fix: acr task mi network permissions (#102)

Author: jaredfholgate

modules/azure/container_registry.tf

@@ -9,6 +9,17 @@ resource "azurerm_container_registry" "alz" {
   network_rule_bypass_option    = var.use_private_networking ? "AzureServices" : "None"
 }
 
+resource "azapi_update_resource" "network_rule_bypass_allowed_for_tasks" {
+  count       = var.use_self_hosted_agents && var.use_private_networking ? 1 : 0
+  type        = "Microsoft.ContainerRegistry/registries@2025-05-01-preview"
+  resource_id = azurerm_container_registry.alz[0].id
+  body = {
+    properties = {
+      networkRuleBypassAllowedForTasks = true
+    }
+  }
+}
+
 resource "azurerm_container_registry_task" "alz" {
   count                 = var.use_self_hosted_agents ? 1 : 0
   name                  = "image-build-task"
@@ -39,7 +50,10 @@ resource "azurerm_container_registry_task_schedule_run_now" "alz" {
   lifecycle {
     replace_triggered_by = [azurerm_container_registry_task.alz]
   }
-  depends_on = [azurerm_role_assignment.container_registry_push_for_task]
+  depends_on = [
+    azurerm_role_assignment.container_registry_push_for_task,
+    azapi_update_resource.network_rule_bypass_allowed_for_tasks
+  ]
 }
 
 resource "azurerm_role_assignment" "container_registry_pull_for_container_instance" {