You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
apart from the Azure replication process not completing and I'm still seeing the Identity not found for the two of AKS cluster identities that I assigned roles with my ACR:
$ az aks check-acr --resource-group my-aks-contoso-dev --name aks-contoso-uks-dev-aks --acr my-contoso.azurecr.ioMerged "aks-contoso-uks-dev-aks" as current context in C:\Users\mateuszl\AppData\Local\Temp\tmpgrz7ae2s[2023-05-23T11:15:33Z] Checking host name resolution (my-contoso.azurecr.io): SUCCEEDED[2023-05-23T11:15:33Z] Canonical name for ACR (my-contoso.azurecr.io): r0509uks.uksouth.cloudapp.azure.com.[2023-05-23T11:15:33Z] ACR location: uksouth[2023-05-23T11:15:33Z] Checking managed identity...[2023-05-23T11:15:33Z] Kubelet managed identity client ID: 7e49d45b-xxxx-xxxx-xxxx-xxxxxxxxxxxx[2023-05-23T11:15:33Z] Validating managed identity existance: SUCCEEDED[2023-05-23T11:15:35Z] Validating image pull permission: FAILED[2023-05-23T11:15:35Z] ACR my-contoso.azurecr.io rejected token exchange: ACR token exchange endpoint returned error status: 401. body:
$ az role assignment list --scope /subscriptions/4629e9b5-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/my-acr-contoso/providers/Microsoft.ContainerRegistry/registries/my-contoso --output tablePrincipal Role Scope----------- ------- --------------------------------------------------------------------------------------------------------------------------------------------- AcrPull /subscriptions/4629e9b5-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/my-acr-contoso/providers/Microsoft.ContainerRegistry/registries/my-contoso AcrPull /subscriptions/4629e9b5-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/my-acr-contoso/providers/Microsoft.ContainerRegistry/registries/my-contoso
Question: Does this empty Principal also indicate I should keep waiting?
The text was updated successfully, but these errors were encountered:
Interestingly, when I go to portal.azure.com > my container registry > Access control (IAM) > Check access > Find > Managed identity > User-assigned managed identity > select one of my aks-*-agentpool-s that is one corresponding with the "principalId": "2f850a88-xxxx-xxxx-xxxx-xxxxxxxxxxxx" above, then I'm getting very different result than from the az role assignment list command above:
I assigned role using Client ID of aks-*-agentpool managed identity of my AKS clusters, instead of Object (principal) ID:
resource"azurerm_role_assignment""aks_acr_pull_allowed" {
principal_id=...I put Client ID of AKS managed identity instead of Object (principal) ID...role_definition_name="AcrPull"...
}
As soon as I corrected my Terraform code, applied, then my ACR shows the expected identities and my AKS clusters can pull images from my ACR.
Apologies for the false issue report.
OTOH, this could be added to the catalogue of issues in the troubleshooting guide :)
I owe huge thanks to @alexeldeib for his great help via #provider-azure channel on Kubernetes Slack.
I followed https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration to enable my AKS cluster with access to my private ACR. Everything seemed worked fine:
apart from the Azure replication process not completing and I'm still seeing the
Identity not found
for the two of AKS cluster identities that I assigned roles with my ACR:https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration says:
I understand it, but it has been more than 12h since creating the role assignments.
Question: Is this typical to wait that long?
I attempted to troubleshoot the problem following https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting#symptom---role-assignments-with-identity-not-found
Question: Does this empty
principalName
indicate I should keep waiting?I also attempted the troubleshooting according to https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/cannot-pull-image-from-acr-to-aks-cluster
Question: Does this empty
Principal
also indicate I should keep waiting?The text was updated successfully, but these errors were encountered: