You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-registry/container-registry-geo-replication.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.date: 10/31/2023
10
10
---
11
11
# Geo-replication in Azure Container Registry
12
12
13
-
Companies that want a local presence, or a hot backup, choose to run services from multiple Azure regions. As a best practice, placing a container registry in each region where images are run allows network-close operations, enabling fast, reliable image layer transfers. Geo-replication enables an Azure container registry to function as a single registry, serving multiple regions with multi-primary regional registries.
13
+
Companies that want a local presence or a hot backup choose to run services from multiple Azure regions. As a best practice, placing a container registry in each region where images are run allows network-close operations, enabling fast, reliable image layer transfers. Geo-replication enables an Azure container registry to function as a single registry, serving multiple regions with multi-primary regional registries.
14
14
15
15
A geo-replicated registry provides the following benefits:
16
16
@@ -21,22 +21,22 @@ A geo-replicated registry provides the following benefits:
21
21
* Registry resilience if a regional outage occurs
22
22
23
23
> [!NOTE]
24
-
> * If you need to maintain copies of container images in more than one Azure container registry, Azure Container Registry also supports [image import](container-registry-import-images.md). For example, in a DevOps workflow, you can import an image from a development registry to a production registry, without needing to use Docker commands.
24
+
> * If you need to maintain copies of container images in more than one Azure container registry, Azure Container Registry also supports [image import](container-registry-import-images.md). For example, in a DevOps workflow, you can import an image from a development registry to a production registry without needing to use Docker commands.
25
25
> * If you want to move a registry to a different Azure region, instead of geo-replicating the registry, see [Manually move a container registry to another region](manual-regional-move.md).
26
26
27
27
## Prerequisites
28
28
29
-
* The user requires following permissions (at registry level) to create/delete replications:
29
+
* The user requires the following permissions (at the registry level) to create/delete replications:
30
30
31
31
| Permission | Description |
32
32
|---|---|
33
33
| Microsoft.ContainerRegistry/registries/write | Create a replication |
34
34
| Microsoft.ContainerRegistry/registries/replications/write | Delete a replication |
35
35
36
36
## Example use case
37
-
Contoso runs a public presence website located across the US, Canada, and Europe. To serve these markets with local and network-close content, Contoso runs [Azure Kubernetes Service](../aks/index.yml) (AKS) clusters in West US, East US, Canada Central, and West Europe. The website application, deployed as a Docker image, utilizes the same code and image across all regions. Content, local to that region, is retrieved from a database, which is provisioned uniquely in each region. Each regional deployment has its unique configuration for resources like the local database.
37
+
Contoso runs a public presence website located across the US, Canada, and Europe. To serve these markets with local and network-close content, Contoso runs [Azure Kubernetes Service](../aks/index.yml) (AKS) clusters in West US, East US, Canada Central, and West Europe. The website application, deployed as a Docker image, utilizes the same code and image across all regions. Content local to that region is retrieved from a database, which is provisioned uniquely in each region. Each regional deployment has its unique configuration for resources like the local database.
38
38
39
-
The development team is located in Seattle WA, utilizing the West US data center.
39
+
The development team is located in Seattle, WA, and utilizes the West US data center.
40
40
41
41
<br />*Pushing to multiple registries*
42
42
@@ -59,11 +59,11 @@ Typical challenges of multiple registries include:
59
59
60
60

61
61
62
-
The geo-replication feature of Azure Container Registry has following benefits:
62
+
The geo-replication feature of Azure Container Registry has the following benefits:
63
63
64
64
* Manage a single registry across all regions: `contoso.azurecr.io`
65
65
* Manage a single configuration of image deployments as all regions use the same image URL: `contoso.azurecr.io/public/products/web:1.2`
66
-
* Push to a single registry, while ACR automatically manages the geo-replication. ACR only replicates unique layers, reducing data transfer across regions.
66
+
* Push to a single registry while ACR automatically manages the geo-replication. ACR only replicates unique layers, reducing data transfer across regions.
67
67
* Configure regional [webhooks](container-registry-webhook.md) to notify you of events in specific replicas.
68
68
* Provide a highly available registry that is resilient to regional outages.
69
69
@@ -102,7 +102,7 @@ ACR begins syncing images across the configured replicas. Once complete, the por
102
102
## Considerations for using a geo-replicated registry
103
103
104
104
* Each region in a geo-replicated registry is independent once set-up. Azure Container Registry SLAs apply to each geo-replicated region.
105
-
* For every push or pull image operations on a geo-replicated registry, Azure Traffic Manager in the background sends a request to the registry closest location in the region to maintain network latency.
105
+
* For every push or pull image operation on a geo-replicated registry, Azure Traffic Manager in the background sends a request to the registry's closest location in the region to maintain network latency.
106
106
* After you push an image or tag update to the closest region, it takes some time for Azure Container Registry to replicate the manifests and layers to the remaining regions you opted into. Larger images take longer to replicate than smaller ones. Images and tags are synchronized across the replication regions with an eventual consistency model.
107
107
* To manage workflows that depend on push updates to a geo-replicated registry, we recommend that you configure [webhooks](container-registry-webhook.md) to respond to the push events. You can set up regional webhooks within a geo-replicated registry to track push events as they complete across the geo-replicated regions.
108
108
* To serve blobs representing content layers, Azure Container Registry uses data endpoints. You can enable [dedicated data endpoints](container-registry-firewall-access-rules.md#enable-dedicated-data-endpoints) for your registry in each of your registry's geo-replicated regions. These endpoints allow configuration of tightly scoped firewall access rules. For troubleshooting purposes, you can optionally [disable routing to a replication](#temporarily-disable-routing-to-replication) while maintaining replicated data.
@@ -112,7 +112,7 @@ ACR begins syncing images across the configured replicas. Once complete, the por
112
112
113
113
* For high availability and resiliency, we recommend creating a registry in a region that supports enabling [zone redundancy](zone-redundancy.md). Enabling zone redundancy in each replica region is also recommended.
114
114
* If an outage occurs in the registry's home region (the region where it was created) or one of its replica regions, a geo-replicated registry remains available for data plane operations such as pushing or pulling container images.
115
-
* If the registry's home region becomes unavailable, you may be unable to carry out registry management operations including configuring network rules, enabling availability zones, and managing replicas.
115
+
* If the registry's home region becomes unavailable, you may be unable to carry out registry management operations, including configuring network rules, enabling availability zones, and managing replicas.
116
116
* To plan for high availability of a geo-replicated registry encrypted with a [customer-managed key](tutorial-enable-customer-managed-keys.md) stored in an Azure key vault, review the guidance for key vault [failover and redundancy](../key-vault/general/disaster-recovery-guidance.md).
117
117
118
118
## Delete a replica
@@ -121,8 +121,8 @@ After you've configured a replica for your registry, you can delete it at any ti
121
121
122
122
To delete a replica in the Azure portal:
123
123
124
-
1. Navigate to your Azure Container Registry, and select **Replications**.
125
-
1. Select the name of a replica, and select **Delete**. Confirm that you want to delete the replica.
124
+
1. Navigate to your Azure Container Registry and select **Replications**.
125
+
1. Select the name of a replica and select **Delete**. Confirm that you want to delete the replica.
126
126
127
127
To use the Azure CLI to delete a replica of *myregistry* in the East US region:
Geo-replication is a feature of the [Premium service tier](container-registry-skus.md) of Azure Container Registry. When you replicate a registry to your desired regions, you incur Premium registry fees for each region.
136
136
137
-
In the preceding example, Contoso consolidated two registries down to one, adding replicas to East US, Canada Central, and West Europe. Contoso would pay four times Premium per month, with no additional configuration or management. Each region now pulls their images locally, improving performance, reliability without network egress fees from West US to Canada and East US.
137
+
In the preceding example, Contoso consolidated two registries down to one, adding replicas to East US, Canada Central, and West Europe. Contoso would pay four times Premium per month, with no additional configuration or management. Each region now pulls their images locally, improving performance and reliability without network egress fees from the West US to Canada and the East US.
138
138
139
139
## Troubleshoot push operations with geo-replicated registries
## Creating replication for a Private Endpoint enabled registry
172
172
173
-
When creating a new registry replication for the primary registry enabled with Private Endpoint, we recommend validating User Identity has valid Private Endpoint creation permissions. Otherwise, the operation gets stuck in the provisioning state while creating the replication.
173
+
When creating a new registry replication for the primary registry enabled with Private Endpoint, we recommend validating that the User Identity has valid Private Endpoint creation permissions. Otherwise, the operation gets stuck in the provisioning state while creating the replication.
174
174
175
175
Follow the below steps if you got stuck in the provisioning state while creating the registry replication:
0 commit comments