CODEWITHSUNDEEP
dockerkubernetesazure-container-serviceazure-container-registryazure-aks
Jeff
Jeff

Reputation: 12183

Getting "unauthorized: authentication required" when pulling ACR images from Azure Kubernetes Service

I followed the guide here (Grant AKS access to ACR), but am still getting "unauthorized: authentication required" when a Pod is attempting to pull an image from ACR.

The bash script executed without any errors. I have tried deleting my Deployment and creating it from scratch kubectl apply -f ..., no luck.

I would like to avoid using the 2nd approach of using a secret.

Upvotes: 4

Views: 9241

Answers (4)

Kalin Krastev
Kalin Krastev

Reputation: 648

In my case, the Admin User was not enabled in the Azure Container Registry.

I had to enable it: Go to "Container registries" page > Open your Registry > In the side pannel under Settings open Access keys and switch Admin user on. This generates a Username, a Password, and a Password2.

Upvotes: 0

gkv
gkv

Reputation: 344

In my case, I was having this problem because my clock was out of sync. I run on Windows Subsytem for Linux, so running sudo hwclock -s fixed my issue.

See this GitHub thread for longer discussion.

Upvotes: 0

Matt Woodward
Matt Woodward

Reputation: 2177

Jeff & Charles - I also experienced this issue, but found that the actual cause of the issue was that AKS was trying to pull an image tag from the container registry that didn't exist (e.g. latest). When I updated this to a tag that was available (e.g. 9) the deployment script on azure kubernetes service (AKS) worked successfully.

I've commented on the product feedback for the guide to request the error message context be improved to reflect this root cause.

Hope this helps! :)

Upvotes: 2

Charles Xu
Charles Xu

Reputation: 31452

The link you posted in the question is the correct steps for Authenticate with Azure Container Registry from Azure Kubernetes Service. I tried before and it works well.

So I suggest you can check if the service-principal-ID and service-principal-password are correct in the command kubectl create secret docker-registry acr-auth --docker-server <acr-login-server> --docker-username <service-principal-ID> --docker-password <service-principal-password> --docker-email <email-address>. And the secret you set in the yaml file should also be check if the same as the secret you created.

Upvotes: 4

Related Questions