From 18aaf2b69524e54e3562a3a622a0394fcd39ec25 Mon Sep 17 00:00:00 2001 From: Che Date: Tue, 12 May 2026 20:15:44 +0100 Subject: [PATCH 1/2] update container app to use managed identity for connecting to registry. --- src/terraform/container_app.tf | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/terraform/container_app.tf b/src/terraform/container_app.tf index f2fd04c..4ff22bd 100644 --- a/src/terraform/container_app.tf +++ b/src/terraform/container_app.tf @@ -3,7 +3,7 @@ resource "azurerm_container_app_environment" "this" { location = azurerm_resource_group.this.location resource_group_name = azurerm_resource_group.this.name log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id - tags = local.common_tags + tags = local.common_tags } resource "azurerm_container_app" "this" { @@ -11,12 +11,18 @@ resource "azurerm_container_app" "this" { container_app_environment_id = azurerm_container_app_environment.this.id resource_group_name = azurerm_resource_group.this.name revision_mode = "Single" - tags = local.common_tags + tags = local.common_tags + + // use managed identity for private ACR image pulls + registry { + server = azurerm_container_registry.this.login_server + identity = "System" + } // bootstrap - pipeline owns image template { container { - name = "${local.name_prefix}" + name = local.name_prefix image = "mcr.microsoft.com/k8se/quickstart:latest" cpu = 0.25 memory = "0.5Gi" @@ -39,4 +45,4 @@ resource "azurerm_role_assignment" "container_app_acr_pull" { scope = azurerm_container_app.this.id role_definition_name = "Contributor" principal_id = data.azurerm_client_config.this.object_id -} \ No newline at end of file +} From 3eed04023bdf34405dfe45bd5af4dfb12ab405d3 Mon Sep 17 00:00:00 2001 From: Che Date: Tue, 12 May 2026 20:42:44 +0100 Subject: [PATCH 2/2] update secrets required following best practice. --- .github/workflows/_terraform.yml | 7 +++++++ .github/workflows/ci-cd.yml | 4 ++++ .github/workflows/pr-validation.yml | 4 ++++ 3 files changed, 15 insertions(+) diff --git a/.github/workflows/_terraform.yml b/.github/workflows/_terraform.yml index 5b148b3..8b1c351 100644 --- a/.github/workflows/_terraform.yml +++ b/.github/workflows/_terraform.yml @@ -23,6 +23,13 @@ on: required: false type: string default: 1.9.8 + secrets: + AZURE_CLIENT_ID: + required: true + AZURE_TENANT_ID: + required: true + AZURE_SUBSCRIPTION_ID: + required: true outputs: resource_group_name: diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 08c19b0..89cbede 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -53,6 +53,10 @@ jobs: needs: changes if: needs.changes.outputs.terraform == 'true' uses: ./.github/workflows/_terraform.yml + secrets: + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} with: apply: true github-environment: stg diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index 190b889..80a0f5c 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -63,6 +63,10 @@ jobs: needs: changes if: needs.changes.outputs.terraform == 'true' uses: ./.github/workflows/_terraform.yml + secrets: + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} with: github-environment: stg