Help needed to run az acr build for Private ACR

[Vamsee-264]

As suggested the steps
Next, use the following commands to update the Azure IPAM containers within your private Azure Container Registry

App Services Container

az acr build -r -t ipam:latest -f ./Dockerfile.deb .

I am using a Private endpoint connection for app service, Hence I am using Private ACR instead of pull the images from public container registry and using PE for container registry( I am hoping private access also can access to build images and pulled into Private ACR from the az acr build command)
Please suggest to run this command from self hosted agent pipeline from github actions. Any dependencies required?

[DCMattyG]

Hi @Vamsee-264, the great thing about using Docker is that everything is self-contained. The Dockerfile references the correct base images which have all of the dependencies included. We also use GitHub actions to build the production containers using the same commands.

Additionally, the az acr build command will package up all of the code and upload it to the Private ACR where it will be built, so you shouldn't need anything special to accomplish this in your GitHub Action runner outside of the Azure CLI available so the az acr build command can be exectued.

Hope that helps!

[Vamsee-264]

Hi @DCMattyG , Microsoft suggested this documentation - https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link#execute-the-az-acr-build-with-private-endpoint-and-private-registry. So, want to understand it can be executed with or without dedicated acr agent pool?

I am using private endpoints to all services in my environment and disabled public access. (which is highly recommended)

The steps which followed:

Configuring resources using Terraform (with Private endpoints to all resources and web app service with vNet Integration). In order to provision using GitHub actions to build and deploy resources.
Using Azure ACR (not sure if public container build with az acr build and pushed into Private ACR).
Preparing to run the IPAM container service in Azure App service.

Let me know if the approach can fulfill to fully configured the IPAM or suggest a suitable solution please

[DCMattyG]

Hey @Vamsee-264, before I answer this in detail I'd just like to reiterate that at the end of the day, Azure IPAM runs in a container and uses a standard Dockerfile to be built. There are many ways to accomplish this, and many different places said image can be stored.

Your question to me looks more like an "Azure Support" question around how Private Container Registries work and the appropriate way to set them up in conjunction with GitHub Action runners. I would always advise to engage Azure support in questions like this as they are more qualified to speak to what can/cannot be done and assist with any troubleshooting.

That said, I did some testing for you, and here are my results...

Steps I followed:

• Created a Virtual Network where all of my Private Endpoints could live
• Created a test Virtual Machine and installed the Azure CLI to test executing the az acr command (simulating a GitHub runner)
• Created a Private Container Registry w/ Private Access using a Private Endpoint in a subnet within the Virtual Network
• I followed the directions in the document you linked above to create a Subnet for Agent Pool, and added the required Service Endpoints (as described here)
• I created a NAT Gateway to allow traffic egress to the Internet for the Agent Pool VMSS (and attached it to the pool Subnet) as I'm not using any NVA's/Firewalls in my test setup (though you may very well be)
• Created a Subnet-integrated Agent Pool for my Private Container Registry using the Azure CLI command (shown here)
• Clone the Azure IPAM repo on my test Virtual Machine and ran the az acr build command in this format:
  • az acr build -r <registry name> -t ipam:latest -f .\Dockerfile.deb . --agent-pool <agent pool name>

With that, everything worked as expected.

I hope that helps. I'm happy to answer any further questions, but my conclusion at this point in time is that the document you shared above has all of the answers you need and by following it I was successfully able to build the container within a Private Container Registry w/ Private Endpoint and a Subnet-integrated Agent Pool.

[Vamsee-264]

Thank you for sharing the detailed technique @DCMattyG and taking the time to for practical experiment. As described in the procedures, you constructed a NAT gateway to allow public internet traffic to access the public container image via the agent pool( could you please reference to do the same process as since Azure ACR has private endpoint( I understood why public access is needed, but wantedto understand technical design of it ). Also apologize for asking several questions, but I'd like to know the following for consistently upgrading the latest code.

1. If we use a public container image, the application code is immediately downloaded and runs the newest code, but if I use ACR, do I need to pull the public container image into Private ACR and restart the app service each time?
2. Is there automatic deployment for new releases in public container application code, or does Private ACR need to pull changes every time?

[DCMattyG]

Hey @Vamsee-264, allow me to respond to your questions...

If we use a public container image, the application code is immediately downloaded and runs the newest code, but if I use ACR, do I need to pull the public container image into Private ACR and restart the app service each time?

Yes. You will be responsible for updating the images in the Private ACR. You can do this by building the images as we've discussed above, or copying the images from the Public ACR to the Private ACR by using the appropriate az acr commands.

Is there automatic deployment for new releases in public container application code, or does Private ACR need to pull changes every time?

When using the Public ACR, your App Service will naturally restart from time to time as the instances move around in Azure, so you will get the new code eventually without much intervention. For Private ACR's you will need to manually update the images inside them.

Hope that helps to answer your questions, if not I'm here so feel free to keep 'em coming!

[Vamsee-264]

Hello @DCMattyG ,
I don't prefer private ACR because it always involves obtaining the latest container image whenever there's a new release( based on your confirmation) and having a large network set up, which incurs a more cost . My challenge here is to allow public container images from a public registry.
We are using the Private Endpoint and VNet interface with the app service (web app) to prevent public access and only allow resources within our VNet.
To allow public internet hosted code in the public registry, I guess we would set up a NSG to allow public internet code.
If so, do we need to maintain a separate vNet for maintain all ipam resources privately( as we can't prefer shared vnet to create pe subnets)
(it would be great if you could share a reference to allow public traffic to run ipam app in app service)?

[DCMattyG]

Do you not allow ANY public internet access?

How do you download updates (like Windows updates)?

Is there a firewall in place or something that controls the communication from the private network to the public Internet?