How can I access an existing private ACR (in my corporate subscription) from my Visual Studio Enterprise subscription?

Question

My company uses an Azure subscription where we have an ACR with container images inside. I am using my Visual Studio Enterprise subscription to experiment with Kubernetes. There, I have created a Kubernetes cluster and wish to start containers from the ACR in the other subscription. Although both subscriptions are visible in my portal, I am getting access denied when I try to access the ACR.

The ACR has an access-control list which has my email in it. Since my email is used to authenticate to both subscriptions, I expect this should work. What other steps do I need?

Answer 1

Hello David Maul

For AKS to be able to pull from ACR, AKS's identity needs to be authorized, not you/your email.

If the ACR and AKS are in the same tenant, you can use the following command to integrate them:
az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acr-resource-id>

Reference link: https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli

If AKS and ACR are in different tenant, you will need to follow the steps in the following documentation: https://learn.microsoft.com/en-us/azure/container-registry/authenticate-aks-cross-tenant

Hopefully this is what you are looking for! If you have additional questions, please let us know in the comments.

If this has been helpful, please take a moment to accept answers as this helps increase visibility of this question for other members of the Microsoft Q&A community. Thank you for helping to improve Microsoft Q&A!