a peculiarity with Azure Containers requiring two DNS records, for the data endpoint and the login endpoint, and two IP addresses. When using private endpoints these require managing. This is poorly documented we felt, and only really got an idea when seeing a passing comment in a 3rd party blog article. Furthermore there was no way of determining what IP address one of these endpoints gets from the Terraform Azurerm module. We figured it out by using a bit of guesswork in our Terraform code.
TH-4622 40 Reputation points

2025-04-22T09:54:45.2933333+00:00

Thanks for trying, but no, that was not the fix. I have posted below for further information.
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-22T15:45:16.28+00:00

@TH-4622 ,

Thank you for sharing the details of the resolution you found for the Azure Container App deployment issue. It’s great to hear that you were able to identify the root cause related to the DNS configuration for the private endpoints, and I appreciate you clarifying the challenge with managing the DNS records for both the data and login endpoints.

I understand that working with private endpoints in Azure can sometimes lead to unexpected complexities, especially when configuring private DNS and ensuring proper integration with the ACR. Your feedback about the limited documentation on managing private endpoints and DNS resolution in this context is extremely valuable.

I’ll be sure to pass along your feedback about the documentation gap regarding private endpoints and VNet integration to the Container Apps team.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-28T21:59:39.54+00:00

Hello TH-4622,

Thank you for your patience and for sharing your feedback on the Q&A community platform. I’m glad to hear that you were able to resolve your issue, and I appreciate you sharing your solution! Your contribution is valuable and can help others in the community facing similar challenges.

As per the Microsoft Q&A community policy, "The question author cannot accept their own answer. They can only accept answers by others"

I’m reposting your solution here:

To manage Azure Container private endpoints effectively, ensure that two DNS records and corresponding IP addresses are created—one for the data endpoint and one for the login endpoint. Configure these records manually when using private endpoints. In Terraform, derive the necessary IP addresses by referencing the associated network interface of the private endpoint resource, using azurerm_network_interface data sources to retrieve the assigned IPs.

1 answer

Your answer

Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-16T21:16:36.26+00:00

Hello TH-4622,

Could you please confirm on this, have you added the AcrPull role on your ACR. If not follow the below steps and please share the update with us.

To assign the AcrPull role to a managed identity via the Azure Portal, start by navigating to your Azure Container Registry (ACR) by searching for "Container Registries" and selecting your registry. In the left-hand menu, go to Access control (IAM) and click Add > Add role assignment. In the role selection screen, search for and choose AcrPull. On the next screen, under "Assign access to," select User, group, or service principal, then click + Select members and choose your managed identity (either user-assigned or system-assigned). Click Select, then proceed to Review + assign to complete the role assignment.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-17T23:02:22.3533333+00:00

Hello TH-4622,

Just checking in to see if you had a chance to review my previous message and confirm on the permissions part so that we can guide you accordingly.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-19T00:09:11.3266667+00:00

Hello TH-4622,

We wanted to follow up on the issue you encountered. Please let us know if it's resolved or if you need further assistance.
TH-4622 40 Reputation points

2025-04-22T09:52:45.33+00:00

We resolved this issue ourselves. It seems that there is a peculiarity with Azure Containers requiring two DNS records, for the data endpoint and the login endpoint, and two IP addresses. When using private endpoints these require managing. This is poorly documented we felt, and only really got an idea when seeing a passing comment in a 3rd party blog article. Furthermore there was no way of determining what IP address one of these endpoints gets from the Terraform Azurerm module. We figured it out by using a bit of guesswork in our Terraform code.
TH-4622 40 Reputation points

2025-04-22T09:54:45.2933333+00:00

Thanks for trying, but no, that was not the fix. I have posted below for further information.
Khadeer Ali 4,960 Reputation points Microsoft External Staff

2025-04-22T15:45:16.28+00:00

@TH-4622 ,

Thank you for sharing the details of the resolution you found for the Azure Container App deployment issue. It’s great to hear that you were able to identify the root cause related to the DNS configuration for the private endpoints, and I appreciate you clarifying the challenge with managing the DNS records for both the data and login endpoints.

I understand that working with private endpoints in Azure can sometimes lead to unexpected complexities, especially when configuring private DNS and ensuring proper integration with the ACR. Your feedback about the limited documentation on managing private endpoints and DNS resolution in this context is extremely valuable.

I’ll be sure to pass along your feedback about the documentation gap regarding private endpoints and VNet integration to the Container Apps team.
Loknathsatyasaivarma Mahali 1,615 Reputation points Microsoft External Staff

2025-04-28T21:59:39.54+00:00

Hello TH-4622,

Thank you for your patience and for sharing your feedback on the Q&A community platform. I’m glad to hear that you were able to resolve your issue, and I appreciate you sharing your solution! Your contribution is valuable and can help others in the community facing similar challenges.

As per the Microsoft Q&A community policy, "The question author cannot accept their own answer. They can only accept answers by others"

I’m reposting your solution here:

To manage Azure Container private endpoints effectively, ensure that two DNS records and corresponding IP addresses are created—one for the data endpoint and one for the login endpoint. Configure these records manually when using private endpoints. In Terraform, derive the necessary IP addresses by referencing the associated network interface of the private endpoint resource, using azurerm_network_interface data sources to retrieve the assigned IPs.

Answer 1

Abiola Akinbade 27,060

Hello TH-4622

Thanks for your question
It is either:

Your managed identity does not have the correct permissions to perform this. The managed identity needs the AcrPull role on your ACR or your container app is no configured to use it.

Also the error shows both "appname.azurecr.io" and "app-name-here.azurecr.io" is this correct?

Check that the image exists in your ACR

az acr repository show-tags --name appname --repository img-search-nodejs-app

Also check your terraform to check that the registry name is correct. Looks like 2 different names.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Please note: If you have Priority Community support please wait for a dedicated Microsoft support representative to assist you, as they have access to the necessary backend resources.

Regards,

Abiola

TH-4622 40 Reputation points

2025-04-14T15:39:01.48+00:00
Hi Abioloa,

The managed identity does have AcrPull permission and verified in the portal.

The app-name-here was just me removing the identifiable aspects in the error; they are the same in the actual error.

The image exists in the ACR

The same with the registry, the names in the actual error/terraform are correct. Thanks for responding though.
Abiola Akinbade 27,060 Reputation points

2025-04-14T16:01:41.0433333+00:00

could you possibly be using a PE or vnet integration?
TH-4622 40 Reputation points

2025-04-15T08:23:43.8766667+00:00

Hi Abiola, yes, as I stated there are private endpoints. There is an integration network for the Azure Container Environment also. This is perhaps resulting in the the error. We're now attempting to test without the private endpoints just to see what happens. I could do with a reference architecture diagram/explanation as an example to check we've configured PEPs and vnet integration correctly, but information out in the wild seems thin on the ground. I have private endpoints and integration networks in other projects, but this is the first time we're attempting with Azure Containers.

Share via

Attempting to deploy a Container app - Azure API says no.

1 answer

Your answer