ACR

구조

acraz01comm.azurecr.io
├── commonhub/nginx         → Pull-through Cache (공통 Base Image)
├── commonhub/ubuntu         → Pull-through Cache (공통 Base Image)
├── commonhub/python         → Pull-through Cache (공통 Base Image)

commonhub 설정

ACR 생성

az acr create \
  --name acraz01comm \
  --resource-group rg-az01-prd-common-01 \
  --sku Premium \
  --location koreacentral \
  --admin-enabled false

ACR Pull 권한 부여

az role assignment create \
  --assignee f636c73e-3406-41be-8954-a968767bae31 \
  --role AcrPull \
  --scope /subscriptions/9f3e1937-23f1-4460-b49c-804126c44b08/resourceGroups/rg-az01-prd-common-01/providers/Microsoft.ContainerRegistry/registries/acraz01comm

Keyvault 설정 - docerhub 접근하기위한 자격증명

1. keyvault 사용

az provider register --namespace Microsoft.KeyVault

2. ketvault 생성

az keyvault create --name kv-common-dockerhub-01 --resource-group rg-az01-prd-common-01 --location koreacentral

3. user/password 등록

az keyvault secret set --vault-name kv-common-dockerhub-01 --name dockerhub-username --value ktdscm

az keyvault secret set --vault-name kv-common-dockerhub-01 --name dockerhub-password --value KTP@ssw0rd123

4. keyvault 권한 부여

az role assignment create \
  --assignee 507ee1f3-65f8-4458-ab5c-629fad95cb10 \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/9f3e1937-23f1-4460-b49c-804126c44b08/resourceGroups/rg-az01-prd-common-01/providers/Microsoft.KeyVault/vaults/kv-common-dockerhub-01

5. acr credential 생성

az acr credential-set create \
  --registry acraz01comm \
  --name dockerhub-credset \
  --login-server docker.io \
  --username https://kv-common-dockerhub-01.vault.azure.net/secrets/dockerhub-username \
  --password https://kv-common-dockerhub-01.vault.azure.net/secrets/dockerhub-password

6. 권한 부여

az role assignment create \
  --assignee 613f136c-a3c5-4fc1-9339-13fe1de01427 \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/9f3e1937-23f1-4460-b49c-804126c44b08/resourceGroups/rg-az01-prd-common-01/providers/Microsoft.KeyVault/vaults/kv-common-dockerhub-01

7. ACR 캐시 등록

Name	Source	Target Repo	Credential Set
cache-ubuntu	docker.io/library/ubuntu	commonhub-ubuntu	dockerhub-credset
cache-alpine	docker.io/library/alpine	commonhub-alpine	dockerhub-credset
cache-python	docker.io/library/python	commonhub-python	dockerhub-credset
cache-nginx	docker.io/library/nginx	commonhub-nginx	dockerhub-credset
cache-openjdk	docker.io/library/openjdk	commonhub-openjdk	dockerhub-credset
cache-busybox	docker.io/library/busybox	commonhub-busybox	dockerhub-credset
cache-redis	docker.io/library/redis	commonhub-redis	dockerhub-credset
cache-postgres	docker.io/library/postgres	commonhub-postgres	dockerhub-credset

service 별 ACR 생성

ACR 생성

az acr create \
  --name acraz01service \
  --resource-group rg-az01-prd-common-01 \
  --sku Premium \
  --location koreacentral \
  --admin-enabled false

권한부여

az role assignment create \
  --assignee <Project01_Group_ObjectID> \
  --role AcrPush \
  --scope /subscriptions/<SubscriptionID>/resourceGroups/rg-az01-prd-common-01/providers/Microsoft.ContainerRegistry/registries/acrproject01