Updates regarding to Image automation for azure ACR

[mazen423]

I would like to open a discussion to know the status of Image update automation for Azure ACR and the requirements to achieve it

[phillebaba]

I think that @stealthybox has started looking at it. The biggest issue with ACR right now is that the solution used in GKE and EKS will probably not work for aad-pod-identity.

[stealthybox]

Yep, looking actively into this -- thanks for the ping

[wiebeck]

I actually got it working! I tried to follow this "official" documentation but stumbled upon a few issues (and some more afterwards) which I needed to resolve. I wrote down my final findings here.

[bondido]

Hi,
Is there currently any way of Image automation taking advantage of AKS - ACR integration?
If we have AKS kubernetes with it's cluster wide service principal "automatically" authenticating in ACR with required privileges (acrPull), does Flux can use it in any way?
Documentation (https://fluxcd.io/docs/use-cases/azure/#image-updates-with-azure-container-registry) is not really clear about it as for me it says we can use it, but we were not able to have it working and it seems as Flux v2 ImageRepository needs to have secret reference with ACR credentials anyway.

Couldn't it "just work" as it worked in Flux v1 (by setting registry.acr.enabled Helm parameter) - without all this additional configuration/credentials-sync overhead ?

[wiebeck]

What you need according to the docs is:

• aad-pod-identity running inside your cluster - follow the instructions on their site
• AcrPull role assignment for some managed identity to your ACR - you will need the clientID and full resource ID of this identity
• follow the instructions, fill in name of ACR and the IDs of your managed identity

This should be enough for the controllers to be able to scan your registry and set up some policies afterwards.

What we did to simplify this a bit:

• set up the AKS cluster with system defined managed Kubelet identity (user defined is okay, too) - the Kubelet needs this role assignment anyway to download container images from the ACR
• provision the AcrPull role assignment via Terraform
• use the very same Kubelet identity to configure image update automation (we automated this also via Terraform)

... so we didn't set up another identity for the image update automation but use the Kubelet identity instead. One less managed identity to provision.