Azure Container App从ACR拉取镜像失败：UNAUTHORIZED认证错误

尝试使用Terraform部署Azure Container App时，从Azure Container Registry（ACR）拉取镜像遭遇认证错误，提示需认证才能拉取镜像。

当前Terraform配置 #

resource "azurerm_container_app" "container_app" {
  name                         = var.ContainerAppName
  resource_group_name          = var.ResourceGroup
  container_app_environment_id = azurerm_container_app_environment.container_app_env.id
  revision_mode                = "Single"

  template {
    container {
      name   = "app-name"
      image  = "${azurerm_container_registry.acr.login_server}/${var.ImageName}:latest"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }

  ingress {
    external_enabled           = true
    allow_insecure_connections = true
    target_port                = 80
    transport                  = "auto" # or "tcp" if using TCP
    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }
}

认证方式 #

当前通过Azure CLI认证Azure，后续将切换为带客户端密钥的服务主体认证。

错误信息 #

Error: creating Container App (Subscription: "<SUBSCRIPTION_ID>"
Resource Group Name: "<RESOURCE_GROUP_NAME>"
Container App Name: "<CONTAINER_APP_NAME>"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:

Status: "Failed"
Code: "ContainerAppOperationError"
Message: "Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: "<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."
Activity Id: ""

API Response:

----[start]----
{"id":"/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.App/locations/<LOCATION>/containerappOperationStatuses/<OPERATION_STATUS_ID>","name":"<OPERATION_STATUS_ID>","status":"Failed","error":{"code":"ContainerAppOperationError","message":"Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."},"startTime":"<TIMESTAMP>"}
-----[end]-----

with azurerm_container_app.container_app,
on main.tf line 41, in resource "azurerm_container_app" "container_app":
41: resource "azurerm_container_app" "container_app" {

creating Container App (Subscription: "<SUBSCRIPTION_ID>"
Resource Group Name: "<RESOURCE_GROUP_NAME>"
Container App Name: "<CONTAINER_APP_NAME>"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:

Status: "Failed"
Code: "ContainerAppOperationError"
Message: "Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: "<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."
Activity Id: ""

API Response:

----[start]----
{"id":"/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.App/locations/<LOCATION>/containerappOperationStatuses/<OPERATION_STATUS_ID>","name":"<OPERATION_STATUS_ID>","status":"Failed","error":{"code":"ContainerAppOperationError","message":"Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."},"startTime":"<TIMESTAMP>"}
-----[end]-----

注：已通过UI验证，<IMAGE_NAME>存在于<ACR_LOGIN_SERVER>，且ACR管理员已启用。

内容的提问来源于stack exchange，提问作者Hiten Samalia