Container registry - ParentResourceNotFound

[NickAusloos]

Bicep version
In my Azure DevOps pipeline, I'm trying to build and deploy Azure resources via Bicep. These tasks are runned in ubuntu-latest vm.

Describe the bug
The container registry, which I try to setup in a shared resource group, cannot be found by app services. It returns the below error.
Multiple options are tried, such as described at Microsoft with the existing keyword.

ERROR: {"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"Conflict","message":"{\r\n  \"status\": \"Failed\",\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n    \"details\": [\r\n      {\r\n        \"code\": \"DeploymentFailed\",\r\n        \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.\",\r\n        \"details\": [\r\n          {\r\n            \"code\": \"NotFound\",\r\n            \"message\": \"{\\r\\n  \\\"error\\\": {\\r\\n    \\\"code\\\": \\\"ParentResourceNotFound\\\",\\r\\n    \\\"message\\\": \\\"**Can not perform requested operation on nested resource. Parent resource 'crtdevops' not found.**\\\"\\r\\n  }\\r\\n}\"\r\n          }\r\n        ]\r\n      }\r\n    ]\r\n  }\r\n}"}]}}

To Reproduce
The resources of the shared resource group are deployed, but it fails with the app services.

Azure DevOps pipeline

pool:
  vmImage: ubuntu-latest

variables:
  artifactName: CompiledBicepTemplate
  env: 'tst'

stages:
- stage: Build
  jobs:
  - job: Build
    steps:
    - task: AzureCLI@2  
      displayName: 'Build bicep artifact' 
      inputs: 
        azureSubscription: 'Azure Dev subscription'
        scriptType: 'pscore'
        scriptLocation: 'inlineScript'
        inlineScript: 'az bicep build --file main.bicep'

    - publish: '$(Build.SourcesDirectory)/main.json'
      displayName: 'Publish artifact in pipeline'
      artifact: $(artifactName)

- stage: Deploy
  jobs:
  - deployment: BicepToAzure
    displayName: 'Deploy bicep to Azure'
    environment: 'AzureDeployment'
    strategy:
      runOnce:
        deploy:
          steps:
          - checkout: self

          - download: current
            displayName: 'Download bicep build artifact'
            artifact: $(artifactName)
            
          - task: AzureCLI@2
            displayName: 'Deploy bicep template'
            inputs:
              azureSubscription: 'Azure Dev subscription'
              scriptType: 'pscore'
              scriptLocation: 'inlineScript'
              inlineScript: |
                az deployment create `
                  --location westeurope `
                  --template-file $(Pipeline.Workspace)/$(artifactName)/main.json `
                  --parameters $(Build.SourcesDirectory)/main.parameters.$(env).json

main.bicep

targetScope = 'subscription'

@allowed([
  'p'
  't'
  'd'
])
param env string
param projectName string
param resourceLocation string
@allowed([
  'F1'
  'D1'
  'B1'
  'B2'
  'B3'
  'S1'
  'S2'
  'S3'
  'P1v2'
  'P2v2'
  'P3v2'
  'P1v3'
  'P2v3'
  'P3v3'
])
param appServicePlanSku string
@allowed([
  'Basic'
  'Standard'
  'Premium'
])
param crSku string
param subscriptionName string

resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: 'rg-${env}-we-${projectName}'
  location: resourceLocation
  //dependsOn: [rgShared]
}

resource rgShared 'Microsoft.Resources/resourceGroups@2021-04-01' = if (env != 'd') {
  name: 'rg-x-we-${subscriptionName}'
  location: resourceLocation
}

module appServiceShared 'shared.bicep' = if (env != 'd') {
  name:'appShared'
  scope: rgShared
  params: {
    subscription: subscriptionName
    env: env
    appServicePlanSku: appServicePlanSku
    crSku: crSku
  }
}

module appService 'app.bicep' = {
  name: 'app${projectName}'
  scope: rg
  params: {
    applicationName: projectName
    env: env
    containerRegistryName: appServiceShared.outputs.containerRegistryName
  }
}

shared.bicep

param subscription string
@allowed([
  'p'
  't'
  'd'
])
param env string
@allowed([
  'F1'
  'D1'
  'B1'
  'B2'
  'B3'
  'S1'
  'S2'
  'S3'
  'P1v2'
  'P2v2'
  'P3v2'
  'P1v3'
  'P2v3'
  'P3v3'
])
param appServicePlanSku string
@allowed([
  'Basic'
  'Standard'
  'Premium'
])
param crSku string

param linuxPlan string = 'linux'
param windowsPlan string = 'windows'

param location string = resourceGroup().location

resource appServicePlanSharedWindows 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'plan-${subscription}-${env}-${windowsPlan}'
  location: location
  sku: {
    name: appServicePlanSku
  }
}

resource appServicePlanSharedLinux 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'plan-${subscription}-${env}-${linuxPlan}'
  location: location
  sku: {
    name: appServicePlanSku
  }
  kind: linuxPlan
  properties: {
    reserved: true
  }
}

resource acrResource 'Microsoft.ContainerRegistry/registries@2021-09-01' = {
  name: 'cr${env}${subscription}'
  location: location
  sku: {
    name: crSku
  }
  properties: {
    adminUserEnabled: true        // TO DO - replace by identity
  }
}

output containerRegistryName string = acrResource.name

app.bicep

@allowed([
  'p'
  't'
  'd'
])
param env string
param applicationName string
//param appServicePlanSharedId string
param containerRegistryName string
param location string = resourceGroup().location

resource sharedPlan 'Microsoft.Web/serverfarms@2022-03-01' existing = {
  name: 'plan-devops-t-linux'
  scope: resourceGroup('rg-x-we-devops')
}

/* resource acrResource 'Microsoft.ContainerRegistry/registries@2021-09-01' existing = {
  name: 'crtdevops'
  scope: resourceGroup('rg-x-we-devops')
} */

resource appServiceApi 'Microsoft.Web/sites@2022-03-01' = {
  name: 'ase-${applicationName}-api-dotnet-${env}'
  location: location
  properties: {
    serverFarmId: sharedPlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'DOCKER|${containerRegistryName}.azurecr.io/${applicationName}service:latest'
      appSettings: [
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: 'https://mcr.microsoft.com'
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_USERNAME'
          value: containerRegistryName
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_PASSWORD'
          value: listCredentials(resourceId('Microsoft.ContainerRegistry/registries', containerRegistryName), '2021-06-01-preview').passwords[0].value //acrResource.listCredentials().passwords[0].value
        }
        {
          name: 'WEBSITES_PORT'
          value: '7122'
        }
      ]
    }
  }
}

resource appServiceAngular 'Microsoft.Web/sites@2022-03-01' = {
  name: 'ase-${applicationName}-frontend-angular-${env}'
  location: location
  properties: {
    serverFarmId: sharedPlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'DOCKER|${containerRegistryName}.azurecr.io/${applicationName}:latest'
      appSettings: [
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: 'https://mcr.microsoft.com'
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_USERNAME'
          value: containerRegistryName
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_PASSWORD'
          value: listCredentials(resourceId('Microsoft.ContainerRegistry/registries', containerRegistryName), '2021-06-01-preview').passwords[0].value //acrResource.listCredentials().passwords[0].value
        }
      ]
    }
  }
}

main.parameters.json

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "env": {
            "value": "t"
        },        
        "projectName": {
            "value": "myaccount"
        },        
        "resourceLocation": {
            "value": "westeurope"
        },
        "appServicePlanSku": {
            "value": "B1"
        },
        "subscriptionName": {
            "value": "devops"
        },
        "crSku": {
            "value": "Basic"
        }
    }
}

Additional context
Build artifact (ARM template)
main.txt

[alex-frankel]

Moving this to discussion - I think this will have the same resolution as #9579

[NickAusloos]

Hello Alex,

I've tried to set the dependsOn in my resource group for app services to the shared resource group

module appServiceShared 'shared.bicep' = if (env != 'd') {
  name:'appShared'
  scope: rgShared
  params: {
    subscription: subscriptionName
    env: env
    appServicePlanSku: appServicePlanSku
    crSku: crSku
  }
}

module appService 'app.bicep' = {
  name: 'app${projectName}'
  scope: rg
  params: {
    applicationName: projectName
    env: env
    //appServicePlanSharedId: appServiceShared.outputs.appServicePlanSharedLinuxId
    //appServicePlanSharedName: appServiceShared.outputs.appServicePlanSharedLinuxName
    containerRegistryName: appServiceShared.outputs.containerRegistryName
  }
  dependsOn: [ appServiceShared ]
}

and in the app service to the existing container registry

resource acrResource 'Microsoft.ContainerRegistry/registries@2021-09-01' existing = {
  name: 'crtdevops'
  scope: resourceGroup('rg-x-we-devops')
}

resource appServiceApi 'Microsoft.Web/sites@2022-03-01' = {
  name: 'ase-${applicationName}-api-dotnet-${env}'
  location: location
  properties: {
    serverFarmId: sharedPlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'DOCKER|${containerRegistryName}.azurecr.io/${applicationName}service:latest'
      appSettings: [
        {
          name: 'DOCKER_REGISTRY_SERVER_URL'
          value: 'https://mcr.microsoft.com'
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_USERNAME'
          value: containerRegistryName
        } 
        {
          name: 'DOCKER_REGISTRY_SERVER_PASSWORD'
          value: listCredentials(resourceId('Microsoft.ContainerRegistry/registries', containerRegistryName), '2021-06-01-preview').passwords[0].value //acrResource.listCredentials().passwords[0].value
        }
        {
          name: 'WEBSITES_PORT'
          value: '7122'
        }
      ]
    }
  }
  dependsOn: [ acrResource ]
}

but still the same error results in the DevOps pipeline

[anthony-c-martin]

The dependsOn in your main.bicep file now looks to be set up correctly - I'm confident that this will ensure the registry is created before the attempt to listCredentials

I noticed that the acrResource scope is different to the scope of the template, meaning that the resourceId function you use is going to provide the incorrect value.

Instead of:

value: listCredentials(resourceId('Microsoft.ContainerRegistry/registries', containerRegistryName), '2021-06-01-preview').passwords[0].value

Could you try:

value: acrResource.listCredentials().passwords[0].value

This will make sure the resourceId generated has the correct scope.

I'd also suggest passing in the name of the RG, just to make sure it's correct:

param acrRgName string

resource acrResource 'Microsoft.ContainerRegistry/registries@2021-09-01' existing = {
  name: 'crtdevops'
  scope: resourceGroup(acrRgName)
}

And in the calling file (omitted some irrelevant stuff):

module appService 'app.bicep' = {
  name: 'app${projectName}'
  scope: rg
  params: {
    ...
    acrRgName:  rgShared.name
  }
  dependsOn: [ appServiceShared ]
}

[anthony-c-martin]

I'm also going to create a follow-up task to improve this error message - it should be more explicit about the fact that executing an action is failing, and referring to the resource as the "parent resource" makes this more confusing. It would also be helpful if we printed the full resourceId in the message rather than just the name.

[NickAusloos]

@anthony-c-martin Your recommendations as brought the solution.
Thx!