Container Registry networkRuleSet defaults to Deny — Container Apps can't pull images on governed subscriptions

[vladpm]

Summary

When deploying to a governed subscription (Azure Policy that provisions Container Registries as Premium with a restrictive network rule set), the Container Apps cannot pull their images because the registry's networkRuleSet.defaultAction defaults to Deny and no allow-list is configured. Provisioning succeeds, but the web / worker / migrations Container App revisions fail to start.

Error (Container App system logs)

Failed to construct registry secret for registry 'crdpp<env>.azurecr.io' for ContainerApp 'dpp-<env>-web'.
Ensure the managed identity 'id-dpp-<env>-web' has the correct permissions.
Error: ACR token exchange endpoint returned error status: 403.
body: {"errors":[{"code":"DENIED","message":"client with IP '<runtime-ip>' is not allowed access.
Refer https://aka.ms/acr/firewall to grant access."}]}

Followed by:

Failed to provision revision for container app 'dpp-<env>-web'. Error details: Operation expired. (Code: ContainerAppOperationError)

The managed identity and AcrPull role are correct — the failure is the ACR firewall (defaultAction: Deny), not RBAC.

Root cause

In infra/modules/platform.bicep the avm/res/container-registry/registry module is configured with publicNetworkAccess: 'Enabled' but networkRuleSetDefaultAction is not set, so the AVM module default of Deny applies. With Premium SKU (required by the governed subscription's SKU policy) that produces:

"networkRuleSet": { "defaultAction": "Deny", "ipRules": [] }

publicNetworkAccess: Enabled alone is not sufficient — defaultAction: Deny with an empty allow-list still blocks the Container Apps runtime.

Workaround currently required after every azd provision:

az acr update --name <registry> --default-action Allow

Proposed fix

Set the default action explicitly in the registry module so it survives re-provisioning:

    publicNetworkAccess: 'Enabled'
    networkRuleSetDefaultAction: 'Allow'
    networkRuleSetIpRules: null

Steps to reproduce

1. Deploy into a subscription whose policy forces Premium ACR (requires the Premium + exportPolicyStatus: 'enabled' changes to get past provisioning — see related build/SKU issues).
2. azd up — infrastructure provisions successfully.
3. All three Container App revisions fail with ContainerAppOperationError: Operation expired; system logs show the ACR 403 ... not allowed access.

Environment

• Governed subscription, region UK South, Premium ACR
• Container Apps pulling via user-assigned managed identity

Impact

On any governed subscription that provisions ACR with a default-deny network rule set, the app never starts after provisioning. Requires a manual az acr update --default-action Allow today; the fix makes it durable in Bicep.

Related

Part of the same governed-subscription deployment path as #33 (unquoted buildArgs) and the ACR Premium-SKU / export-policy changes.