Trigger pod updates in AKS when an ACR task trigger updates an image

[infbase]

What is the problem you're trying to solve After an ACR task trigger updates an image, the running pods in AKS with that image should also be updated. Without that happening, we can end up in a scenario where we have critical vulnerabilities exposed in an AKS cluster even after they have been patched in ACR.

Describe the solution you'd like When an AKS (or Arc for k8s) cluster has GitOps integration configured, the running pods should be automatically updated to use this updated image (deployment rolling update, helm upgrade...). This should not depend on image semantic versioning but preferably on image digests, as forcing changes in the image version may not be desirable, especially if the image update was triggered by base image patching, with no functional changes to the image.

[SteveLasker]

Hi folks, Have you looked at: https://aka.ms/acr/webhooks There's more details here: Working with ACR Geo-replication notifications

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.