Connect Container Registry to AKS cluster

[Carus11]

Is your feature request related to a problem? Please describe.

When you deploy an ACR, The AKS cluster is not automatically authenticated to pull images from the ACR.

Describe the solution you'd like

Follow the guidance in the Azure Kubernetes terraform documentation to use a managed identity to authenticate the AKS cluster with the ACR. No other authentication steps outside of this infrastructure connection should be needed.

Describe alternatives you've considered

dockerconfig.json file, using admin credentials - these do not align with customer security policies.

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

This issue is stale because it has been open 30 days with no activity.

[frozentank]

I'm fairly sure I ran into this before. There's a couple of pitfalls with this.

To start, if you're concerned with customer security policies. The ACR deployed by this pipeline is public. So your cluster should have pull rights but not push rights by default.

If we want the cluster to have push rights we would have to add a role assignment to the machine identity associated with the node pools.

Something like this:

data "azurerm_kubernetes_cluster" "clusters" {
    count = length(var.clusters)
    name = var.clusters[count.index].cluster_name
    resource_group_name = var.clusters[count.index].cluster_rg_name
}

data "azurerm_user_assigned_identity" "machine_id" {
    count = length(data.azurerm_kubernetes_cluster.clusters)
    name = "${data.azurerm_kubernetes_cluster.clusters[count.index].name}-agentpool"
    resource_group_name = data.azurerm_kubernetes_cluster.clusters[count.index].node_resource_group
}

resource "azurerm_role_assignment" "acrpushrole" {
    count = length(data.azurerm_kubernetes_cluster.clusters)
    principal_id = data.azurerm_user_assigned_identity.machine_id[0].principal_id
    role_definition_name             = "AcrPush"
    scope                            = var.acr_id
    skip_service_principal_aad_check = true
} 

[github-actions]

This issue is stale because it has been open 30 days with no activity.