Azure DevOps Pipeline - 推送到 Azure 容器注册表 - 权限错误

Question

• 我创建了一个 Azure 容器注册表。
• 我有一个 Azure DevOps 项目。
• 我已经使用向导创建了一个 Azure DevOps Pipeline，因此 它使用标准模板来构建和推送 Docker 镜像。

验证管道时抛出以下错误:

Failed to set Azure permission 'RoleAssignmentId: ****' for the service principal '****' on subscription ID '****': error code: Forbidden, inner error code: AuthorizationFailed, inner error message The client '****' with object id '****' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/****/resourceGroups/****/providers/Microsoft.ContainerRegistry/registries/****/providers/Microsoft.Authorization/roleAssignments/****' or the scope is invalid. If access was recently granted, please refresh your credentials. Ensure that the user has 'Owner' or 'User Access Administrator' permissions on the Subscription.

我可能缺少什么配置？这方面的文档非常稀疏，而且写得好像它应该都能正常工作一样。

谢谢

Answer 1

您需要向此处使用的服务主体添加 AcrPull 权限。请找到您的 ACR 并添加它。

这里有您的服务主体的 ID:

Failed to set Azure permission 'RoleAssignmentId: ' for the service principal ''

另外，请检查 ACR 上的网络是否阻止您。