various fixes and updates

- updated msi pull controller to 0.1.7
- updated pull binding CRD for the additional workload identity fields
- updated podmonitor to use the az apigroup (we don't have core prometheus CRDs installed)
- updated VAP parameterNotFoundAction to `Allow` to mitigate a potential bug
- updated servicegroup name in pipeline.yaml for acrpull
- serialize image-puller MI federation setup (only one update at a time is supported)

Signed-off-by: Gerd Oberlechner <[email protected]>
Signed-off-by: Steve Kuznetsov <[email protected]>

dev-infrastructure/modules/aks-cluster-base.bicep

@@ -469,6 +469,10 @@ resource uami_fedcred 'Microsoft.ManagedIdentity/userAssignedIdentities/federate
   }
 ]
 
+//
+//  A C R   P U L L   C O N T R O L L E R
+//
+
 resource pullerIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
   location: location
   name: 'image-puller'
@@ -485,6 +489,7 @@ module acrPullerRoles 'acr/acr-permissions.bicep' = [
   }
 ]
 
+@batchSize(1)
 resource puller_fedcred 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = [
   for i in range(0, length(workloadIdentities)): {
     parent: pullerIdentity
@@ -499,6 +504,7 @@ resource puller_fedcred 'Microsoft.ManagedIdentity/userAssignedIdentities/federa
   }
 ]
 
+
 // grant aroDevopsMsi the aksClusterAdmin role on the aksCluster so it can
 // deploy services to the cluster
 resource aroDevopsMSIClusterAdmin 'Microsoft.Authorization/roleAssignments@2022-04-01' = {

frontend/deploy/helm/frontend/templates/acrpullbinding.yaml

@@ -5,8 +5,8 @@ metadata:
 spec:
   acr:
     environment: PublicCloud
-    scope: {{ .Values.pullBinding.registry }}
-    server: {{ .Values.pullBinding.scope }}
+    server: {{ .Values.pullBinding.registry }}
+    scope: {{ .Values.pullBinding.scope }}
   auth:
     workloadIdentity:
       serviceAccountRef: frontend