<p>How can we pull ACR images from gov Cloud if we are working in commercial cloud?</p>

Aditya Purusharthi
<p>You should be able to accomplish this using <em>token</em> authentication against your ACR.  Be advised though that this is currently a preview feature and requires the <strong>Premium</strong> SKU for ACR.  Having said that, here are the steps:</p>
<ol>
<li><p><a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-repository-scoped-permissions" rel="nofollow noreferrer">Generate an authentication token</a> for your ACR in Azure Government, specifying <code>_repositories_pull</code> for the scope map.  Make sure to generate the password too.  You can do this after you create the token - just click on the token in the portal and there will be an option to generate a password.</p>
</li>
<li><p>After you generate the password, copy the <em>Docker login command</em> that is generated.  It will look something like <code>docker login -u token1 -p 3AP3Gf...wJ &lt;youracr&gt;.azurecr.us</code></p>
</li>
<li><p>From your terminal, where you have access to your AKS cluster in commercial, login to docker using the docker command from #2.  Note: you will probably have to run this as <code>sudo</code>.  This will generate a file at <code>~/.docker/config.json</code> that contains the password to authenticate to your ACR in Azure Gov.</p>
</li>
<li><p>Use the <code>config.json</code> from #3 to <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials" rel="nofollow noreferrer">create a secret based on existing Docker credentials in your cluster</a>.</p>
</li>
<li><p>Finally, use an <code>imagePullSecret</code> in your pod spec to use the secret you generated in #4.  Also, be sure to update your <code>image</code> to reference the full path of your container image in ACR.  <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret" rel="nofollow noreferrer">Example here</a>.</p>
</li>
</ol>
