Azure blob storage and blocking egress traffic

[mkosieradzki]

Currently Azure Container Registry stores container images in blobs. Unfortunately those blobs are only reachable over *.blob.core.windows.net - for obvious reasons this is not acceptable for egress traffic restrictions.

I am pleased that Microsoft Container Registry is no longer using the azure blob storage domain but the CDN (*.cdn.mscr.io) - what makes our lives much easier.

When can we expect similar thing to happen for public ACRs like aksrepos.azurecr.io? What is the current blocker? Lack of custom domain support with SSL in Azure Storage?

What is the plan for vnet-integrated ACRs? Are those going to support virtual network service endpoints for blobs as well? Is it going to integrate with Virtual Network Service Endpoint Policy?

This is a significant show-stopper for private AKS clusters...

[yugangw-msft]

Marcin Kosieradzki (@mkosieradzki), thanks for the feedback.
For egress traffic, our ongoing development will eliminate the blob uri usage in firewall rules.
On vnet, using service endpoint has already avoided using blob uri. Are you asking about vnet private endpoint?

[mkosieradzki]

Yugang Wang (@yugangw-msft) Thanks! That's a great news.

Actually I was unable to distinguish out whether the blob calls were for ACR accessible via Service Endpoints or aksrepos.azurecr.io. So if you say that vnet integration already solves the problem, then it's probably so ;).

Is there any roadmap? Is this going to happen during current or the next sprint?

[yugangw-msft]

Using VNET does resolve the problem; but VNET integration right now comes with the limitation that only VM/AKS will be able to access ACR, not other resources like ACI or ML, though the limitation will be lifted at some point in future.
Meanwhile, the unified data endpoint under development will make client firewall rule configuration as easy as a single uri like aksrepos.westus.azurecr.io.
Will update this issue once we have firm timeline Please stay tuned.

[yugangw-msft]

data endpoint was released:

https://azure.microsoft.com/en-us/updates/azure-container-registry-dedicated-data-endpoints-now-in-preview/