You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/how-to-manage-groups.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -157,7 +157,7 @@ We currently don't support:
157
157
158
158
1. Locate the group you want your group to be a member of and choose **Select**.
159
159
160
-
For this exercise, we're adding "MDM policy - West" to the "MDM policy - All org" group, so "MDM - policy - West" inherits all the properties and configurations of the "MDM policy - All org" group.
160
+
For this exercise, we're adding "MDM policy - West" to the "MDM policy - All org" group. The "MDM - policy - West" group will have the same access as the "MDM policy - All org" group.
161
161
162
162
163
163
@@ -166,7 +166,7 @@ Now you can review the "MDM policy - West - Group memberships" page to see the g
166
166
For a more detailed view of the group and member relationship, select the parent group name (MDM policy - All org) and take a look at the "MDM policy - West" page details.
167
167
168
168
### Remove a group from another group
169
-
You can remove an existing Security group from another Security group; however, removing the group also removes any inherited settings for its members.
169
+
You can remove an existing Security group from another Security group; however, removing the group also removes any inherited access for its members.
170
170
171
171
1. On the **Groups - All groups** page, search for and select the group you need to remove as a member of another group.
title: Integrate Azure Container Registry with Azure Kubernetes Service
3
3
description: Learn how to integrate Azure Kubernetes Service (AKS) with Azure Container Registry (ACR)
4
4
services: container-service
5
-
manager: gwallace
6
5
ms.topic: article
7
-
ms.date: 06/10/2021
6
+
ms.date: 11/16/2022
8
7
ms.tool: azure-cli, azure-powershell
9
8
ms.devlang: azurecli
10
9
---
11
10
12
11
# Authenticate with Azure Container Registry from Azure Kubernetes Service
13
12
14
-
When you're using Azure Container Registry (ACR) with Azure Kubernetes Service (AKS), an authentication mechanism needs to be established. This operation is implemented as part of the CLI, PowerShell, and Portal experience by granting the required permissions to your ACR. This article provides examples for configuring authentication between these two Azure services.
13
+
You need to establish an authentication mechanism when using [Azure Container Registry (ACR)][acr-intro] with Azure Kubernetes Service (AKS). This operation is implemented as part of the Azure CLI, Azure PowerShell, and Azure portal experiences by granting the required permissions to your ACR. This article provides examples for configuring authentication between these Azure services.
15
14
16
-
You can set up the AKS to ACR integration in a few simple commands with the Azure CLIor Azure PowerShell. This integration assigns the AcrPull role to the managed identity associated to the AKS Cluster.
15
+
You can set up the AKS to ACR integration in a few steps using the Azure CLI, Azure PowerShell, or Azure portal. The AKS to ACR integration assigns the [**AcrPull** role][acr-pull] to the [Azure Active Directory (Azure AD) **managed identity**][aad-identity] associated with your AKS cluster.
17
16
18
17
> [!NOTE]
19
-
> This article covers automatic authentication between AKS and ACR. If you need to pull an image from a private external registry, use an [image pull secret][Image Pull Secret].
18
+
> This article covers automatic authentication between AKS and ACR. If you need to pull an image from a private external registry, use an [image pull secret][image-pull-secret].
20
19
21
20
## Before you begin
22
21
23
-
These examples require:
22
+
* You need to have the [**Owner**][rbac-owner], [**Azure account administrator**][rbac-classic], or [**Azure co-administrator**][rbac-classic] role on your **Azure subscription**.
23
+
* To avoid needing one of these roles, you can instead use an existing managed identity to authenticate ACR from AKS. For more information, see [Use an Azure managed identity to authenticate to an ACR](../container-registry/container-registry-authentication-managed-identity.md).
24
+
* If you're using Azure CLI, this article requires that you're running Azure CLI version 2.7.0 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][azure-cli-install].
25
+
* If you're using Azure PowerShell, this article requires that you're running Azure PowerShell version 5.9.0 or later. Run `Get-InstalledModule -Name Az` to find the version. If you need to install or upgrade, see [Install Azure PowerShell][azure-powershell-install].
24
26
25
-
### [Azure CLI](#tab/azure-cli)
27
+
##Create a new AKS cluster with ACR integration
26
28
27
-
***Owner**, **Azure account administrator**, or **Azure co-administrator** role on the **Azure subscription**
28
-
* Azure CLI version 2.7.0 or later
29
+
You can set up AKS and ACR integration during the creation of your AKS cluster. To allow an AKS cluster to interact with ACR, an Azure AD managed identity is used.
29
30
30
-
### [Azure PowerShell](#tab/azure-powershell)
31
+
### Create an ACR
31
32
32
-
***Owner**, **Azure account administrator**, or **Azure co-administrator** role on the **Azure subscription**
33
-
* Azure PowerShell version 5.9.0 or later
33
+
If you don't already have an ACR, create one using the following command.
34
34
35
-
---
35
+
#### [Azure CLI](#tab/azure-cli)
36
36
37
-
To avoid needing an **Owner**, **Azure account administrator**, or **Azure co-administrator** role, you can use an existing managed identity to authenticate ACR from AKS. For more information, see [Use an Azure managed identity to authenticate to an Azure container registry](../container-registry/container-registry-authentication-managed-identity.md).
37
+
```azurecli
38
+
# Set this variable to the name of your ACR. The name must be globally unique.
38
39
39
-
## Create a new AKS cluster with ACR integration
40
+
MYACR=myContainerRegistry
40
41
41
-
You can set up AKS and ACR integration during the initial creation of your AKS cluster. To allow an AKS cluster to interact with ACR, an Azure Active Directory **managed identity** is used. The following command allows you to authorize an existing ACR in your subscription and configures the appropriate **ACRPull** role for the managed identity. Supply valid values for your parameters below.
42
+
az acr create -n $MYACR -g myContainerRegistryResourceGroup --sku basic
43
+
```
42
44
43
-
### [Azure CLI](#tab/azure-cli)
45
+
#### [Azure PowerShell](#tab/azure-powershell)
46
+
47
+
```azurepowershell
48
+
# Set this variable to the name of your ACR. The name must be globally unique.
### Create a new AKS cluster and integrate with an existing ACR
58
+
59
+
If you already have an ACR, use the following command to create a new AKS cluster with ACR integration. This command allows you to authorize an existing ACR in your subscription and configures the appropriate **AcrPull** role for the managed identity. Supply valid values for your parameters below.
60
+
61
+
#### [Azure CLI](#tab/azure-cli)
44
62
45
63
```azurecli
46
-
# set this to the name of your Azure Container Registry. It must be globally unique
64
+
# Set this variable to the name of your ACR. The name must be globally unique.
65
+
47
66
MYACR=myContainerRegistry
48
67
49
-
# Run the following line to create an Azure Container Registry if you do not already have one
50
-
az acr create -n $MYACR -g myContainerRegistryResourceGroup --sku basic
68
+
# Create an AKS cluster with ACR integration.
51
69
52
-
# Create an AKS cluster with ACR integration
53
70
az aks create -n myAKSCluster -g myResourceGroup --generate-ssh-keys --attach-acr $MYACR
54
71
```
55
72
56
-
Alternatively, you can specify the ACR name using an ACR resource ID, which has the following format:
73
+
Alternatively, you can specify the ACR name using an ACR resource ID using the following format:
> If you are using an ACR that is located in a different subscription from your AKS cluster, use the ACR resource ID when attaching or detaching from an AKS cluster.
62
-
63
-
```azurecli
64
-
az aks create -n myAKSCluster -g myResourceGroup --generate-ssh-keys --attach-acr /subscriptions/<subscription-id>/resourceGroups/myContainerRegistryResourceGroup/providers/Microsoft.ContainerRegistry/registries/myContainerRegistry
65
-
```
78
+
> If you're using an ACR located in a different subscription from your AKS cluster, use the ACR *resource ID* when attaching or detaching from the cluster.
79
+
>
80
+
> ```azurecli
81
+
> az aks create -n myAKSCluster -g myResourceGroup --generate-ssh-keys --attach-acr /subscriptions/<subscription-id>/resourceGroups/myContainerRegistryResourceGroup/providers/Microsoft.ContainerRegistry/registries/myContainerRegistry
82
+
> ```
66
83
67
-
### [Azure PowerShell](#tab/azure-powershell)
84
+
#### [Azure PowerShell](#tab/azure-powershell)
68
85
69
86
```azurepowershell
70
-
# set this to the name of your Azure Container Registry. It must be globally unique
87
+
# Set this variable to the name of your ACR. The name must be globally unique.
88
+
71
89
$MYACR = 'myContainerRegistry'
72
90
73
-
# Run the following line to create an Azure Container Registry if you do not already have one
@@ -83,47 +99,53 @@ This step may take several minutes to complete.
83
99
84
100
## Configure ACR integration for existing AKS clusters
85
101
86
-
### [Azure CLI](#tab/azure-cli)
102
+
### Attach an ACR to an AKS cluster
103
+
104
+
#### [Azure CLI](#tab/azure-cli)
87
105
88
-
Integrate an existing ACR with existing AKS clusters by supplying valid values for **acr-name** or **acr-resource-id** as below.
106
+
Integrate an existing ACR with an existing AKS cluster using the [`--attach-acr` parameter][cli-param] and valid values for **acr-name** or **acr-resource-id**.
89
107
90
108
```azurecli
109
+
# Attach using acr-name
91
110
az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acr-name>
92
-
```
93
111
94
-
or,
95
-
96
-
```azurecli
112
+
# Attach using acr-resource-id
97
113
az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acr-resource-id>
98
114
```
99
115
100
116
> [!NOTE]
101
-
> Running`az aks update --attach-acr` uses the permissions of the user running the command to create the role ACR assignment. This role is assigned to the kubelet managed identity. For more information on the AKS managed identities, see [Summary of managed identities][summary-msi].
117
+
> The`az aks update --attach-acr`command uses the permissions of the user running the command to create the ACR role assignment. This role is assigned to the [kubelet][kubelet] managed identity. For more information on AKS managed identities, see [Summary of managed identities][summary-msi].
102
118
103
-
You can also remove the integration between an ACR and an AKS cluster with the following
119
+
#### [Azure PowerShell](#tab/azure-powershell)
104
120
105
-
```azurecli
106
-
az aks update -n myAKSCluster -g myResourceGroup --detach-acr <acr-name>
121
+
Integrate an existing ACR with an existing AKS cluster using the [`-AcrNameToAttach` parameter][ps-attach] and valid values for **acr-name**.
> Running the `Set-AzAksCluster -AcrNameToAttach` cmdlet uses the permissions of the user running the command to create the role ACR assignment. This role is assigned to the [kubelet][kubelet] managed identity. For more information on AKS managed identities, see [Summary of managed identities][summary-msi].
110
129
111
-
```azurecli
112
-
az aks update -n myAKSCluster -g myResourceGroup --detach-acr <acr-resource-id>
113
-
```
130
+
---
114
131
115
-
### [Azure PowerShell](#tab/azure-powershell)
132
+
### Detach an ACR from an AKS cluster
116
133
117
-
Integrate an existing ACR with existing AKS clusters by supplying valid values for **acr-name** as below.
Remove the integration between an ACR and an AKS cluster using the [`--detach-acr` parameter][cli-param] and valid values for **acr-name** or **acr-resource-id**.
137
+
138
+
```azurecli
139
+
# Detach using acr-name
140
+
az aks update -n myAKSCluster -g myResourceGroup --detach-acr <acr-name>
141
+
142
+
# Detach using acr-resource-id
143
+
az aks update -n myAKSCluster -g myResourceGroup --detach-acr <acr-resource-id>
121
144
```
122
145
123
-
> [!NOTE]
124
-
> Running `Set-AzAksCluster -AcrNameToAttach` uses the permissions of the user running the command to create the role ACR assignment. This role is assigned to the kubelet managed identity. For more information on the AKS managed identities, see [Summary of managed identities][summary-msi].
146
+
#### [Azure PowerShell](#tab/azure-powershell)
125
147
126
-
You can also remove the integration between an ACR and an AKS cluster with the following
148
+
Remove the integration between an ACR and an AKS cluster using the [`-AcrNameToDetach` parameter][ps-detach] and valid values for **acr-name**.
Create a file called **acr-nginx.yaml**that contains the following. Substitute the resource name of your registry for **acr-name**. Example: *myContainerRegistry*.
194
+
Create a file called **acr-nginx.yaml**using the sample YAML below. Replace **acr-name** with the name of your ACR.
173
195
174
196
```yaml
175
197
apiVersion: apps/v1
@@ -195,19 +217,19 @@ spec:
195
217
- containerPort: 80
196
218
```
197
219
198
-
Next, run this deployment in your AKS cluster:
220
+
After creating the file, run the following deployment in your AKS cluster.
199
221
200
222
```console
201
223
kubectl apply -f acr-nginx.yaml
202
224
```
203
225
204
-
You can monitor the deployment by running:
226
+
You can monitor the deployment by running`kubectl get pods`.
0 commit comments