azure - 无法将 Azure 容器注册表附加到 Azure kubernetes 服务

Question

尝试将 ACR 连接到 azure 中的 AKS，但得到

Could not create a role assignment for ACR. Are you an Owner on this subscription?

以下是我遵循的步骤:

1. 登录:az login
2. 要移动 servicePrincipal.json:az ad sp create-for-rbac --skip-assignment
3. 获取服务主体对象 ID:az ad sp list --display-name acrrgdevfahim并从结果中获取 id:

{
  "appId": "18843c4f-b406-4f0d-9fa3-219058a0f23a",
  "displayName": "azure-cli-2023-03-12-09-56-37",
  "password": "ACQ8Q~Oh.3_R~nqlqtek0ndYeOAAzJg6njU9mbi2",
  "tenant": "8aa57581-5266-4503-a692-a10815c0a5a6"
}
fahimhoque@Arnob ~ % az ad sp list --display-name acrrgdevfahim
[
  {
    "accountEnabled": true,
    "addIns": [],
    "alternativeNames": [
      "isExplicit=False",
      "/subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourcegroups/RG-dev/providers/Microsoft.ContainerRegistry/registries/acrrgdevfahim"
    ],
    "appDescription": null,
    "appDisplayName": null,
    "appId": "6b19686e-30f0-4805-806f-c4ca9ed8bbd4",
    "appOwnerOrganizationId": null,
    "appRoleAssignmentRequired": false,
    "appRoles": [],
    "applicationTemplateId": null,
    "createdDateTime": "2023-03-12T06:54:39Z",
    "deletedDateTime": null,
    "description": null,
    "disabledByMicrosoftStatus": null,
    "displayName": "acrrgdevfahim",
    "homepage": null,
    "id": "c465e0ec-dba8-4783-bbff-ee9944a69763",
    "info": null,
    "keyCredentials": [
      {
        "customKeyIdentifier": "4E9BFDB4314ADD4B76713CE558593C75874AD534",
        "displayName": "CN=6b19686e-30f0-4805-806f-c4ca9ed8bbd4",
        "endDateTime": "2023-06-10T06:49:00Z",
        "key": null,
        "keyId": "661bb2e7-d8d1-41b8-980d-7728875554b2",
        "startDateTime": "2023-03-12T06:49:00Z",
        "type": "AsymmetricX509Cert",
        "usage": "Verify"
      }
    ],
    "loginUrl": null,
    "logoutUrl": null,
    "notes": null,
    "notificationEmailAddresses": [],
    "oauth2PermissionScopes": [],
    "passwordCredentials": [],
    "preferredSingleSignOnMode": null,
    "preferredTokenSigningKeyThumbprint": null,
    "replyUrls": [],
    "resourceSpecificApplicationPermissions": [],
    "samlSingleSignOnSettings": null,
    "servicePrincipalNames": [
      "6b19686e-30f0-4805-806f-c4ca9ed8bbd4",
      "https://identity.azure.net//ob5N0+Wkcw9erM4VGKOVJ1T/5bYaBWcqVa1x47nLZo="
    ],
    "servicePrincipalType": "ManagedIdentity",
    "signInAudience": null,
    "tags": [],
    "tokenEncryptionKeyId": null,
    "verifiedPublisher": {
      "addedDateTime": null,
      "displayName": null,
      "verifiedPublisherId": null
    }
  }
]

分配拉取权限 az role assignment create --assignee-object-id c465e0ec-dba8-4783-bbff-ee9944a69763 --scope /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourceGroups/RG-dev/providers/Microsoft.ContainerRegistry/registries/acrrgdevfahim --role acrpull

最后:az aks update -n aksclusterfahim -g RG-dev --attach-acr acrrgdevfahim

给出结果:

Could not create a role assignment for ACR. Are you an Owner on this subscription?

现在，从我的订阅页面中的门户，我可以看到自己被标记为订阅的所有者。我该如何解决这个问题？

更新1:

对这两个查询进行进一步调查:

1. az role assignment list --all --include-classic-administrators --query "[?principalName=='<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="fa9c92958b8f9fd49b88949598ba958f8e96959591d4999597" rel="noreferrer noopener nofollow">[email protected]</a>']"结果:[]

2. az role assignment list --all --output table

结果:

    Role         Scope
    ----------------------------------------------------------------  -----------  ---------------------------------------------------------------------------------------------------------------------------------------- fhoque.arnob_outlook.com#EXT#@fhoquearnoboutlook.onmicrosoft.com 
    Owner        /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4
    a48be5d4-727b-444b-99d9-e8b03ab75c16                             
    Contributor 
    /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourceGroups/MC_RG-dev_aksclusterfahim_centralindia
    fhoque.arnob_outlook.com#EXT#@fhoquearnoboutlook.onmicrosoft.com 
    Owner       
    /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourceGroups/RG-dev
    c119ef5d-7f74-4a5d-a83d-dfae0bbbca61                             
    AcrPull     
    /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourceGroups/RG-dev/providers/Microsoft.ContainerRegistry/registries/acrrgdevfahim
    6b19686e-30f0-4805-806f-c4ca9ed8bbd4                             
    AcrPull     
    /subscriptions/45f28bb3-dd53-47e9-b42b-38a49f7a8ec4/resourceGroups/RG-dev/providers/Microsoft.ContainerRegistry/registries/acrrgdevfahim
   

Answer 1

我尝试在我的环境中重现相同的结果，并得到如下结果:

尝试在 Windows powershell ISE 中运行以下 cmd，以验证您是否拥有使用 CLI 创建角色分配所需的权限，如下所示:

Az login 
az role assignment list --all --include-classic-administrators --query "[?principalName=='<your-email-address>']"

在Azure Active Directory中 -> 应用程序注册 -> 尝试添加服务主体，如下所示:

要检查现有的服务主体:

az role assignment list --all --assignee <service-principal-object-id>

请务必检查注册表 ID

az acr show --name <ACRName> --query id --output tsv

当我尝试分配向服务主体授予必要的权限时，它成功分配角色如下:

az role assignment create --assignee <service-principal-object-id> --scope <RegistryID> --role AcrPull

要将 ACR 连接到 AKS 群集，请使用以下命令:

#Attach using acr-name
az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acr-name>

在门户中确认Acrpull角色分配如下:

为了验证 ACR 和 AKS 之间的连接，我在 ACR 中创建了一个存储库，并在 kubectl 部署中引用了该镜像。已成功拉取镜像，启动并运行。

引用:

Integrate Azure Container Registry with Azure Kubernetes Service - Azure Kubernetes Service | Microsoft Learn