AKS attach-acr error after migrating from one subscription to another

user_782400 0
Viewed 311

I just migrated from one subscription to another on Azure. Although the subscriptionId is the same, the tenantId was changed.

After the migration, my AKS cluster no longer can pull images from the ACR. My AKS currently uses service principles that I believe are no longer valid after the migration. I have updated the service principle but I'm still not able to pull the image.

Is there any other configuration that I need to be aware of?

azure-container-registry azure-aks azure
1 Answers

Pls verify if the Role "AcrPull" is still assigned to the Managed Identity (Kubelet) of the AKS node pool.

Terrafrom example:

  resource "azurerm_role_assignment" "example" {
    scope                            = azurerm_container_registry.acr.id
    role_definition_name             = "AcrPull"
    principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
  }

AZ cli example:

export KUBE_ID=$(az aks show -g <resource group> -n <aks cluster name> --query identityProfile.kubeletidentity.objectId -o tsv)
export ACR_ID=$(az acr show -g <resource group> -n <acr name> --query id -o tsv)
az role assignment create --assignee $KUBE_ID --role "AcrPull" --scope $ACR_ID
user_167764510
Related