can we bind AKS cluster to our own Azure Container Registry?

Question

How can we bind AKS cluster to our own Azure Container Registry?

Answer 1

Hi @Bharani ,

Thanks for contacting Microsoft Q&A platform.

Assuming that you want to integrate your AKS cluster with your own Azure Container Registry and ensure that images from this registry only can be used to create pods on the aforementioned AKS cluster, you can:

• Integrate ACR with an AKS Cluster
• Use the built-in Azure Policy for Kubernetes Kubernetes cluster containers should only use allowed images. You can find the policy json (GitHub version 6.1.0) here. Description: Use images from trusted registries to reduce the Kubernetes cluster's exposure risk to unknown vulnerabilities, security issues and malicious images. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc. Effects: audit, deny, disabled

For more information please check this document. For how-to on enforcing Azure Policy for Kubernetes please check out this document.

Hope this helps you.

Answer 2

Hi there Bharani

Thanks for using QandA platform.

Guess this is possible, Create a new AKS cluster and integrate with an existing ACR using the az aks create command with the --attach-acr parameter. This command allows you to authorize an existing ACR in your subscription and configures the appropriate AcrPull role for the managed identity.

For a detailed info follow the documentation below

https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli

If this helps kindly accept the answer thanks much.