fix: Add ACR public access management functions to build scripts#283
Open
Shubhangi-Microsoft wants to merge 6 commits into
Open
fix: Add ACR public access management functions to build scripts#283Shubhangi-Microsoft wants to merge 6 commits into
Shubhangi-Microsoft wants to merge 6 commits into
Conversation
fix: Add ACR public access management functions to build scripts
Shubhangi-Microsoft
requested review from
Avijit-Microsoft,
Prajwal1-Microsoft,
Roopan-Microsoft,
VinaySh-Microsoft,
gpickett,
malrose07 and
toherman-msft
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds “open ACR temporarily, then restore” behavior to the image build/push scripts so az acr build and subsequent deployments can succeed even when ACR public access/network rules are restrictive, while ensuring the original ACR configuration is restored on completion or failure.
Changes:
- Added ACR public network access enable/restore helpers to the Bash and PowerShell build/push scripts.
- Wrapped build/deploy flow with guaranteed cleanup (
try/finallyin PowerShell,trapin Bash). - Recorded original ACR
publicNetworkAccessandnetworkRuleSet.defaultActionto restore after the run.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| infra/scripts/build_push_images.sh | Adds Bash functions + trap-based cleanup to temporarily enable ACR public access and restore prior settings. |
| infra/scripts/build_push_images.ps1 | Adds PowerShell functions + try/finally cleanup to temporarily enable ACR public access and restore prior settings. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+202
to
+204
| $script:OriginalAcrPublicAccess = (az acr show --name $Name --query "publicNetworkAccess" -o tsv 2>$null).Trim() | ||
| $script:OriginalAcrDefaultAction = (az acr show --name $Name --query "networkRuleSet.defaultAction" -o tsv 2>$null).Trim() | ||
| Write-Host " Current: publicNetworkAccess=$($script:OriginalAcrPublicAccess) defaultAction=$($script:OriginalAcrDefaultAction)" -ForegroundColor DarkGray |
Comment on lines
+204
to
+206
| ORIGINAL_ACR_PUBLIC_ACCESS="$(az acr show --name "$name" --query "publicNetworkAccess" -o tsv 2>/dev/null || true)" | ||
| ORIGINAL_ACR_DEFAULT_ACTION="$(az acr show --name "$name" --query "networkRuleSet.defaultAction" -o tsv 2>/dev/null || true)" | ||
| echo " Current: publicNetworkAccess=${ORIGINAL_ACR_PUBLIC_ACCESS} defaultAction=${ORIGINAL_ACR_DEFAULT_ACTION}" |
Comment on lines
+302
to
+305
| trap cleanup_on_exit EXIT INT TERM | ||
|
|
||
| enable_acr_public_access "$ACR_NAME" | ||
|
|
fix: update dns zone index for acr and improve error handling in build image scripts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request adds robust handling for Azure Container Registry (ACR) public network access in both the PowerShell (
build_push_images.ps1) and Bash (build_push_images.sh) image build/deploy scripts. The scripts now ensure that ACR public access is enabled before building and pushing images, and then restore the original ACR network settings afterward, even if an error occurs. This helps prevent accidental exposure or misconfiguration of ACR network rules during CI/CD operations.Key changes:
ACR Public Access Management:
Enable-AcrPublicAccessandRestore-AcrAccessfunctions tobuild_push_images.ps1to manage ACR public network access and network rule settings before and after the script runs. The script records the original state and restores it at the end.enable_acr_public_access,restore_acr_access, andcleanup_on_exitfunctions tobuild_push_images.shto provide equivalent functionality in Bash, including trapping script exit to ensure restoration. [1] [2]Script Execution Flow:
try/finallyin PowerShell, and atrapin Bash). This ensures cleanup even if the script fails or is interrupted. [1] [2] [3]## PurposeDoes this introduce a breaking change?
How to Test
What to Check
Verify that the following are valid
Other Information