Share via

How to configure ACR with only Private network & Private SSL Certificate.

Atul Vishwakarma 40 Reputation points
2023-12-31T11:20:45.8766667+00:00

CONTEXT:

I want to configure my ACR with Private network & expose with Private Endpoints using Private DNS zone so that all my VMs (In Same VNet) & AKS can access this registry using Private Endpoint.

ISSUE:

I've disabled Public Access but still it has Public Endpoints e.g.:

***.azurecr.io

***.uaenorth.data.azurecr.io

Azure Container Registry
Azure Container Registry
An Azure service that provides a registry of Docker and Open Container Initiative images.
511 questions
Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,472 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,777 questions
Accepted answer
  1. Pinaki Ghatak 5,600 Reputation points Microsoft Employee Volunteer Moderator
    2024-01-02T15:50:22.91+00:00

    Hello Atul.

    Since your topic of question and inject changed, we suggest to keep them separate question post. We understand from your revised question the topic is about apply custom domain names.

    Here are the steps to apply a custom domain for azureacr.io:

    1. Create a custom domain: You can create a custom domain using a domain registrar of your choice. Ensure that you have access to the domain's DNS records.
    2. Create a certificate: Create a certificate for your custom domain. You can use a certificate authority of your choice to create the certificate.
    3. Add a CNAME record: Add a CNAME record to your domain's DNS records. The CNAME record should point to the login server of your registry. For example, if your registry is named myregistry.azurecr.io, the CNAME record should point to myregistry.azurecr.io.
    4. Configure your registry: Configure your registry to use the custom domain and certificate. You can do this by creating a new az acr update command with the --custom-domain and --ssl-cert parameters.
    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pinaki Ghatak 5,600 Reputation points Microsoft Employee Volunteer Moderator
    2024-01-06T20:01:47.0366667+00:00

    Hello @Atul Vishwakarma

    To elaborate further on steps what is needed to do, there are multiple steps here.

    1. Prepare your existing registry: Enable data endpoints and managed identities
    2. Prepare your Azure Key Vault: This involves managing your certificates. Note that ACR custom domains are currently not supported where key vault access is restricted, but this is work in progress and will be available with system managed identities only.
    3. Prepare your DNS zone: You would need to configure your DNS settings appropriately.

    Please note that these are high-level steps and the actual process might involve more detailed steps. Also, keep in mind that this feature is in private preview and might not be available for all users.

    Please note that using custom domains with Azure services often involves additional considerations around SSL/TLS certificates, DNS configuration, and potentially other Azure services like Azure Key Vault.

    I hope this helps! If you have any other questions, feel free to ask.

    If this answers your question, please mark this as answered.

    1 person found this answer helpful.
    0 comments
  2. Konstantinos Passadis 19,591 Reputation points MVP
    2023-12-31T12:07:05+00:00

    Hello @Atul Vishwakarma !

    Please follow these instructions

    Those Public Endpoints remain as the DNS name of the ACR , more like a reference , but access is not possible

    The link below has everything you need !

    https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link

    I hope this helps!

    Kindly mark the answer as Accepted and Upvote in case it helped!

    Regards

    0 comments
  3. Pinaki Ghatak 5,600 Reputation points Microsoft Employee Volunteer Moderator
    2023-12-31T12:47:34.2533333+00:00

    Hello Atul

    To configure your Azure Container Registry (ACR) with a private network and expose it with private endpoints using a private DNS zone, you can follow these steps:

    1. Set up a private endpoint: You can set up a private endpoint for your registry using the Azure portal or the Azure CLI. This feature is available in the Premium container registry service tier.
    2. Disable public access: Navigate to your container registry in the Azure portal and select Settings > Networking. On the Public access tab, in Allow public network access, select Disabled. Then select Save.
    3. Configure DNS settings for the registry’s private endpoints: This allows the settings to resolve to the registry’s allocated private IP address. With DNS configuration, clients and services in the network can continue to access the registry at the registry’s fully qualified domain name.
    4. Configure access to ACR using Private Endpoint: This can be done by setting up a connection between the VM and ACR, and between the AKS and ACR.

    Please note that once the public network access is disabled, instances of certain Azure services including Azure DevOps Services are currently unable to access the container registry. Private endpoints are not currently supported with Azure DevOps managed agents. You will need to use a self-hosted agent with network line of sight to the private endpoint.

    If the registry has an approved private endpoint and public network access is disabled, repositories and tags can’t be listed outside the virtual network using the Azure portal, Azure CLI, or other tools.

    If you still see public endpoints after following these steps, it might be due to some misconfiguration or delay in the update. Please double-check your settings and wait for a few minutes for the changes to take effect.

    i hope this information helps you further.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.