Azure / Azure/AKS

[Feature] Support for Service Principal configuration for Network Isolated Clusters

Open
#5,821 1 comment 0 reactions 1 assignee Claimed by @toddysm View on GitHub
azure/acr feature-request Private-cluster
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
4d 15h
Merged PRs (30d)
14

Description

**Is your feature request related to a problem? Please describe.**
Our current architecture currently deploys an ACR to a centralized Azure tenant where we have AKS referencing this ACR for container images. These clusters can either be in the same Azure tenant or in a separate Azure tenant in relation to the ACR.

For clusters deployed in a different tenant, we rely on multi-tenant Service Principal configured for the AKS clusters to have access to the ACR running in the centralized tenant. Unfortunately for network isolated clusters where we BYO private ACR, this isn't supported. Here's the following error we see:

```
azure-native:containerservice/v20241002preview:ManagedCluster (aks-cluster):
error: Code="BootstrapArtifactSourceNotAllowed" Message="When feature \"ServicePrincipalCluster\" is enabled, bootstrapProfile.artifactSource 'Cache' is not allowed"
```

Optional: Set the appropriate GitHub label(s) to indicate the AKS feature or area your feature request relates to.

**Describe the solution you'd like**
Support for network isolated cluster configured with BYO private ACR with Service Principal configuration for AKS.

**Describe alternatives you've considered**
As an alternative, we currently have to deploy ACRs in each Azure tenant with caching rules set up to pull from the centralized ACR.

**Additional context**
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.