A container registry gives a cloud-hosted Kubernetes cluster a place to obtain Docker images for deployment. Build the image locally, then publish it to a registry the cluster can reach. A private registry keeps images for a proprietary application out of a public registry. section 3.0 section 3.9.1
Create an Azure Container Registry through the Azure portal, or define one as an azurerm_container_registry resource in Terraform. Give it a unique name and a resource group. The Terraform example enables an admin account for remote authentication and selects the Basic SKU. Keep the registry if more images need publishing; delete unused cloud resources to avoid ongoing charges. section 3.9.1 section 7.9.2 section 3.9.4
To publish a locally built image:
- Get your registry URL and credentials from the Azure portal or with az acr show and az acr credential show. Use your own registry details. section 7.9.6
- Authenticate with docker login <registry-url>. Login is required before pushing to the private registry. section 3.9.2 section 7.12
- Set the destination with docker tag <existing-image> <registry-url>/<image-name>:<version>, then upload it with docker push <registry-url>/<image-name>:<version>. Check the Azure portal to confirm the image arrived. section 3.9.2
Check the published image
For a video-streaming image, tag and push version 1 as <registry-url>/video-streaming:1. To verify the remote copy, first stop and remove containers using the image, then remove its local copies. Run docker run -d -p 3000:3000 -e PORT=3000 <registry-url>/video-streaming:1. Without that cleanup, Docker may use a cached image instead of pulling from the registry. section 3.9.2 section 3.9.3
A local Kubernetes instance can use locally built images without a separate registry. A cloud cluster instead needs the image published, its deployment manifest pointed at the registry URL, and permission to pull. In the Azure Terraform setup, an AcrPull role assignment grants that permission to the cluster. section 6.8.2 section 7.12 section 7.11.2
Listing 7.9 Attaching the container registry to the cluster
--snip-- resource "azurerm_role_assignment" "role_assignment" { #1 principal_id = azurerm_kubernetes_cluster .cluster.kubelet_identity[0].object_id role_definition_name = "AcrPull" #2 scope = azurerm_container_registry.container_registry.id skip_service_principal_aad_check = true } #1 Assigns a role to the cluster #2 Gives the cluster permission to pull images from the registry
The Terraform role assignment shows which cluster identity receives AcrPull permission and how its scope points to the registry. section 7.11.2
Treat credentials and costs as operational concerns. The example login produces a warning about passing a password through the CLI; later security work addresses that warning. Registry credentials can be retrieved with the Azure CLI rather than emitted as Terraform outputs. section 3.9.2 section 7.9.6 section 7.9.7
