[Az] Day 09: Synchronizing Container Images to ACR for a Private AKS Cluster Using CI/CD Pipelines.

Introduction

Deploying applications in a private AKS cluster presents unique challenges, especially when the cluster lacks direct internet access.
In such environments, the cluster cannot pull container images from public registries like Docker Hub or Quay.io.
Instead, all container images must be sourced from a private ACR accessible within the cluster's network.

To address this, we need a robust solution that not only synchronizes required images into the ACR but also integrates with Continuous Integration/Continuous Deployment (CI/CD) pipelines and adheres to Software Development Life Cycle (SDLC) best practices.
This ensures that all images are reviewed and approved before being imported, enhancing security and compliance.

Table of Contents

Implementation

By leveraging Azure DevOps CI/CD pipelines, we can automate the public image importing process as below.

1. Image Configuration File

The images.txt file lists all the container images that need to be imported into the private ACR.

Each line specifies the source image and the destination repository within the ACR, separated by =>. This format allows for easy maintenance and review of the images being imported.

Example images.txt

inline

• Source Image: The full path to the image in the public registry, including the tag.
• Destination Repository: The repository path within the ACR where the image will be imported.
• Comments: Lines starting with # are treated as comments and ignored by the script.

2. Synchronization Script

The sync-script.sh script automates the process of importing images listed in images.txt into the ACR. It reads each line of the configuration file, processes the source and destination information, and uses the Azure CLI to import the images.

View code

inline

3. Azure Pipeline

To streamline the synchronization process, we utilize a CI/CD pipeline. This pipeline is designed to automatically execute the synchronization script whenever there are updates to the images.txt file, ensuring that all container images in the ACR remain current.

View code

inline

Important Variables:

• The image-sync variable group contains the DOCKER_NAME and DOCKER_TOKEN, which are essential for accessing Docker Hub and avoiding rate limits.
• The azureSubscription with a specific Azure service connection name in Azure DevOps.
• Replace acrName with the actual name of the Azure Container Registry.

Once the pipeline completes successfully, you can verify that all images have been correctly imported into the ACR.

The imported images on ACR repositories

Conclusion

Synchronizing container images for a private AKS cluster without direct internet access requires careful planning and automation. By leveraging a combination of an image configuration file, a synchronization script, and an Azure DevOps CI/CD pipeline, we can:

• Automate the import of necessary images into a private ACR.
• Ensure that all images are reviewed and approved according to SDLC practices.
• Maintain a secure and compliant deployment environment within the private AKS cluster.

This approach not only streamlines the deployment process but also integrates seamlessly with existing development workflows, promoting efficiency and reliability in managing containerized applications.

References

• Image importing pipeline
• Azure Container Registry Documentation

Next

Day 10: Implementing a Helm Deployment CI/CD AzureDevOps Pipeline for a Private AKS Cluster.

In the next article, We will create Helm charts for nginx-ingress and cert-manager, and set up a robust CI/CD pipeline using Azure DevOps for Helm deployments to a private AKS cluster.

Thank You

Thank you for taking the time to read this guide! We hope it has been helpful. Feel free to explore further and happy coding! 🌟✨

Steven | GitHub