FestiveTechCalendar2021 - Have Yourself An Azure Container Registry

Have Yourself An
Azure Container Registry
Festive Tech Calendar 2021

whoami
• Philip Welz
• Senior Kubernetes & DevOps Engineer @ white duck
• Certified Kubernetes { A | AD | S }
• GitOps, Kubernetes & Azure
© white duck GmbH 2021
Email: Philip.Welz@whiteduck.de
Twitter: @philip_welz
LinkedIn: https://www.linkedin.com/in/philip-welz
Blog: https://philinthe.cloud

Housekeeping
• check out all the other sessions
• https://festivetechcalendar.com/
• listen and watch attentively
• Note the code word, fill out our form and win one of three white
duck merch packages
• https://festivetechcalendar.com/Home/Supporters

Agenda
• Overview
• Resilience
• Security
• Enhanced Features
• What’s to come

Overview
• fully managed and scalable container registry
• based on the open-source Docker Registry 2.0
• integrates with Azure Services like Azure AD, RBAC,
AKS, Azure Monitor, …
• pricing based on service tier and usage
• storage, build-time
• SLA backed
• integrates with Azure DevOps & GitHub

RESILIENCE

Geo-replication

Zone redundancy
• preview feature
• provides resiliency and high availability to a registry in
a specific region
• can be combined with Geo-replication, enhances both
the reliability and performance of a registry
• limitations
• ACR Tasks doesn't yet support availability zones

Zone redundancy

SECURITY

Customer managed key
• supplements default encryption at rest
with an additional encryption layer
• integrates with Azure Key Vault
• limitations
• can only be enabled on creation & can't be disabled once
enabled
• content-trust is currently not supported

Microsoft Defender for container registries
• part of Microsoft Defender for Cloud
(former Azure Security Center)
• enabled at the Subscription Level
• images are scanned on push, import or on a weekly
basis (any image that has been pulled within the last 30
days)
• limitations
• no support for Windows containers images

Microsoft Defender for Cloud

Content-trust
• #SupplyChainSecurity
• enables Docker Content-trust model to push and pull
signed images
• image publisher signs image with a digital signature
consumers can configure their clients to pull only signed
images
• limitations
• no AKS & ACI support

Private Link
• private connectivity to services on Azure
with no public internet access
• integration with on-premises and peered networks

Azure Policy
• audit compliance of Azure container
registries with built-in policy definitions
• integrates with Azure Security Benchmark
• built-in Regulatory Compliance
• FedRAMP, CMMC, HIPAA HITRUST 9.2 and more

ENHANCED FEATURES

Enhanced features
• Webhooks
• trigger events when certain
actions take place
• can be tested with az acr
webhook ping
• Tasks
• on-demand image build
• automated builds by source
code or base image updates
• schedulable

Support for further artifacts
• WebAssembly (Wasm) modules
• Open Policy Agent
• Helm Charts
• still experimental
• Helm 3.7.0 introduces some major changes
• Bicep modules (preview)
• Introduced in Bicep 0.4 for private registries

OCI
• Open Container Initiative
• OCI image spec
• JSON manifest
• OCI artifact is something
• other than an image
• stored in a registry
• that sets a custom type in the config.mediaType field

Anonymous Pull
• preview feature
• enables anonymous (unauthenticated) pull access
• can be disabled at any time
• limitations
• applies to all repositories in the registry

Connected Registry
• Preview
• available in Asia East, EU North & West and US East
• regularly synchronizes content with a cloud-based Azure container
registry
• operating modes: ReadWrite (default) & ReadOnly
• hierarchical deployment of IoT Edge
• in this architecture, the connected registries deployed on each layer are
configured to synchronize the images with the connected registry on the layer
above
• limitations:
• Number of clients for the connected registry is limited to 20

WHAT’S TO COME

What’s to come
• Project Teleport
• Notary v2

Links
• ACR Backlog
• https://github.com/Azure/acr/projects/1
• Project Teleport
• https://github.com/Azure/acr/blob/main/docs/teleport/aks-getting-started.md
• https://stevelasker.blog/2019/10/29/azure-container-registry-teleportation/
• Dan Lorenc – OCI Artifacts explained
• https://dlorenc.medium.com/oci-artifacts-explained-8f4a77945c13
• Thorsten Hans – ACR Unleashed Series
• https://www.thorsten-hans.com/azure-container-registry-unleashed-acr-up-and-
running/#the-acr-unleashed-series

FestiveTechCalendar2021 - Have Yourself An Azure Container Registry

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to FestiveTechCalendar2021 - Have Yourself An Azure Container Registry

Similar to FestiveTechCalendar2021 - Have Yourself An Azure Container Registry (20)

Recently uploaded

Recently uploaded (20)