When deploying the container app, the current revision sits in an activating status and unable to pull the image.

Question

What are we trying to do?

We are attempting to deploy a container to a container app from our Azure Container Registry.

What is the problem? When deploying the container app using the setup seen here, the current revision sits in an activating status and after a few minutes, it fails stating that it can't pull the image. Steps we have taken to troubleshoot: Deployed the Microsoft Container App Startup container and used its console to verify that DNS resolution was working and pointed to the right IP Addresses. Used both the standard portal, the preview portal, and the Azure CLI to deploy revisions with the same results across all. This had no effect. Changed from using a managed identity for the container app image information to using admin credentials. This had no effect.

Answer 1

Hello Fabián Avilés,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Problem

Sequel to your questions, I understand that you are having challenges that involves the failure to deploy a container app from an Azure Container Registry, resulting in the container app remaining in an "activating" status before ultimately failing due to an inability to pull the image. Despite multiple troubleshooting attempts, including verification of DNS resolution and authentication method changes, the issue persists across different deployment interfaces.

Scenario

John, an Azure DevOps engineer, is tasked with deploying a containerized application to Azure Kubernetes Service (AKS) from an Azure Container Registry (ACR). The application is critical for a customer-facing service and needs to be deployed promptly to meet service level agreements.

John begins the deployment process using the standard portal interface but encounters an issue where the deployment gets stuck in an "activating" status for several minutes before ultimately failing due to the inability to pull the image from the ACR. Concerned about the impact on the service, John decides to troubleshoot the issue.

Hope I captured your unique scenario?

Solution

You might have tried couple of troubleshooting methods, and it seems everything is Okay. This prescribed solution was based on the scenario given and your questions, while focusing on the problem statement.

First thing:

Ensure that the necessary permissions and access policies are correctly configured for both the Azure Container Registry (ACR) and the container app. Verify that the service principal or user account used for deployment has the appropriate roles (e.g., Contributor, AcrPush, AcrPull) assigned in ACR1.

# Example Azure CLI command to grant pull permissions to a service principal
az acr login --name <ACR_NAME>
az acr show --name <ACR_NAME> --query "id"
az role assignment create --assignee <SERVICE_PRINCIPAL_ID> --scope <ACR_ID> --role acrpull

Secondly:

Double-check the authentication method being used by the container app to pull images from the ACR. If you're using admin credentials, ensure they are correct and not expired. If using a service principal or managed identity, confirm that it's correctly configured and has the necessary permissions.

Thirdly:

Verify the network configuration for both the Azure Container Registry and the container app. Ensure there are no network restrictions or firewalls blocking traffic between them. Check if there are any NSG rules or network policies that might be interfering with the image pull process.

Then,

Check that the image tags in the Azure Container Registry match the tags specified in the deployment configuration for the container app. Ensure consistency between the image tag used during the build process and the one referenced in the deployment YAML or manifest file.

Finally

If the above could not solve the issue, could you please, answer the following questions:

• What specific error messages are being encountered during the deployment process?
• Have all necessary permissions and access policies been configured correctly for the Azure Container Registry and the container app?

Check error message, by examine Logs and Diagnostics. Check for both the ACR and the container app. Look for any relevant error messages, failed requests, or authentication issues.

Use commands like az acr check-health and az aks check-acr to diagnose network connectivity or configuration problemsand let us read from you.

References

Source: Azure Documentation-Troubleshooting in Azure Container Apps. Accessed, 15/5/2024.

Source: Microsoft Bing. Accessed, 15/5/2024.

Source: Registry roles and permissions - Azure Container Registry. Accessed, 15/5/2024.

Source: Troubleshoot network issues with registry - Azure Container Registry. Accessed, 15/5/2024.

Source: Image tag best practices - Azure Container Registry. Accessed, 15/5/2024.

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam