Authenticating to ACR using az credentials / managed identity

[mbkrafft]

Hi,

I'm trying to build and push images to an Azure Container Registry without having docker as an explicit dependency. The image is being built correctly, but pushing it to a remote registry is not working without an explicit docker login.

Ideally I would like to be able to auth and push the image to an ACR by using:

• the az login and az acr login -n <registry> commands locally
• a managed identity in the ADO build agents

Any roadmap or potential workarounds for using the Azure Default Credentials to directly push to a private ACR specified by the <ContainerRegistry>$(registryName)</ContainerRegistry> property during dotnet publish?

[baronfel]

Hi @mbkrafft - this is a duplicate of #425 which our team is currently investigating. We do want to support Managed Identity as a first-class options, and we do currently support authenticating to ACR using

• admin credentials,
• non-admin token credentials, and
• Azure OIDC credentials (using az acr login, per their docs on how to use this inside a CI pipeline)

You can see some examples of these methods on this GitHub Actions run.

Thanks!

[mbkrafft]

Sorry about the duplicate and thanks for the swift response @baronfel . Will look into it!

EDIT:
Upon further testing I'm still not able to directly push the image to an ACR.

This works:
az login
az acr login -n <registry>
dotnet publish (to local docker deamon)
docker tag <image> <registry>/<image>
docker push <registry>/<image>.

but I'm not able to push to the registry directly from dotnet publish by any of these methods:

1. az login
az acr login -n <registry>
dotnet publish (directly to remote registry)

2. az login
$DOCKER_TOKEN=$(az acr login --name <registry>--expose-token --output tsv --query accessToken>
$DOCKER_TOKEN | docker login <registry> --username 00000000-0000-0000-0000-000000000000 --password-stdin
dotnet publish (directly to remote registry)

I'm getting 401's when using dotnet but not when using docker, so any help resolving this issue or insights into how the credentials are being using within dotnet publish would be appreciated.