[containerapp] "az containerapp job create" does not recognize *.azurecr.us registry domain as one that can use identity instead of username:password for auth

[azclibot]

Source: Azure/azure-cli#32194 (by @bitdeft)
Affected extension: containerapp (src/containerapp/)

---

<<UNTRUSTED:issue-32194>>

Issue #32194 (by @bitdeft)

Title

"az containerapp job create" does not recognize *.azurecr.us registry domain as one that can use identity instead of username:password for auth

Body

Describe the bug

When invoking the command, if you supply an ACR domain with *azurecr.us, which is used in usgov / GCCH tenants for Azure Container Registry, it requires --registry-username and --registry-password instead of allowing the use of --registry-identitiy for auth with an MSI.

Related command

az containerapp job create

Errors

Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry

Issue script & Debug output

It doesn't pass validation, likely the domain for the usgov regions azurecr.us needs to be added.

'''
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 654, in execute
self._validation(expanded_arg)
File "/usr/lib64/az/lib/python3.12/site-packages/knack/invocation.py", line 113, in _validation
self._validate_arg_level(parsed_ns)
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 925, in _validate_arg_level
validator(**self._build_kwargs(validator, ns))
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/containerapp/_validators.py", line 110, in validate_registry_server
raise ValidationError("Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry")
azure.cli.core.azclierror.ValidationError: Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry
'''

Expected behavior

This is targeting an azure container registry, not a docker one. It should accept managed identity for auth.

Environment Summary

From Azure Cloud Shell:

'''
azure-cli 2.76.0 *

core 2.76.0 *
telemetry 1.1.0

Extensions:
ml 2.38.0
ssh 2.0.6

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Python location '/usr/bin/python3.12'
Config directory '/home/bryce/.azure'
Extensions directory '/home/bryce/.azure/cliextensions'
Extensions system directory '/usr/lib/python3.12/site-packages/azure-cli-extensions'
'''

Additional context

I am fairly certain that using an identity for pulling the image is supported in these tenants, but if I am wrong, and that is not the case then this is expected behavior. Thanks!

Comments

Comment by @azure-client-tools-bot-prd[bot]

Hi @bitdeft,

2.76.0 is not the latest Azure CLI(2.77.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

Comment by @yonzhan

Thank you for opening this issue, we will look into it.

Comment by @microsoft-github-policy-service[bot]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @howang-ms, @Greedygre.

Comment by @Greedygre

Thanks for reporting this issue. We will have a look and fix it.
<<END:issue-32194>>

[yonzhan]

Thank you for opening this issue, we will look into it.

[azclibot]

Context for Copilot

This issue was triaged from Azure/azure-cli#32194.

Bug summary: az containerapp job create fails when using an azurecr.us registry domain (used in US Government/GCCH tenants) with --registry-identity. The validator in _validators.py only recognizes azurecr.io as a valid Azure Container Registry domain, so azurecr.us domains are incorrectly rejected, requiring --registry-username and --registry-password instead of allowing managed identity auth.

Failing command:

az containerapp job create

Error:

Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry

Root cause: In src/containerapp/azext_containerapp/_validators.py, the validate_registry_server function (around line 110) checks whether the registry server is an Azure Container Registry by matching against azurecr.io only. It needs to also match azurecr.us (and potentially azurecr.cn for Azure China).

Expected fix: Update the domain check to recognize all Azure Container Registry sovereign cloud domains (azurecr.io, azurecr.us, azurecr.cn) as valid ACR endpoints that support managed identity authentication.

CLI version: 2.76.0
Environment: Azure Cloud Shell (US Government tenant)

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Title

• Start with [Container Apps] — square brackets [] for a customer-facing change (added to HISTORY.rst), curly {} if not. A bug fix is customer-facing, so use [].
• Then Fix #10016: to link the issue.
• Then optionally the affected command az <command>:.
• Then a present-tense, capitalized verb (Fix for bug fixes; Add/Change/Deprecate/Remove otherwise) and a concise summary.
• Recommended title: [Container Apps] Fix #10016: az <command>: Fix <concise description of the fix>

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #10016.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add [Container Apps] az <command>: <note> lines for extra notes.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).