update container app to use managed identity for connecting to registry.

.github/workflows/_terraform.yml

@@ -23,6 +23,13 @@ on:
         required: false
         type: string
         default: 1.9.8
+    secrets:
+      AZURE_CLIENT_ID:
+        required: true
+      AZURE_TENANT_ID:
+        required: true
+      AZURE_SUBSCRIPTION_ID:
+        required: true
 
     outputs:
       resource_group_name:

.github/workflows/ci-cd.yml

@@ -53,6 +53,10 @@ jobs:
     needs: changes
     if: needs.changes.outputs.terraform == 'true'
     uses: ./.github/workflows/_terraform.yml
+    secrets:
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
     with:
       apply: true
       github-environment: stg

.github/workflows/pr-validation.yml

@@ -63,6 +63,10 @@ jobs:
     needs: changes
     if: needs.changes.outputs.terraform == 'true'
     uses: ./.github/workflows/_terraform.yml
+    secrets:
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
     with:
       github-environment: stg
 

src/terraform/container_app.tf

@@ -3,20 +3,26 @@ resource "azurerm_container_app_environment" "this" {
   location                   = azurerm_resource_group.this.location
   resource_group_name        = azurerm_resource_group.this.name
   log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
-  tags = local.common_tags
+  tags                       = local.common_tags
 }
 
 resource "azurerm_container_app" "this" {
   name                         = "${local.name_prefix}-app"
   container_app_environment_id = azurerm_container_app_environment.this.id
   resource_group_name          = azurerm_resource_group.this.name
   revision_mode                = "Single"
-  tags = local.common_tags
+  tags                         = local.common_tags
+
+  // use managed identity for private ACR image pulls
+  registry {
+    server   = azurerm_container_registry.this.login_server
+    identity = "System"
+  }
 
   // bootstrap - pipeline owns image
   template {
     container {
-      name   = "${local.name_prefix}"
+      name   = local.name_prefix
       image  = "mcr.microsoft.com/k8se/quickstart:latest"
       cpu    = 0.25
       memory = "0.5Gi"
@@ -39,4 +45,4 @@ resource "azurerm_role_assignment" "container_app_acr_pull" {
   scope                = azurerm_container_app.this.id
   role_definition_name = "Contributor"
   principal_id         = data.azurerm_client_config.this.object_id
-}
+}