Azure container app cannot pull image from azure container registry which are present in different subscriptions

Question

my scenario is like I have shared container registry in one subscription say subscription A, I need to pull image from ACR to ACA through DevOps pipelines. The ACAs are present for each environment like dev, test, UAT & etc which is in another subscription say subscription B. I am using 'az containerapp up' command in azure devops pipelines to pull image of the shared ACR. Getting error 'The resource is not found in the subscription B'. What might be the alternative possible solution because we need to reduce cost of using container registry for each environment. I am using service connections to pull image and the service connections are separate for separate subscriptions.

I know that they are in different subscriptions but I searched on websites to connect two different subscriptions. Is there a possibility that I can connect two different service connections in azure devops & use one service connection to pull that image.

Answer 1

Before integrating the Azure CLI command az containerapp up with Azure pipelines, please first confirm you are able to pull the ACR image from Sub B to deploy the container app in Sub A via CloudShell or LocalPowerShell .

I tested to create ARM service connection with Tenant Root Management Group whose referenced service principle had access to both subscriptions; the issue still existed.

In local PowerShell, I az login with my user account and still could reproduce the issue.

az containerapp up `
    --name XXcontainerapp `
    --image XXacrsubB.azurecr.io/azurecontainerappdemo:XX `
    --resource-group rg-containerapp `
    --environment TestEnv `
    --registry-username XXacrsubB `
    --registry-password XXXXXX

It seemed to be a limitation with this command az containerapp up . You may consider reporting the issue with Azure CLI.