Configure continuous patching in Azure Container Registry

[IlKaizen]

Hi there,

I tried the new continuous patching feature, but I am facing issues. I have followed the instructions from this page https://learn.microsoft.com/en-us/azure/container-registry/how-to-continuous-patching but I keep getting this error message:

`2025/05/11 12:25:33 Alias support enabled for version >= 1.1.0, please see https://aka.ms/acr/tasks/task-aliases for more information.
2025/05/11 12:25:33 Creating Docker network: acb_default_network, driver: 'bridge'
2025/05/11 12:25:33 Successfully set up Docker network: acb_default_network
2025/05/11 12:25:33 Setting up Docker configuration...
2025/05/11 12:25:33 Successfully set up Docker configuration
2025/05/11 12:25:33 Logging in to registry: myregistrythgt.azurecr.io
2025/05/11 12:25:34 Successfully logged into myregistrythgt.azurecr.io
2025/05/11 12:25:34 Executing step ID: acb_step_0. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:34 Launching container with name: acb_step_0
Inside cssc-trigger-workflow task, getting list of images to be patched based on --filter-policy for Registry myregistrythgt.azurecr.io.
2025/05/11 12:25:34 Successfully executed container: acb_step_0
2025/05/11 12:25:34 Executing step ID: acb_step_1. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:34 Launching container with name: acb_step_1
2025/05/11 12:25:36 Successfully executed container: acb_step_1
2025/05/11 12:25:36 Executing step ID: acb_step_2. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:36 Launching container with name: acb_step_2
2025/05/11 12:25:36 Successfully executed container: acb_step_2
2025/05/11 12:25:36 Executing step ID: acb_step_3. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:36 Launching container with name: acb_step_3
Below images will be scanned and patched (if any os vulnerabilities found) based on --filter-policy.\nConfigured Tag Convention: floating
Listing repositories and tags matching the filter:
Repo,Tag
certbot,certbotv1
Matches found: 1
2025/05/11 12:25:37 Successfully executed container: acb_step_3
2025/05/11 12:25:37 Executing step ID: acb_step_4. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:37 Launching container with name: acb_step_4
2025/05/11 12:25:37 Successfully executed container: acb_step_4
2025/05/11 12:25:37 Executing step ID: acb_step_5. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:37 Launching container with name: acb_step_5
2025/05/11 12:25:38 Successfully executed container: acb_step_5
2025/05/11 12:25:38 Executing step ID: acb_step_6. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:38 Launching container with name: acb_step_6
2025/05/11 12:25:39 Successfully executed container: acb_step_6
2025/05/11 12:25:39 Executing step ID: acb_step_7. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/11 12:25:39 Launching container with name: acb_step_7
ERROR: No access was configured for the VM, hence no subscriptions were found. If this is expected, use '--allow-no-subscriptions' to have tenant level access.
2025/05/11 12:25:46 Container failed during run: acb_step_7. No retries remaining.
failed to run step ID: acb_step_7: exit status 1

Run ID: cbk failed after 15s. Error: failed during run, err: exit status 1

`

Am I missing something?

Thank you in advance,

[cegraybl]

Hello @IlKaizen, can you confirm the name of your registry? searched for 'myregistrythgt.azurecr.io' but did not find it or let me know if it was recently created. Will investigate from my end, please help us creating an issue with your registry details and I can follow up.

@Ruchii-27 looks like this could be a bug on the step that runs az login --identity on the Trigger task, since the task's identity does not have access to roles at subscription level shouldn't we see a similar error when testing? Let me know what you think.

[IlKaizen]

Hi @cegraybl Thank you for the prompt reply. I have deleted the ACR after doing the test. I have also tried with another ACR and the first time it worked. Then I run the command az acr supply-chain workflow update and here I am getting the same initial error:
2025/05/13 07:52:43 Executing step ID: acb_step_0. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:43 Launching container with name: acb_step_0
Inside cssc-trigger-workflow task, getting list of images to be patched based on --filter-policy for Registry testact-bcevgzh7h0hpb5d4.azurecr.io.
2025/05/13 07:52:43 Successfully executed container: acb_step_0
2025/05/13 07:52:43 Executing step ID: acb_step_1. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:43 Launching container with name: acb_step_1
2025/05/13 07:52:44 Successfully executed container: acb_step_1
2025/05/13 07:52:44 Executing step ID: acb_step_2. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:44 Launching container with name: acb_step_2
2025/05/13 07:52:45 Successfully executed container: acb_step_2
2025/05/13 07:52:45 Executing step ID: acb_step_3. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:45 Launching container with name: acb_step_3
Below images will be scanned and patched (if any os vulnerabilities found) based on --filter-policy.\nConfigured Tag Convention: floating
Listing repositories and tags matching the filter:
Repo,Tag
certbot,certbotu1
certbot,certbotv1
Matches found: 2
2025/05/13 07:52:45 Successfully executed container: acb_step_3
2025/05/13 07:52:45 Executing step ID: acb_step_4. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:45 Launching container with name: acb_step_4
2025/05/13 07:52:46 Successfully executed container: acb_step_4
2025/05/13 07:52:46 Executing step ID: acb_step_5. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:46 Launching container with name: acb_step_5
2025/05/13 07:52:47 Successfully executed container: acb_step_5
2025/05/13 07:52:47 Executing step ID: acb_step_6. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:47 Launching container with name: acb_step_6
2025/05/13 07:52:47 Successfully executed container: acb_step_6
2025/05/13 07:52:47 Executing step ID: acb_step_7. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/13 07:52:47 Launching container with name: acb_step_7
ERROR: No access was configured for the VM, hence no subscriptions were found. If this is expected, use '--allow-no-subscriptions' to have tenant level access.
2025/05/13 07:52:55 Container failed during run: acb_step_7. No retries remaining.
failed to run step ID: acb_step_7: exit status 1

Run ID: cb9 failed after 15s. Error: failed during run, err: exit status 1

[Ruchii-27]

Hi @IlKaizen, have you deleted the cssc workflow and/or deleted your registry testact.azurecr.io?
I was trying to check logs from our end and the only registry I see you have cssc worflow enabled is cosign.azurecr.io

[cegraybl]

@IlKaizen we have merged and released a new version of the extension (1.0.0b2) to handle your case.
You will need to:

1. delete your current workflow (all your patched images will remain): az acr supply-chain workflow delete ...
2. upgrade to the new extension version: az extension add -n acrcssc --upgrade
3. recreate the workflow and verify: az acr supply-chain workflow create ...

Please confirm if you can that this has worked for you or if you need additional assistance

[IlKaizen]

@cegraybl I have done the steps which you outlined and now the cssc-trigger-workflow has status Succeeded but i have this in the logs:
`2025/05/30 06:51:58 Alias support enabled for version >= 1.1.0, please see https://aka.ms/acr/tasks/task-aliases for more information.
2025/05/30 06:51:58 Creating Docker network: acb_default_network, driver: 'bridge'
2025/05/30 06:51:58 Successfully set up Docker network: acb_default_network
2025/05/30 06:51:58 Setting up Docker configuration...
2025/05/30 06:51:59 Successfully set up Docker configuration
2025/05/30 06:51:59 Logging in to registry: cosign.azurecr.io
2025/05/30 06:52:00 Successfully logged into cosign.azurecr.io
2025/05/30 06:52:00 Executing step ID: acb_step_0. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:00 Launching container with name: acb_step_0
Inside cssc-trigger-workflow task, getting list of images to be patched based on --filter-policy for Registry cosign.azurecr.io.
2025/05/30 06:52:00 Successfully executed container: acb_step_0
2025/05/30 06:52:00 Executing step ID: acb_step_1. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:00 Launching container with name: acb_step_1
2025/05/30 06:52:01 Successfully executed container: acb_step_1
2025/05/30 06:52:01 Executing step ID: acb_step_2. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:01 Launching container with name: acb_step_2
2025/05/30 06:52:02 Successfully executed container: acb_step_2
2025/05/30 06:52:02 Executing step ID: acb_step_3. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:02 Launching container with name: acb_step_3
Below images will be scanned and patched (if any os vulnerabilities found) based on --filter-policy.\nConfigured Tag Convention: floating
Listing repositories and tags matching the filter:
Repo,Tag
tomcat,10.1.28
Matches found: 1
2025/05/30 06:52:02 Successfully executed container: acb_step_3
2025/05/30 06:52:02 Executing step ID: acb_step_4. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:02 Launching container with name: acb_step_4
2025/05/30 06:52:03 Successfully executed container: acb_step_4
2025/05/30 06:52:03 Executing step ID: acb_step_5. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:03 Launching container with name: acb_step_5
2025/05/30 06:52:03 Successfully executed container: acb_step_5
2025/05/30 06:52:03 Executing step ID: acb_step_6. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:03 Launching container with name: acb_step_6
2025/05/30 06:52:04 Successfully executed container: acb_step_6
2025/05/30 06:52:04 Executing step ID: acb_step_7. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:04 Launching container with name: acb_step_7
[
{
"environmentName": "AzureCloud",
"id": "1XXXXXX-XXXX-XXXX-aXXXXXXXXXX",
"isDefault": true,
"name": "N/A(tenant level account)",
"state": "Enabled",
"tenantId": "1XXXXXX-XXXX-XXXX-aXXXXXXXXXX",
"user": {
"assignedIdentityInfo": "MSI",
"name": "systemAssignedIdentity",
"type": "servicePrincipal"
}
}
]
2025/05/30 06:52:13 Successfully executed container: acb_step_7
2025/05/30 06:52:13 Executing step ID: scan-and-schedule-patch. Timeout(sec): 1800, Working directory: '', Network: 'acb_default_network'
2025/05/30 06:52:13 Launching container with name: scan-and-schedule-patch
Tag Convention details: Configured Tag Convention: floating
Scheduling cssc-scan-image for cosign/tomcat, Tag:10.1.28, OriginalTag:10.1.28, PatchTag:10.1.28-patched
ERROR: (SubscriptionNotFound) The subscription '1XXXXXX-XXXX-XXXX-aXXXXXXXXXX' could not be found.
Code: SubscriptionNotFound
Message: The subscription '1XXXXXX-XXXX-XXXX-aXXXXXXXXXX' could not be found.
2025/05/30 06:52:15 Successfully executed container: scan-and-schedule-patch
2025/05/30 06:52:15 Step ID: acb_step_0 marked as successful (elapsed time in seconds: 0.560280)
2025/05/30 06:52:15 Step ID: acb_step_1 marked as successful (elapsed time in seconds: 0.858952)
2025/05/30 06:52:15 Step ID: acb_step_2 marked as successful (elapsed time in seconds: 0.533226)
2025/05/30 06:52:15 Step ID: acb_step_3 marked as successful (elapsed time in seconds: 0.578650)
2025/05/30 06:52:15 Step ID: acb_step_4 marked as successful (elapsed time in seconds: 0.788591)
2025/05/30 06:52:15 Step ID: acb_step_5 marked as successful (elapsed time in seconds: 0.540461)
2025/05/30 06:52:15 Step ID: acb_step_6 marked as successful (elapsed time in seconds: 0.580799)
2025/05/30 06:52:15 Step ID: acb_step_7 marked as successful (elapsed time in seconds: 8.814451)
2025/05/30 06:52:15 Step ID: scan-and-schedule-patch marked as successful (elapsed time in seconds: 2.323670)

Run ID: cb19 was successful after 18s`

Please note that i have masked my tenantid.
I have noticed however, that the tenantid is being used in the subscriptionid.
So the tenantid is being used as a subscriptionID, and this is causing the error SubscriptionNotFound.
If you need more info, please let me know.

[cegraybl]

@Ruchii-27 this is a new error, does it come from the ACR CLI? I don't see other references to subscription besides the az login

[Ruchii-27]

@cegraybl This error message is not from ACR CLI, seems to be during az acr task run

[cegraybl]

still checking, not sure where it got the tenant and subscription mixed up. looks like the error is happening when executing az acr task run to trigger the scan task.
I don't see direct references to subscription in our task, so could be a bug or similar inside the task command