Deploy Azure Container App to different Resource Group in Azure pipeline-CodePudding

I´m playing around with Azure Container Apps, but I'm running into a small issue when trying to deploy through Azure Pipelines, the thing is that I have one Azure Container Registry and I want to create a new Revision for ca-sandbox-1 and ca-sandbox-2, but since there are in different Resource Group I always get a "Forbidden" when executing Azure Pipelines

If I create the Azure Container Registry in the same Resource Group the pipeline works well. Now If I try to create a new revision in two different Resource Group, only works from AzureCLI or VSCode. Is there a way of making this work from Azure Pipelines?

Azure rg-core (Resource Group)

acrcore (Azure Container Registry)
ca-core (Azure Container App)

rg-sandbox-1 (Resource Group)

ca-sandbox-1 (Azure Container App)

rg-sandbox-2 (Resource Group)

ca-sandbox-2 (Azure Container App)

Azure-pipeline.yml

- main

stages:
- stage: Build
  displayName: Build and push stage
  jobs:
  - job: Build
    displayName: Build
    pool:
      vmImage: 'ubuntu-latest'

 steps:
    - task: Docker@2
      displayName: 'docker build and publish'
      inputs:
        containerRegistry: 'acr-core-connection'
        repository: 'ca-core'
        command: 'buildAndPush'
        Dockerfile: '**/Dockerfile'
        buildContext: '.'

    - task: AzureContainerAppsRC@0
      inputs:
        azureSubscription: 'subs-rg-core'
        acrName: 'acrcore'
        imageToDeploy: 'acrcore.azurecr.io/api-sandbox:$(Build.BuildId)'
        containerAppName: 'ca-sandbox-1'
        resourceGroup: 'rg-sandbox-1'
        targetPort: '80'

CodePudding user response：

Is there a way of making this work from Azure Pipelines?

From your description, you need to access the azure container registry and azure container app in different Resource Groups.

To meet your requirement, you need to create a Service Connection at Subscription Level.

Navigate to Project Settings -> Service Connections -> Select Azure Resource Manager Service Connection. Then you can only select Azure Subscription.

In this case, the Service Connection will have access to whole Azure Subscription.

For example: