feat: Managed Identity support for Image Pull

[suselva]

Ability to use MI for image pulls

Overview:

Currently customers must pass in their ACR credentials to get container images pulled onto ACI. This introduces concerns from customers that the credentials may be compromised. Customers would like to be able to authenticate with ACR using an assigned managed identity.

ACI Support:

Specify the properties of Azure container registry by including the imageRegistryCredentials property in the container group definition.

ImageRegistryCredential

Prerequisites

• MI should have create resource permission on at least the Resource Group Level to be able to create an ACI Resource.
• MI should have “ACRPull” access on the ACR.
• Assign MI as Kubelet Identity on the AKS Cluster. Kubelet Identity is available on the nodepool VMSS as a user assigned identity, which is used for authorizing with ACI to create container groups.

Work Required

1. MI to be added as ContainerGroupIdentity to be passed to ACI.
2. Infer Managed Identity using a GET call against ManagedCluster and use ACR Server name from the PodSpec “image” property to initialize imageRegistryCredential property(when imagePullSecrets is not passed)

Validation

MI to authenticate image pull

Reference:

Deploy to ACR from ACR using MI: Deploy container image from Azure Container Registry using a managed identity - Azure Container Instances | Microsoft Docs
Attach ACR to AKS : Integrate Azure Container Registry with Azure Kubernetes Service - Azure Kubernetes Service | Microsoft Docs
MI with ACI: Enable managed identity in container group - Azure Container Instances | Microsoft Docs

[PSanetra]

@helayoty Is there any chance of getting this or a similar PR, which introduces managed identity support for pulling from ACRs, merged?

[Fei-Guo]

@helayoty Is there any chance of getting this or a similar PR, which introduces managed identity support for pulling from ACRs, merged?

Hi, Philip, we are very close to release Virtual Kubelet version 2 in AKS, which has resolved this problem. I don't think we will actively add new features to this repo anymore. VN2 has not been open sourced yet and it uses a completely different architecture in which a real kubelet is involved.