You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use the automatically generated…

To authorize an Azure identity, such as the service principal used by an Azure Kubernetes Service (AKS) cluster, to access an Azure resource like an Azure Container Registry (ACR), you must use Azure Role-Based Access Control (RBAC). The correct procedure is to create a role assignment. This assignment links the identity (the AKS service principal), a role definition that specifies permissions (e.g., AcrPull), and the scope (the specific ACR instance). This grants the AKS identity the required permissions to pull container images from the registry without managing explicit credentials like passwords or keys.

A. an Azure AD user: An Azure AD user is an identity for a person. The question requires using the AKS cluster's non-human service principal identity.

B. a secret in Azure Key Vault: While Key Vault stores secrets, it does not grant permissions. The fundamental step is to assign a role to the service principal to authorize its access.

C. an Azure AD group: Creating a group is for managing identities, but it does not grant permissions on its own. A role assignment would still be required for the group.

1. Microsoft Docs

"Authenticate with Azure Container Registry from Azure Kubernetes Service": This document explicitly states the procedure. Under the section "Configure ACR integration for existing AKS clusters

" it details the process for service principals: "To grant the service principal access to your ACR

you need to assign a role to the service principal for your ACR." It then provides the az role assignment create command as the solution.

Source: https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli#configure-acr-integration-for-existing-aks-clusters

2. Microsoft Docs

"What is Azure role-based access control (Azure RBAC)?": This document defines the core components of Azure RBAC. It explains

"A role assignment is the process of attaching a role definition to a user

group

service principal

or managed identity at a particular scope for the purpose of granting access." This confirms that a role assignment is the object you create to grant access.

Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview#role-assignments

3. Microsoft Docs

"Azure Container Registry roles and permissions": This page lists the built-in roles for ACR

such as AcrPull. It clarifies that these roles are assigned to "a user

group

service principal

or managed identity to grant them permissions to ACR." This reinforces that a role assignment is the mechanism to apply these permissions.

Source: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=portal#assign-roles