Merge pull request #78735 from iainfoulds/aksdockercontenttrust

[AKS] Removing links to ACR for Docker content trust

Author: v-albemi

articles/aks/best-practices.md

@@ -36,7 +36,7 @@ As a cluster operator, work together with application owners and developers to u
 * [Best practices for cluster security and upgrades](operator-best-practices-cluster-security.md)
     * Includes securing access to the API server, limiting container access, and managing upgrades and node reboots.
 * [Best practices for container image management and security](operator-best-practices-container-image-management.md)
-    * Includes securing the image and runtimes, using trusted registries, and automated builds on base image updates..
+    * Includes securing the image and runtimes and automated builds on base image updates.
 * [Best practices for pod security](developer-best-practices-pod-security.md)
     * Includes securing access to resources, limiting credential exposure, and using pod identities and digital key vaults.
 

articles/aks/operator-best-practices-container-image-management.md

@@ -18,7 +18,6 @@ This article focuses on how to secure your containers in AKS. You learn how to:
 
 > [!div class="checklist"]
 > * Scan for and remediate image vulnerabilities
-> * Use a trusted registry with digitally signed container images
 > * Automatically trigger and redeploy container images when a base image is updated
 
 You can also read the best practices for [cluster security][best-practices-cluster-security] and for [pod security][best-practices-pod-security].
@@ -33,16 +32,6 @@ One concern with the adoption of container-based workloads is verifying the secu
 
 In a real-world example, you can use a continuous integration and continuous deployment (CI/CD) pipeline to automate the image scans, verification, and deployments. Azure Container Registry includes these vulnerabilities scanning capabilities.
 
-## Use a trusted registry
-
-**Best practice guidance** - Limit the image registries that pods and deployments can use. Only allow trusted registries where you validate and control the images that are available.
-
-For additional security, you can also digitally sign your container images just like you can digitally sign your application code. You then only permit AKS to deploy signed images. This process provides an additional layer of security in that you limit AKS to only pull images digitally signed and trusted by you, not just images that pass a vulnerability check. You also make sure that the container image has not been tampered with and replaced by an image with the exact same name.
-
-Trusted registries that provide digitally signed container images add complexity to your environment, but may be required for certain policy or regulatory compliance. Azure Container Registry supports the use of trusted registries and signed images.
-
-For more information about digitally signed images, see [Content trust in Azure Container Registry][acr-content-trust].
-
 ## Automatically build new images on base image update
 
 **Best practice guidance** - As you use base images for application images, use automation to build new images when the base image is updated. As those base images typically include security fixes, update any downstream application container images.
@@ -58,7 +47,6 @@ For more information about base image updates, see [Automate image builds on bas
 This article focused on how to secure your containers. To implement some of these areas, see the following articles:
 
 * [Automate image builds on base image update with Azure Container Registry Tasks][acr-base-image-update]
-* [Content trust in Azure Container Registry][acr-content-trust]
 
 <!-- EXTERNAL LINKS -->
 [azure-pipelines]: /azure/devops/pipelines/?view=vsts
@@ -68,5 +56,4 @@ This article focused on how to secure your containers. To implement some of thes
 <!-- INTERNAL LINKS -->
 [best-practices-cluster-security]: operator-best-practices-cluster-security.md
 [best-practices-pod-security]: developer-best-practices-pod-security.md
-[acr-content-trust]: ../container-registry/container-registry-content-trust.md
 [acr-base-image-update]: ../container-registry/container-registry-tutorial-base-image-update.md