Loading source
Pulling the file list, source metadata, and syntax-aware rendering for this listing.
Source from repo
GitHub Copilot for Azure plugin providing Azure service management and development assistance inside Claude Code and IDEs.
Files
Skill
Size
Entrypoint
Format
Open file
Syntax-highlighted preview of this file as included in the skill package.
references/services/container-apps/cloudrun-deployment-guide.md
1# Deployment: Cloud Run to Container Apps2## Prerequisites4Azure CLI 2.53+, gcloud CLI, Docker, ACR, Key Vault, Log Analytics6## Phase 1: Image Migration8### Bash10```bash12set -euo pipefail13GCP_PROJECT="${GCP_PROJECT:-<project>}"14GCP_REGION="${GCP_REGION:-<region>}"15ACR_NAME="${ACR_NAME:-<acr>}"16gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev"18az acr login --name "$ACR_NAME"19for img in "app:v1" "worker:v1"; do20docker pull "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$img"21docker tag "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$img" "${ACR_NAME}.azurecr.io/$img"22docker push "${ACR_NAME}.azurecr.io/$img"23done24```25### PowerShell27```powershell29$GCP_PROJECT = if ($env:GCP_PROJECT) { $env:GCP_PROJECT } else { "<project>" }30$GCP_REGION = if ($env:GCP_REGION) { $env:GCP_REGION } else { "<region>" }31$ACR_NAME = if ($env:ACR_NAME) { $env:ACR_NAME } else { "<acr>" }32gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev"34az acr login --name $ACR_NAME35@("app:v1", "worker:v1") | ForEach-Object {36docker pull "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$_"37docker tag "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT}/<repo>/$_" "${ACR_NAME}.azurecr.io/$_"38docker push "${ACR_NAME}.azurecr.io/$_"39}40```41## Phase 2: Infrastructure43> Choose ONE path: basic (without VNet) OR VNet-integrated.45### Basic (no VNet)47#### Bash49```bash51set -euo pipefail52az group create --name "$RG" --location "$LOCATION"53az monitor log-analytics workspace create -g "$RG" -n "${RG}-logs" -l "$LOCATION"54LOG_ID=$(az monitor log-analytics workspace show -g "$RG" -n "${RG}-logs" --query customerId -o tsv)55LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primarySharedKey -o tsv)56az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \57--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"58```59#### PowerShell61```powershell63az group create --name $RG --location $LOCATION64az monitor log-analytics workspace create -g $RG -n "${RG}-logs" -l $LOCATION65$workspace = az monitor log-analytics workspace show -g $RG -n "${RG}-logs" | ConvertFrom-Json66$keys = az monitor log-analytics workspace get-shared-keys -g $RG -n "${RG}-logs" | ConvertFrom-Json67az containerapp env create -n "${RG}-env" -g $RG -l $LOCATION `68--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey69```70### VNet-Integrated72#### Bash74```bash76set -euo pipefail77az network vnet create -g "$RG" -n "${RG}-vnet" \78--address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/2379SUBNET_ID=$(az network vnet subnet show -g "$RG" --vnet-name "${RG}-vnet" -n aca-subnet --query id -o tsv)80az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \81--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \82--infrastructure-subnet-resource-id "$SUBNET_ID"83```84#### PowerShell86```powershell88az network vnet create -g $RG -n "${RG}-vnet" `89--address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/2390$subnet = az network vnet subnet show -g $RG --vnet-name "${RG}-vnet" -n aca-subnet | ConvertFrom-Json91az containerapp env create -n "${RG}-env" -g $RG -l $LOCATION `92--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `93--infrastructure-subnet-resource-id $subnet.id94```95## Phase 3: Secrets & Identity97### Bash99```bash101set -euo pipefail102az keyvault create --name "$KEY_VAULT" -g "$RG" -l "$LOCATION"103IDENTITY_ID=$(az identity create -n "${RG}-id" -g "$RG" -l "$LOCATION" --query id -o tsv)104PRINCIPAL_ID=$(az identity show --ids "$IDENTITY_ID" --query principalId -o tsv)105# Grant Key Vault access — use RBAC (recommended) or access policies107# Option A: RBAC (default for new vaults)108KV_ID=$(az keyvault show --name "$KEY_VAULT" --query id -o tsv)109az role assignment create --assignee "$PRINCIPAL_ID" \110--role "Key Vault Secrets User" --scope "$KV_ID"111# Option B: Access policies (if vault uses access-policy mode)112# az keyvault set-policy --name "$KEY_VAULT" --object-id "$PRINCIPAL_ID" --secret-permissions get list113# Migrate secrets without writing them to disk115az keyvault secret set --vault-name "$KEY_VAULT" --name <secret-name> \116--value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"117# ACR pull access119ACR_ID=$(az acr show --name "$ACR_NAME" --query id -o tsv)120az role assignment create --assignee "$PRINCIPAL_ID" --role AcrPull --scope "$ACR_ID"121```122### PowerShell124```powershell126az keyvault create --name $KEY_VAULT -g $RG -l $LOCATION127$identity = az identity create -n "${RG}-id" -g $RG -l $LOCATION | ConvertFrom-Json128$principalId = (az identity show --ids $identity.id | ConvertFrom-Json).principalId129# Grant Key Vault access — RBAC (recommended)131$kvId = (az keyvault show --name $KEY_VAULT | ConvertFrom-Json).id132az role assignment create --assignee $principalId `133--role "Key Vault Secrets User" --scope $kvId134# Migrate secrets without writing them to disk136$secretValue = gcloud secrets versions access latest --secret=<secret-id> --project=$GCP_PROJECT137az keyvault secret set --vault-name $KEY_VAULT --name <secret-name> --value $secretValue138Remove-Variable secretValue139# ACR pull access141$acrId = (az acr show --name $ACR_NAME | ConvertFrom-Json).id142az role assignment create --assignee $principalId --role AcrPull --scope $acrId143```144## Phase 4: Deploy Container App146### Bash148```bash150set -euo pipefail151SECRET_URI=$(az keyvault secret show --vault-name "$KEY_VAULT" --name db-pw --query id -o tsv)152az containerapp create \153--name <app-name> -g "$RG" --environment "${RG}-env" \154--image "${ACR_NAME}.azurecr.io/app:v1" --target-port 8080 --ingress external \155--cpu 1.0 --memory 1Gi --min-replicas 0 --max-replicas 10 \156--user-assigned "$IDENTITY_ID" --registry-identity "$IDENTITY_ID" \157--registry-server "${ACR_NAME}.azurecr.io" \158--secrets db-pw=keyvaultref:"${SECRET_URI}",identityref:"${IDENTITY_ID}" \159--env-vars ENV=prod DB_PASSWORD=secretref:db-pw \160--scale-rule-name http --scale-rule-type http --scale-rule-http-concurrency 80161```162### PowerShell164```powershell166$secret = az keyvault secret show --vault-name $KEY_VAULT --name db-pw | ConvertFrom-Json167az containerapp create `168--name <app-name> -g $RG --environment "${RG}-env" `169--image "${ACR_NAME}.azurecr.io/app:v1" --target-port 8080 --ingress external `170--cpu 1.0 --memory 1Gi --min-replicas 0 --max-replicas 10 `171--user-assigned $identity.id --registry-identity $identity.id `172--registry-server "${ACR_NAME}.azurecr.io" `173--secrets "db-pw=keyvaultref:$($secret.id),identityref:$($identity.id)" `174--env-vars "ENV=prod" "DB_PASSWORD=secretref:db-pw" `175--scale-rule-name http --scale-rule-type http --scale-rule-http-concurrency 80176```177### Configuration Mapping179| Cloud Run | Container Apps |181|-----------|----------------|182| `--min-instances 0` | `--min-replicas 0` |183| `--max-instances 10` | `--max-replicas 10` |184| `--concurrency 80` | `--scale-rule-http-concurrency 80` |185| `--cpu 1` | `--cpu 1.0` |186| `--memory 512Mi` | `--memory 1Gi` |187## Phase 5: Validation189### Bash191```bash193FQDN=$(az containerapp show --name <app-name> -g "$RG" --query properties.configuration.ingress.fqdn -o tsv)194curl -I "https://$FQDN/health"195az containerapp logs show --name <app-name> -g "$RG" --tail 100196```197### PowerShell199```powershell201$app = az containerapp show --name <app-name> -g $RG | ConvertFrom-Json202Invoke-WebRequest -Uri "https://$($app.properties.configuration.ingress.fqdn)/health"203az containerapp logs show --name <app-name> -g $RG --tail 100204```205## Troubleshooting207| Issue | Solution |209|-------|----------|210| Image pull fails | Verify ACR role: `az role assignment list --assignee $PRINCIPAL_ID --scope $ACR_ID -o table` |211| App won't start | Check logs: `az containerapp logs show --name <app> -g $RG --tail 100` |212| Secret not accessible | Verify RBAC: `az role assignment list --assignee $PRINCIPAL_ID --scope $KV_ID -o table` |213| Scaling not working | Check config: `az containerapp show --name <app> --query properties.template.scale` |214