Public anonymous registry not working in Azure Pipeline #6202
Comments
|
Can you output the version of bicep that is running in the pipeline? I'm not sure if the agent has another version of bicep pre-installed that is conflicting. |
|
Sorry about that. That is 0.4.1310 too. |
|
Can you upgrade to the latest public release of Bicep and confirm it's still happening? |
|
Results using the pipeline above replacing line 13 with |
|
Anything else I can add to make this clearer @majastrz ? |
|
@majastrz this is PSVersionTAble and Az.Accounts version from the ubuntu-latest machine in the DevOps pipeline: |
|
Hi @Agazoth, have you tested it again lately? It works for me with your pipeline logic and your 2 files, main.bicep & bicepconfig.json. I only added a few debug statements & a publish artifact step. parameters:
- name: serviceconnection
type: string
default: AzureSponsorship
stages:
- stage: Bicep_Build
displayName: Test Bicep Build
pool:
vmAgentImage: "ubuntu-latest"
jobs:
- job: TestBicepBuild
steps:
- pwsh: |
curl -Lo bicep "https://storateamsppublic.blob.core.windows.net/templates/bicep/0.4.1310/bicep"
chmod +x ./bicep
sudo mv ./bicep /usr/local/bin/bicep
bicep -v
displayName: "Install Bicep"
- task: AzurePowerShell@5
displayName: "Testing Bicep Anonymous Build"
name: build_template
inputs:
azureSubscription: ${{parameters.serviceconnection}}
ScriptType: InlineScript
Inline: |
$env:BICEP_REGISTRY_ENABLED_EXPERIMENTAL = $true
"Experimental feature is: {0}" -f $env:BICEP_REGISTRY_ENABLED_EXPERIMENTAL
Write-output 'Before'
Get-Location
ls
bicep build main.bicep
Write-output 'After'
ls
Write-output 'Builded JSON file:'
Get-Content -LiteralPath 'main.json' -Raw
azurePowerShellVersion: "latestVersion"
pwsh: true
- task: PublishBuildArtifacts@1
inputs:
PathtoPublish: '$(Build.SourcesDirectory)'
ArtifactName: 'drop'
publishLocation: 'Container' Here are my raw logs for the Initialize job step: InstallBicep step Az.Accounts is 2.7.2 as you can see below: |
|
Hi @slapointe, I am now running your pipeline. My Initialize step looks like this: And my bicep install step like this: I still get this in the "Testing Bicep Anonymous Build": The only difference seems to be the serviceconnection. You target a different tenant then I do and the tenant I target is the same tenant as the container registry resides in. |
|
Also, can you make sure you're running on the latest release: https://github.com/Azure/bicep/releases/tag/v0.4.1318 You seems to be running not an official release, is this a nightly build or something? I've added another registry that is in my tenant in my Did you tried a brand new container registry, with standard sku and anonymous access turned on and/or a new service connection? Sidenote, you don't need the experimental flag anymore. |
|
@Agazoth One thing I could see looking at the source code is that we fallback with the anonymous client when we hit a 401 (Unauthorized). You hit a 403 (Forbidden) 403 Definition: "The request contained valid data and was understood by the server, but the server is refusing action." Could you verify that you maybe in a situation like this: the service connection credentials are valid for AAD auth but the service connection do not have proper access to your ACR (if we don't mind anonymous access) ? If so, it is a bug and a scenario we do not yet support. |
|
@slapointe - I get the same results with 1318.
This is exactly the case. The serviceprincipal used for the serviceconnection does not have ARC pull and resides in the same tenant as the container registry (valid for AAD auth). |
|
Got it. It should be a quick fix to implement. Meanwhile, you have a workaround by giving the proper access to the service principal that is used in your service connection. |
3 tasks
Repository owner
moved this from Todo
to Done
in Bicep
Mar 25, 2022
alex-frankel
added
top 5 bug
top 10 committed
and removed
top 5 bug
top 10 committed
labels
ghost
locked as resolved and limited conversation to collaborators
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Bicep version
0.4.1310
Describe the bug
We have a setup with a bicep registry that has anonymous access allowed. When building templates locally, the registry can be accessed from unauthenticated PowerShell sessions in both Windows and WSL Ubuntu. PowerShell versions:
The bicepconfig.json is placed in the same folder as the main.bicep file.
Running the same build from a ubuntu-latest machine in an Azure DevOps pipeline generates this error:
To Reproduce
main.bicep
bicepconfig.json
pipeline.yaml
Additional context
Just update the serviceconnection to target your own environment
The text was updated successfully, but these errors were encountered: