How to validate if AKS pod pulled image from ACR using an MSI?

Question

I have to move away from using SPN to pull image from our private ACR and switch to MSI.

Our AKS cluster have the necessary MSIs and the AcrPull role assigned to the sub where the ACR lives.
How can I validate that the image pull happens using the MSI? and not the SPN that was previously set up?

Answer 1

Hello @Shrutika Gamare

1. Verify that the managed identity exists and is correctly configured for the resource you are trying to access.
2. Ensure that the managed identity has the necessary permissions to access the requested resource. You may need to grant the appropriate role or access control permissions to the managed identity.
3. To validate ACR is accessible to AKS.

az aks check-acr --name MyManagedCluster --resource-group MyResourceGroup --acr myacr.azurecr.io 

See image below.

Please let me know if this helps in anyway.