feat: Support network bypass for tasks

avm/res/container-registry/registry/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 The latest version of the changelog can be found [here](https://github.com/Azure/bicep-registry-modules/blob/main/avm/res/container-registry/registry/CHANGELOG.md).
 
+## 0.13.0
+
+### Changes
+
+- Added `networkRuleBypassAllowedForTasks` as parameter to enable or disable rule bypass for tasks
+
+### Breaking Changes
+
+- None
+
 ## 0.12.1
 
 ### Changes

avm/res/container-registry/registry/README.md

@@ -1225,6 +1225,7 @@ param trustPolicyStatus = 'enabled'
 | [`location`](#parameter-location) | string | Location for all resources. |
 | [`lock`](#parameter-lock) | object | The lock settings of the service. |
 | [`managedIdentities`](#parameter-managedidentities) | object | The managed identity definition for this resource. |
+| [`networkRuleBypassAllowedForTasks`](#parameter-networkrulebypassallowedfortasks) | bool | Whether if ACR Tasks can bypass the network rules. |
 | [`networkRuleBypassOptions`](#parameter-networkrulebypassoptions) | string | Whether to allow trusted Azure services to access a network restricted registry. |
 | [`networkRuleSetDefaultAction`](#parameter-networkrulesetdefaultaction) | string | The default action of allow or deny when no other rules match. |
 | [`networkRuleSetIpRules`](#parameter-networkrulesetiprules) | array | The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'. Set to an empty array to explicitly configure no allowed IPs. |
@@ -1771,6 +1772,14 @@ The resource ID(s) to assign to the resource. Required if a user assigned identi
 - Required: No
 - Type: array
 
+### Parameter: `networkRuleBypassAllowedForTasks`
+
+Whether if ACR Tasks can bypass the network rules.
+
+- Required: No
+- Type: bool
+- Default: `False`
+
 ### Parameter: `networkRuleBypassOptions`
 
 Whether to allow trusted Azure services to access a network restricted registry.

avm/res/container-registry/registry/main.bicep

@@ -113,6 +113,9 @@ param networkRuleBypassOptions string = 'AzureServices'
 @description('Optional. The default action of allow or deny when no other rules match.')
 param networkRuleSetDefaultAction string = 'Deny'
 
+@description('Optional. Whether if ACR Tasks can bypass the network rules.')
+param networkRuleBypassAllowedForTasks bool = false
+
 @description('Optional. The IP ACL rules. Note, requires the \'acrSku\' to be \'Premium\'. Set to an empty array to explicitly configure no allowed IPs.')
 param networkRuleSetIpRules array?
 
@@ -354,6 +357,7 @@ resource registry 'Microsoft.ContainerRegistry/registries@2025-06-01-preview' =
     dataEndpointEnabled: dataEndpointEnabled
     publicNetworkAccess: publicNetworkAccessMode
     networkRuleBypassOptions: networkRuleBypassOptions
+    networkRuleBypassAllowedForTasks: networkRuleBypassAllowedForTasks
     networkRuleSet: shouldConfigureNetworkRuleSet
       ? {
           defaultAction: networkRuleSetDefaultAction

avm/res/container-registry/registry/main.json

@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.42.1.51946",
-      "templateHash": "78351714311834863"
+      "version": "0.44.1.10279",
+      "templateHash": "1260307057351156248"
     },
     "name": "Azure Container Registries (ACR)",
     "description": "This module deploys an Azure Container Registry (ACR)."
@@ -1252,6 +1252,13 @@
         "description": "Optional. The default action of allow or deny when no other rules match."
       }
     },
+    "networkRuleBypassAllowedForTasks": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Whether if ACR Tasks can bypass the network rules."
+      }
+    },
     "networkRuleSetIpRules": {
       "type": "array",
       "nullable": true,
@@ -1517,6 +1524,7 @@
         "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
         "publicNetworkAccess": "[variables('publicNetworkAccessMode')]",
         "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+        "networkRuleBypassAllowedForTasks": "[parameters('networkRuleBypassAllowedForTasks')]",
         "networkRuleSet": "[if(variables('shouldConfigureNetworkRuleSet'), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', coalesce(parameters('networkRuleSetIpRules'), createArray())), null())]",
         "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
       },
@@ -1639,8 +1647,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "3787322352564227867"
+              "version": "0.44.1.10279",
+              "templateHash": "4263940608513193457"
             },
             "name": "Container Registries scope maps",
             "description": "This module deploys an Azure Container Registry (ACR) scope map."
@@ -1792,8 +1800,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "3012796831560516344"
+              "version": "0.44.1.10279",
+              "templateHash": "6123633129260504929"
             },
             "name": "Azure Container Registry (ACR) Replications",
             "description": "This module deploys an Azure Container Registry (ACR) Replication."
@@ -1969,8 +1977,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "13412699468141336519"
+              "version": "0.44.1.10279",
+              "templateHash": "14478595598443469747"
             },
             "name": "Container Registries Credential Sets",
             "description": "This module deploys an ACR Credential Set."
@@ -2180,8 +2188,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "1319901650921923538"
+              "version": "0.44.1.10279",
+              "templateHash": "338746873912111587"
             },
             "name": "Container Registry Cache",
             "description": "The cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))."
@@ -2336,8 +2344,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "5970335582661416899"
+              "version": "0.44.1.10279",
+              "templateHash": "6340623853029357446"
             },
             "name": "Container Registries Tokens",
             "description": "Deploys an Azure Container Registry (ACR) Token."
@@ -2530,8 +2538,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "2468771835002458415"
+              "version": "0.44.1.10279",
+              "templateHash": "11906310709471570489"
             },
             "name": "Container Registries Tasks",
             "description": "Deploys an Azure Container Registry (ACR) Task that can be used to automate container image builds and other workflows ([ref](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tasks-overview))."
@@ -2852,8 +2860,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.42.1.51946",
-              "templateHash": "3200175097987099858"
+              "version": "0.44.1.10279",
+              "templateHash": "13160039560964786779"
             },
             "name": "Azure Container Registry (ACR) Webhooks",
             "description": "This module deploys an Azure Container Registry (ACR) Webhook."

avm/res/container-registry/registry/version.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "0.12"
+  "version": "0.13"
 }