AKS cannot pull tugboat images because someone pasted the Azure Container Registry admin password into a Kubernetes secret. How should the security engineer fix registry access?
Select an answer to reveal the explanation.
Short Explanation
Paste-the-admin-password into a Secret is how tugboat images get stuck. Give the kubelet managed identity AcrPull (or today’s reader roles) and leave the ACR admin user out of production pulls.
Full Explanation
AKS should authenticate to Azure Container Registry using Microsoft Entra ID and Azure RBAC—typically by assigning AcrPull or current ABAC-equivalent repository reader roles to the cluster kubelet managed identity—rather than storing the ACR admin password in a Kubernetes secret. Private Endpoint can support private connectivity but does not by itself grant pull authorization. Anonymous pull and shared admin passwords are not the managed identity access pattern this bullet tests.