Closed mloskot closed 1 year ago
Interestingly, when I go to portal.azure.com > my container registry > Access control (IAM) > Check access > Find > Managed identity > User-assigned managed identity > select one of my aks-*-agentpool
-s that is one corresponding with the "principalId": "2f850a88-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
above, then I'm getting very different result than from the az role assignment list
command above:
I assigned role using Client ID of aks-*-agentpool
managed identity of my AKS clusters, instead of Object (principal) ID:
resource "azurerm_role_assignment" "aks_acr_pull_allowed" {
principal_id = ...I put Client ID of AKS managed identity instead of Object (principal) ID...
role_definition_name = "AcrPull"
...
}
As soon as I corrected my Terraform code, applied, then my ACR shows the expected identities and my AKS clusters can pull images from my ACR.
Apologies for the false issue report.
OTOH, this could be added to the catalogue of issues in the troubleshooting guide :)
I owe huge thanks to @alexeldeib for his great help via #provider-azure channel on Kubernetes Slack.
I followed https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration to enable my AKS cluster with access to my private ACR. Everything seemed worked fine:
apart from the Azure replication process not completing and I'm still seeing the
Identity not found
for the two of AKS cluster identities that I assigned roles with my ACR:https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration says:
I understand it, but it has been more than 12h since creating the role assignments.
Question: Is this typical to wait that long?
I attempted to troubleshoot the problem following https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting#symptom---role-assignments-with-identity-not-found
Question: Does this empty
principalName
indicate I should keep waiting?I also attempted the troubleshooting according to https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/cannot-pull-image-from-acr-to-aks-cluster
Question: Does this empty
Principal
also indicate I should keep waiting?