AKS ChartPullError from ACR

[Romer Ventura (romerve)]

Hi,

I'm having some issues with fluxcd configs using az k8s-configuration flux or the Azure Portal is unable to pull charts stored in an attached Azure Container Registry. The flux configuration is in a namespace other than flux-system, and when pulling the chart it generated a ChartPullError with the following messsage:

Message:               
chart pull error: 
  chart pull error: failed to get chart version for remote reference: 
    GET "https://<MYACR>.azurecr.io/v2/azure-voting/tags/list": 
    GET "https://<MYACR>.azurecr.io/oauth2/token?scope=repository%!A(MISSING)azure-voting%!A(MISSING)metadata_read%!C(MISSING)pull&service=<MYACR>.azurecr.io": 
  unexpected status code 401: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.

Az aks check-acr shows all is good and able to pull images, and issuing helm install succeeds and application works.

The only way i can get this to work it's to create a docker-registry secret in the namespace and reference it in the HelmRepository definition:

---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: <MYACRNAME>
spec:
  interval: 5m
  type: "oci"
  url: oci://<MYACR>.azurecr.io/charts
  secretRef:
    name: <MYACR-SECRET>

So the question is: Should entire cluster, regardless of namespace, be able to pull charts from attached ACRs? I would expect that since it is attached, i should be able to pull images and charts without additional configuration..

AKS: 1.23.5
fluent-bit: 1.2.0
flux: v0.31.1
fluxconfig-agent: 1.2.0
fluxconfig-controller: 1.2.0
helm-controller: v0.22.1
image-automation-controller: v0.23.2
image-reflector-controller: v0.19.1
kustomize-controller: v0.26.1
notification-controller: v0.24.0
source-controller: v0.25.5

[Jonathan Innis (jonathan-innis)]

To clarify, Romer Ventura (@romerve) , you have enabled AKS chart to have an attached ACR integration and this is not working as expected as shown here? https://docs.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli

[Romer Ventura (romerve)]

It works as expected when pulling images, however, when using flux to pull charts from the same ACR it fails as mentioned above.