<p>I'm suddenly having issues pulling the latest image from Azure container registry with AKS (which previously worked fine.</p>

<p>If I run</p>

<pre><code>kubectl describe pod &lt;podid&gt; I get:


Failed to pull image &lt;image&gt;: rpc error: code = Unknown desc = Error response from daemon: Get &lt;image&gt;: unauthorized: authentication required
</code></pre>

<p>I've tried logging into the ACR manually and it's all working correctly - the new images have pushed correctly and I can pull them manually.</p>

<p>Moreover I've tried:</p>

<pre><code>az aks update -g MyResourceGroup -n MyManagedCluster --attach-acr acrName
</code></pre>

<p>Which succeeds (no errors, there is an output propagation being successful) but it still doesn't work.</p>

<p>I've tried updating the credentials with:</p>

<pre><code>az aks update-credentials --resource-group &lt;group&gt;--name &lt;aks name&gt;--reset-service-principal --service-principal &lt;sp id&gt; --client-secret &lt;client-secret&gt;
</code></pre>

<p>Which spits out a rather weird message:</p>

<pre><code>Deployment failed. Correlation ID: 6e84754a-821d-4a39-a0df-7ab9ba21973f. 
Unable to get log analytics workspace info. Resource ID: 
/subscriptions/&lt;subscription id&gt;/resourcegroups/defaultresourcegroup- 
weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace- 
d259e6ea-8230-4cb0-a7a8-7f0df6c7ef18-weu. Details: autorest/azure: Service 
returned an error. Status=404 Code="ResourceGroupNotFound" 
Message="Resource group 'defaultresourcegroup-weu' could not be found.". For 
more details about how to create and use log analytics workspace,  please 
refer to: https://aka.ms/new-log-analytics
</code></pre>

<p>I tried creating a new log analytics workspace and the error above persisted.</p>

<p>I've also tried steps from:</p>

<p><a href="https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication#service-principal" rel="nofollow noreferrer">This link</a></p>

<p><a href="https://stackoverflow.com/questions/49639280/kubernetes-cannot-pull-image-from-private-docker-image-repository">This SO post</a></p>

<p><a href="https://stackoverflow.com/questions/55574059/failed-to-pull-image-xx-azurecr-io-xxlatest-rpc-error-code-unknown-desc">As well as this post</a></p>

<p>Besides the the posts above, I've gone through many tutorials and Microsoft pages to try fix the problem.</p>

<p>I've tried creating a new service principal and assigning it the appropriate roles but the error still persists.
I've also dabbled with creating new secrets and had no success.</p>

<p>My pods that don't need new images are all running as expected.
If I look at my app registrations (under azure active directory) they were all created a year ago - so I'm concerned something expired and I don't know how to fix it.</p>

adrian
<p>there are two ways to get this sorted</p>

<ol>
<li>Map the ACR to AKS</li>
</ol>

<hr>

<pre><code>CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name 
$AKS_CLUSTER_NAME --subscription $SUBSCRIPTION_ID --query "servicePrincipalProfile.clientId" --output tsv)

ACR_ID=$(az acr show --name $ACR_NAME --resource-group $ACR_RESOURCE_GROUP --subscription $SUBSCRIPTION_ID --query "id" --output tsv)

az role assignment create --assignee $CLIENT_ID --role Reader --scope $ACR_ID
</code></pre>

<hr>

<p>other way is to add the Image pull secret, which will be of type kubernetes.io/dockerconfigjson</p>

<p>this can be done by -</p>

<pre><code>kubectl create secret docker-registry regcred --docker-server=&lt;your-registry-server&gt; --docker-username=&lt;your-name&gt; --docker-password=&lt;your-pword&gt; --docker-email=&lt;your-email&gt;
</code></pre>

<hr>

<p>Then you can refer this secret as imagePullSecret in the deployment files and the authentication error shall not be there</p>
