How can I get/build the an App Service's web hook URL?

[matthiasguentert]

I would like to create a web hook with my container registry that calls https://$app-foobar-dev1:SomeLongPassword@app-foobar-dev1.scm.azurewebsites.net/docker/hook everytime a new image is available (myimage:latest).

Creating the web hook is straight forward. But I am struggling to receive the password from app service.

I have learned that the publishing profile holds the password and that there is a property called properties.siteConfig.publishingUsername that I expect to hold the string $app-foobar-dev1.

However how can I retrieve the password from the app service? There is no corresponding property like publishingPassword or similar.

resource app 'Microsoft.Web/sites@2020-12-01' = {
  name: name
  location: 'westeurope'
  kind: 'app,linux,container'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {    
    serverFarmId: serverFarmId
    reserved: true
    enabled: true
    httpsOnly: true
    siteConfig: {
      alwaysOn: true
      httpLoggingEnabled: true
      ipSecurityRestrictions: [
           // .. 
      ]
      scmIpSecurityRestrictionsUseMain: true
      linuxFxVersion: 'DOCKER|mcr.microsoft.com/appsvc/staticsite:latest'
      appSettings: [
        {
          name: 'DOCKER_CUSTOM_IMAGE_NAME'
          value: 'mcr.microsoft.com/appsvc/staticsite:latest'
        }
      ]
    }
  }
}

output publishingUsername string = app.properties.siteConfig.publishingUsername

[brwilkinson]

I am not sure how easy this will be via templates, since i believe this require a POST method.

Get the creds in json:
https://docs.microsoft.com/en-us/rest/api/appservice/web-apps/list-publishing-credentials

Get the whole xml published profile:
https://docs.microsoft.com/en-us/rest/api/appservice/web-apps/list-publishing-profile-xml-with-secrets

The first one has "scmUri" which is the base URI string that you are looking for to create the webhook.

"scmUri": "https://$ACU1-BRW-AOA-T5-wsCTR01:2PKncnelgy0hCXeB0soda9kzusSppdfeqmyFA@acu1-brw-aoa-t5-wsctr01.scm.azurewebsites.net" then you would append the /docker/hook

The only workaround I can think of it using a DeploymentScript to execute a az cli OR PowerShell command to retrieve this OR the REST POST as listed above.

Whichever system you are calling the webhook from for your CI, can perhaps retrieve that directly via command line prior to calling the webhook.

Another option maybe to enable Continuous Deployment directly on the WebApp? ... however I am not familiar enough with that service for containers to know if it polls the registry outwards for changes, although I guess it might be worth looking into.

[matthiasguentert]

Hey thank you very much for the time you have invested to answer my question. I'll give it a try as soon as I can and report back ,

[matthiasguentert]

Unfortunately, this didn't work for me.

For testing purposes, I have created a simple containerized ASP.NET core web app and pushed it to my repository with the latest tag. Then I made a tiny change and pushed it again to the repository... unfortunately the app service did not reload the new docker image.

Also, I don't see any Webhooks being created on the container registry (which might not be required when using DOCKER_ENABLE_CI).

This is the bicep code I've used to create my resources.

resource acr 'Microsoft.ContainerRegistry/registries@2020-11-01-preview' = {
  name: 'crbicepdemo1'
  location: 'westeurope'
  sku: {
    name: 'Basic'
  }
  properties: {
    adminUserEnabled: true
  }
}

resource plan 'microsoft.web/serverFarms@2021-01-01' = {
  name: 'plan-bicep-demo'
  location: 'westeurope'
  sku: {
    name: 'B1'
    tier: 'Basic'
  }
  kind: 'linux'
  properties: {
    targetWorkerSizeId: 0
    targetWorkerCount: 1
    reserved: true
  }
}

var image = 'crbicepdemo1.azurecr.io/webapplication1:latest'

resource app 'Microsoft.Web/sites@2021-01-01' = {
  name: 'app-bicep-demo'
  location: 'westeurope'
  kind: 'app,linux,container'
  properties: {
    serverFarmId: plan.id
    siteConfig: {
      appSettings:[
        {
          name: 'DOCKER_ENABLE_CI'
          value: 'true'
        }
        {
          name: 'DOCKER_CUSTOM_IMAGE_NAME'
          value: image
        }              
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: acr.properties.loginServer
        }
        {
          name: 'DOCKER_REGISTRY_SERVER_USERNAME'
          value: acr.name
        }
        {
          name: 'DOCKER_REGISTRY_SERVER_PASSWORD'
          value: listCredentials(acr.id, acr.apiVersion).passwords[0].value
        }
        {
          name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'
          value: 'false'
        }        
      ]
      linuxFxVersion: 'DOCKER|${image}'
    }
  }
}

[brwilkinson]

can you check in the portal on the "Container settings (classic)" for the website. Or toggle the new experience.

There are logs there, an indicator if CI is enabled correctly, plus all other settings to connect to the registry.

--

I also now see there is the webhook to configure on the container registry itself that does a push... i.e. it's not a pull from the App Service.

https://docs.microsoft.com/en-us/azure/templates/microsoft.containerregistry/2020-11-01-preview/registries/webhooks?tabs=bicep

I would recommend to just configure the CI on the WebSite in the portal and then export out the webhook settings from the container registry that is created. I'll take a look into that myself as well.

--

Edit. okay I think you maybe correct, since that webhook also requires the webhook/Service URI ... so I am not sure if that was where your question was originally positioned.

So in that case yeah I think it's going to be difficult in Bicep to retrieve that since it requires the POST method.

• The only way I see that happening if via a Deployment Scripts task to retrieve that URI, the issue is that you wouldn't want to output it, since it contains a secret, so you likely need to just configure the webhook, imperatively via the DeploymentScript, however written in a idempotent manner, where you check if it exists first OR read source and destination values and only set the destination if they don't match.

[brwilkinson]

I am now wondering if it might be possible to get this via list on the publishing credentials...
https://docs.microsoft.com/en-us/rest/api/appservice/web-apps/list-publishing-credentials

via one of these resource functions, that perhaps isn't published yet.
https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-functions-resource#implementations

I'll ask around.

[brwilkinson]

okay yeah list does work here 😎

I'll publish the answer below.

[brwilkinson]

Okay after all of that, list* does work here.

You should be able to use the following to retrieve the scmuri via list.

resource publishingcreds 'Microsoft.Web/sites/config@2021-01-01' existing = {
  name: 'myWebSite/publishingcredentials'
}

output scmuri string = list(publishingcreds.id,'2021-01-01').properties.scmUri

You can then use that to add the webhook in the ACR .. via the serviceURI.

https://docs.microsoft.com/en-us/azure/templates/microsoft.containerregistry/2020-11-01-preview/registries/webhooks?tabs=bicep

[matthiasguentert]

Awesome man, thanks a bunch for your perseverance 💪🏻 this did the trick. Here is my complete code.

resource acr 'Microsoft.ContainerRegistry/registries@2020-11-01-preview' = {
  name: 'crbicepdemo1'
  location: 'westeurope'
  sku: {
    name: 'Basic'
  }
  properties: {
    adminUserEnabled: true
  }
}

resource plan 'microsoft.web/serverFarms@2021-01-01' = {
  name: 'plan-bicep-demo'
  location: 'westeurope'
  sku: {
    name: 'B1'
    tier: 'Basic'
  }
  kind: 'linux'
  properties: {
    targetWorkerSizeId: 0
    targetWorkerCount: 1
    reserved: true
  }
}

var image = 'crbicepdemo1.azurecr.io/webapplication1:latest'

resource app 'Microsoft.Web/sites@2021-01-01' = {
  name: 'app-bicep-demo'
  location: 'westeurope'
  kind: 'app,linux,container'
  properties: {
    serverFarmId: plan.id
    siteConfig: {
      appSettings:[
        {
          name: 'DOCKER_ENABLE_CI'
          value: 'true'
        }
        {
          name: 'DOCKER_CUSTOM_IMAGE_NAME'
          value: image
        }              
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: acr.properties.loginServer
        }
        {
          name: 'DOCKER_REGISTRY_SERVER_USERNAME'
          value: acr.name
        }
        {
          name: 'DOCKER_REGISTRY_SERVER_PASSWORD'
          value: listCredentials(acr.id, acr.apiVersion).passwords[0].value
        }
        {
          name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'
          value: 'false'
        }        
      ]
      linuxFxVersion: 'DOCKER|${image}'
    }
  }
}

resource publishingcreds 'Microsoft.Web/sites/config@2021-01-01' existing = {
  name: 'app-bicep-demo/publishingcredentials'
}

var creds = list(publishingcreds.id, publishingcreds.apiVersion).properties.scmUri

resource hook 'Microsoft.ContainerRegistry/registries/webhooks@2020-11-01-preview' = {
  parent: acr
  location: 'westeurope'
  name: 'webhook1' 
  properties: {
    serviceUri: '${creds}/docker/hook'
    status: 'enabled'
  
    actions: [
      'push'
    ]
  }
}