Skip to content

Commit 2cebaf7

Browse files
dlepowdlepow
committed
review comments
1 parent 6fa2e75 commit 2cebaf7

File tree

1 file changed

+44
-42
lines changed

1 file changed

+44
-42
lines changed

‎articles/container-registry/container-registry-firewall-access-rules.md

Lines changed: 44 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Firewall access rules
33
description: Configure rules to access an Azure container registry from behind a firewall, by allowing access to ("whitelisting") REST API and data endpoint domain names or service-specific IP address ranges.
44
ms.topic: article
5-
ms.date: 05/06/2020
5+
ms.date: 05/07/2020
66
---
77

88
# Configure rules to access an Azure container registry behind a firewall
@@ -17,53 +17,16 @@ To pull or push images or other artifacts to an Azure container registry, a clie
1717

1818
* **Registry REST API endpoint** - Authentication and registry management operations are handled through the registry's public REST API endpoint. This endpoint is the login server name of the registry. Example: `myregistry.azurecr.io`
1919

20-
* **Data endpoint** - Azure [allocates blob storage](container-registry-storage.md) in Azure Storage accounts on behalf of each registry to manage the data for container images and other artifacts. When a client accesses image layers in an Azure container registry, it makes requests using a storage account endpoint provided by the registry.
20+
* **Storage (data) endpoint** - Azure [allocates blob storage](container-registry-storage.md) in Azure Storage accounts on behalf of each registry to manage the data for container images and other artifacts. When a client accesses image layers in an Azure container registry, it makes requests using a storage account endpoint provided by the registry.
2121

2222
If your registry is [geo-replicated](container-registry-geo-replication.md), a client might need to interact with the data endpoint in a specific region or in multiple replicated regions.
2323

2424
## Allow access to REST and data endpoints
2525

2626
* **REST endpoint** - Allow access to the fully qualified registry login server name, `<registry-name>.azurecr.io`, or an associated IP address range
27-
* **Storage (data) endpoint** - Enable access to a [dedicated data endpoint](#enable-dedicated-data-endpoints-preview) (preview) in each region where the registry is located or replicated, `<registry-name>.<region>.data.azurecr.io`. Alternatively, and less specifically, allow access to all Azure blob storage accounts using the wildcard `*.blob.core.windows.net`, or an associated IP address range.
28-
29-
## Enable dedicated data endpoints (preview)
30-
31-
> [!WARNING]
32-
> If you previously configured client firewall access to the existing `*.blob.core.windows.net` endpoints, switching to dedicated data endpoints will impact client connectivity, causing pull failures. To ensure clients have consistent access, add the new data endpoint rules to the client firewall rules. Once completed, enable dedicated data endpoints for your registries using the Azure CLI or other tools.
33-
34-
A dedicated data endpoint is an optional feature of the **Premium** container registry service tier. For information about registry service tiers and limits, see [Azure Container Registry Tiers](container-registry-skus.md). To enable data endpoints using the Azure CLI, use Azure CLI version 2.4.0 or higher. If you need to install or upgrade, see [Install Azure CLI](/cli/azure/install-azure-cli).
35-
36-
The following [az acr update][az-acr-update] command enables data endpoints on a registry *myregistry*. For demonstration purpose, assume that the registry is replicated in two regions:
37-
38-
```azurecli
39-
az acr update --name myregistry --data-endpoint-enabled
40-
```
41-
42-
To view the data endpoints, including regional endpoints for geo-replicated registries, use the [az acr show-endpoints][az-acr-show-endpoints] command:
43-
44-
```azurecli
45-
az acr show-endpoints --name myregistry
46-
```
47-
48-
Output:
49-
50-
```
51-
{
52-
"loginServer": "myregistry.azurecr.io",
53-
"dataEndpoints": [
54-
{
55-
"region": "eastus",
56-
"endpoint": "myregistry.eastus.data.azurecr.io",
57-
},
58-
{
59-
"region": "westus",
60-
"endpoint": "myregistry.westus.data.azurecr.io",
61-
}
62-
]
63-
}
64-
```
65-
66-
After you set up dedicated data endpoints for your registry, you can enable client firewall access rules for the data endpoints. Enable data endpoint access rules for all required registry regions.
27+
* **Storage (data) endpoint** - Allow access to all Azure blob storage accounts using the wildcard `*.blob.core.windows.net`, or an associated IP address range.
28+
> [!NOTE]
29+
> Azure Container Registry is introducing [dedicated data endpoints](#enable-dedicated-data-endpoints-preview) (preview), allowing you to tightly scope client firewall rules for your registry storage. Optionally enable data endpoints in all regions where the registry is located or replicated, using the form `<registry-name>.<region>.data.azurecr.io`.
6730
6831
## Allow access by IP address range
6932

@@ -149,6 +112,45 @@ In an Azure virtual network, use network security rules to filter traffic from a
149112

150113
For example, create an outbound network security group rule with destination **AzureContainerRegistry** to allow traffic to an Azure container registry. To allow access to the service tag only in a specific region, specify the region in the following format: **AzureContainerRegistry**.[*region name*].
151114

115+
## Enable dedicated data endpoints (preview)
116+
117+
> [!WARNING]
118+
> If you previously configured client firewall access to the existing `*.blob.core.windows.net` endpoints, switching to dedicated data endpoints will impact client connectivity, causing pull failures. To ensure clients have consistent access, add the new data endpoint rules to the client firewall rules. Once completed, enable dedicated data endpoints for your registries using the Azure CLI or other tools.
119+
120+
Dedicated data endpoints is an optional feature of the **Premium** container registry service tier. For information about registry service tiers and limits, see [Azure Container Registry Tiers](container-registry-skus.md). To enable data endpoints using the Azure CLI, use Azure CLI version 2.4.0 or higher. If you need to install or upgrade, see [Install Azure CLI](/cli/azure/install-azure-cli).
121+
122+
The following [az acr update][az-acr-update] command enables dedicated data endpoints on a registry *myregistry*. For demonstration purpose, assume that the registry is replicated in two regions:
123+
124+
```azurecli
125+
az acr update --name myregistry --data-endpoint-enabled
126+
```
127+
128+
The data endpoints use a regional pattern, `<registry-name>.<region>.data.azurecr.io`. To view the data endpoints, use the [az acr show-endpoints][az-acr-show-endpoints] command:
129+
130+
```azurecli
131+
az acr show-endpoints --name myregistry
132+
```
133+
134+
Output:
135+
136+
```
137+
{
138+
"loginServer": "myregistry.azurecr.io",
139+
"dataEndpoints": [
140+
{
141+
"region": "eastus",
142+
"endpoint": "myregistry.eastus.data.azurecr.io",
143+
},
144+
{
145+
"region": "westus",
146+
"endpoint": "myregistry.westus.data.azurecr.io",
147+
}
148+
]
149+
}
150+
```
151+
152+
After you set up dedicated data endpoints for your registry, you can enable client firewall access rules for the data endpoints. Enable data endpoint access rules for all required registry regions.
153+
152154
## Configure client firewall rules for MCR
153155

154156
If you need to access Microsoft Container Registry (MCR) from behind a firewall, see the guidance to configure [MCR client firewall rules](https://github.com/microsoft/containerregistry/blob/master/client-firewall-rules.md). MCR is the primary registry for all Microsoft-published docker images, such as Windows Server images.

0 commit comments

Comments
 (0)