add AKS permissions over the ACR

terraform/main.tf

@@ -109,6 +109,8 @@ module "azure_aks_pr" {
     module.azuread_applications.identity_2
   ]
 
+  azure_container_registry_id = module.acr_proxy.id
+
   tags = local.tags
 }
 
@@ -132,6 +134,8 @@ module "azure_aks_nightly" {
     module.azuread_applications.identity_2
   ]
 
+  azure_container_registry_id = module.acr_proxy.id
+
   tags = local.tags
 }
 

terraform/modules/azure/aks/main.tf

@@ -56,6 +56,16 @@ resource "azurerm_kubernetes_cluster" "aks" {
   }
 }
 
+## ACR Permissions
+
+resource "azurerm_role_assignment" "kubweb_to_acr" {
+  scope                = var.azure_container_registry_id
+  role_definition_name = "AcrPull"
+  principal_id         = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
+}
+
+## Workload Identity Federation
+
 resource "azurerm_federated_identity_credential" "msi_federation" {
   count               = length(var.workload_identity_applications)
   name                = "msi_federation-${local.cluster_full_name}-${var.workload_identity_applications[count.index].name}"

terraform/modules/azure/aks/vars.tf

@@ -36,6 +36,11 @@ variable "node_resource_group_name" {
   description = "AKS nodes resource group name"
 }
 
+variable "azure_container_registry_id" {
+  type        = string
+  description = "Azure Container Registry ID"
+}
+
 variable "default_node_pool_count" {
   type        = number
   default     = 3

terraform/modules/azure/registry/outputs.tf

@@ -0,0 +1,3 @@
+output "id" {
+  value = azurerm_container_registry.acr.id
+}