<p>I'm trying to deploy a Kubernetes Pod in AKS (I'm new to Kubernetes, so at this stage, I just want to create a container, deploy to Kubernetes and connect to it).</p>

<p>My Yaml file is as follows:</p>

<pre><code>apiVersion: v1
kind: Pod
spec: 
  containers:
    - name: dockertest20190205080020
      image: dockertest20190205080020.azurecr.io    
      ports:
      - containerPort: 443
metadata: 
  name: my-test
</code></pre>

<p>I've created the image in Azure Container Registry and, according to the CLI, successfully deployed it to Kubernetes.</p>

<p>After deploying, I used the following command:</p>

<pre><code>kubectl get service
</code></pre>

<p>And it tells me there is no External IP to connect to.  I then tried:</p>

<pre><code>kubectl describe pod my-test
</code></pre>

<p>Which gave the following errors:</p>

<pre><code> Events:
   Warning  Failed   4m (x2221 over 8h)  kubelet, aks-nodepool1-27401563-2  Error: ImagePullBackOff
   Normal   BackOff  0s (x2242 over 8h)  kubelet, aks-nodepool1-27401563-2  Back-off pulling image "dockertest20190205080020.azurecr.io"
</code></pre>

<p>I then tried editing the deployment:</p>

<pre><code>kubectl edit pods my-test
</code></pre>

<p>Which game me the error:</p>

<pre><code>message: 'containers with unready status: [dockertest20190205080020]'
</code></pre>

<p>I'm not a little unsure what my next diagnostic step would be.  I get the impression there's an issue with the container or the container registry, but I'm unsure how to determine what that may be.</p>

<p>What happens here (most likely) - your AKS doesnt have permissions to pull images frmo you ACR (that's the default behaviour). You need to grant those (<a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-aks#grant-aks-access-to-acr" rel="nofollow noreferrer">link</a>):</p>

<pre><code>#!/bin/bash

AKS_RESOURCE_GROUP=myAKSResourceGroup
AKS_CLUSTER_NAME=myAKSCluster
ACR_RESOURCE_GROUP=myACRResourceGroup
ACR_NAME=myACRRegistry

# Get the id of the service principal configured for AKS
CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query "servicePrincipalProfile.clientId" --output tsv)

# Get the ACR registry resource id
ACR_ID=$(az acr show --name $ACR_NAME --resource-group $ACR_RESOURCE_GROUP --query "id" --output tsv)

# Create role assignment
az role assignment create --assignee $CLIENT_ID --role acrpull --scope $ACR_ID
</code></pre>

<p>Alternative is to just use a docker login secret (that article mentions that as well).</p>

<p>Example image in ACR:
<a href="https://i.stack.imgur.com/2TVmO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2TVmO.png" alt="enter image description here"></a></p>

<p>image name would be </p>

<p>clrtacr.azurecr.io/dns:tag (or without tag for latest)</p>
