Onboarding Azure Container Registry

1. In the CloudGuard portal, navigate to Asset > Environments.

2. From the top menu, select Add > Container Registry and follow the setup steps.

3. In the Container Registry Onboarding wizard, enter the registry details:

   1. Environment Name - Enter a new name for the registry or use the default name. This name allows you to identify the registry later in CloudGuard.

   2. Environment Description - Optionally, enter a description.

   3. Select an Organizational Unit.

   4. Select the type of environment to host your scanner - Kubernetes or AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. ECS Scanner.

   5. Select a Kubernetes cluster or an AWS environment on which you can run the registry scanner:

      • For Kubernetes, select from the list of clusters with enabled Image Assurance. For a new cluster, click Onboard a new Kubernetes Cluster and see Onboarding Kubernetes Clusters. In this case, you quit the registry onboarding and, after onboarding a new cluster, you need to start the registry onboarding from the beginning.

      • For AWS, select from the list of all AWS environments onboarded to CloudGuard.

   6. Choose Registry type - Select Azure Container Registry (ACR).

   7. Registry URI - Enter the approved endpoint name of your Azure Registry in <acrName>.azurecr.io format.

   8. Authentication Method - For more information, see the Azure documentation in More Links.

      • Azure Service Principal

        1. Pull Secret Name - Create an image pull secret in the same namespace where the Image Assurance agents are deployed and enter it in this field.

           Make sure that the <secret-name> is a valid Kubernetes name. For more details, see the Kubernetes Documentation.

           To create the secret, run:

           Copy

           kubectl create secret docker-registry <secret-name> \
               --namespace <namespace> \
               --docker-server=<container-registry-name>.azurecr.io \
               --docker-username=<service-principal-ID> \
               --docker-password=<service-principal-password>
           

        2. Tenant ID - Enter your Azure AD tenant ID.

           To get the tenant ID, run:

           Copy

           az account list --query [].tenantId --output tsv
           

      • Azure Managed User Identity

        • Application client ID - Enter the ID.

          To get the Application client ID, run:

          az aks show --resource-group <resource-group> --name <cluster-name> --query identityProfile.kubeletidentity.clientId --output tsv

          Note - Make sure that the role has the permissions to pull from the registry (AcrPull). For this, use the check-acr command (see https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-check-acr).

4. Click Next to continue with Cluster Configurations.

In this step, you configure the CloudGuard Service Account credentials if in Step 1 you selected to onboard with a new cluster or with the existing cluster that requires an agent update.

For onboarding with the hosting cluster that has updated agents, this step is skipped.

1. Configure a Service Account by one of these methods:

   • Select an existing Service Account with its corresponding API Key.

   • Enter a Service Account manually.

   • Click Add Service Account to create a new account.

2. Click Next to continue to the next step.