Allow to deploy images from a private ACR

[jmalkiew]

We'd like to be able to deploy images to AKS virtual node from an ACR that is deployed into VNET (private endpoint & Firewall enabled). Currently that's not possible as AKS fails to create a pod due to "HTTP response status code 409 error code "RegistryErrorResponse" it receives from ACR.

[feiskyer]

@jmalkiew could you share the result for 'kubectl describe pod '? (remember to remove any credentials if there have)

[jmalkiew]

@feiskyer we had a case with Azure support opened. I can give you the case number if that will help. The conclusion was „ We double checked with ACR product engineering team what applies to ACI as limitation (https://docs.microsoft.com/en-us/answers/questions/193123/azure-aci-with-private-acr-and-selected-public-net.html) with private ACR applies with Virtual Node with AKS”. That means that if we add a firewall rule to ACR to restrict access to ACR we’ll get an error. I was asked to request an feature request.

[feiskyer]

tagged as a feature request and dependency of ACI

[ryanzhang-oss]

add e2e tests with private container images should be added to validate pulling images with secrets.