Background
When we start working with Docker and Kubernetes, we need a container registry to publish out images. Most people start with the public DockerHub registry. This is good for getting started. however, as we become more proficient with container images and orchestration using something like Kubernetes, we need enterprise grade features. The public container registries do not provide all the enterprise grade features. In such scenario, we need to choose private container registry. In this post we will see how to integrate private Azure Container Registry (ACR) with Azure Kubernetes Service (AKS) cluster.
Advantages of using a private container registry with ACR
Similar to other private container registries, ACR provides following features:
- Support for Docker and Open Container initiative (OCI) images
- Simplify container lifecycle management
- Build
- Store
- Secure
- Scan
- Replicate
- Connect across environments
- Azure Kubernetes Service (AKS)
- Azure Redhat OpenShift
- Azure Services (App Service ,Machine Learning, Azure Batch)
Integrate ACR with AKS using Admin User
In this YouTube video, I demonstrate how to integrate with ACR using 5 easy steps.
The 5 steps demonstrated in the video are as follows
We use Admin user to push images to ACR registry using Docker login. The images are then pulled to AKS cluster using the Managed Identity associated with the AKS cluster. The Managed Identity is granted ACR Pull role when we create the AKS cluster using the --attach-acr flag with az aks create command.
Integrate ACR with AKS using AAD identity
After I published the video on YouTube, Sergio Rodrigo shared a blog about Build & Pull Docker images to ACR. I replied to his tweet on Twitter suggesting that the readers of his blog could benefit from the video version of my post. This Tweet caught the eye of Steve Lasker who is the PM on ACR team in Microsoft. Steve suggested that instead of using Admin User to connect to the ACR registry to push images, there is a better way. By default, the Admin User access is disable when we create a new ACR registry.
We can make use of our own identity linked to an Azure Active Directory (AAD) to authenticate with ACR. When we login to ACR using the AAD identity, a token is generated and our local docker config file is updated with the token. We can push the images using this token. This eliminates the need for enabling the Admin User for ACR.
Based on this suggestion I created an updated video.
Conclusion
Private container registries are helpful in preserving the intellectual property of an organization. We need not have to publish the IP of organization to publicly available container registry. It also helps in improving the security posture by providing role based access control (RBAC). We can separate activities like who can push images to the registry and who can pull them.
I hope these two videos were helpful in improving the readers understanding about integrating ACR with AKS.
Until next time, Code with Passion and Strive for Excellence.
