The Azure Container Registry (ACR) team is rolling out the preview of repository scoped role-based access control (RBAC) permissions, our top-voted item on UserVoice. In this release, we have a command-line interface (CLI) experience for you to try and provide feedback.
ACR already supports several authentication options using identities that have role-based access to an entire registry. However, for multi-team scenarios, you might want to consolidate multiple teams into a single registry, limiting each team’s access to their specific repositories. Repository scoped RBAC now enables this functionality.
Here are some of the scenarios where repository scoped permissions might come in handy:
Limit repository access to specific user groups within your organization. For example, provide write access to developers who build images that target specific repositories, and read access to teams that deploy from those repositories.
Provide millions of IoT devices with individual access to pull images from specific repositories.
Provide an external organization with permissions to specific repositories.
In this release, we have introduced tokens as a mechanism to implement repository scoped RBAC permissions. A token is a credential used to authenticate with the registry. It can be backed by username and password or Azure Active Directory(AAD) objects like Azure Active Directory users, service principals, and managed identities. For this release, we have provided tokens backed by username and password. Future releases will support tokens backed by Azure Active Directory objects like Azure Active Directory users, service principals, and managed identities. See Figure 1.
*Support for Azure Active Directory (AAD) backed token will be available in a future release.
Figure 1
Figure 2 below describes the relationship between tokens and scope-maps.
A token is a credential used to authenticate with the registry. It has a permitted set of actions which are scoped to one or more repositories. Once you have generated a token, you can use it to authenticate with your registry. You can do a docker login using the following command:
docker login –username mytoken –password-stdin myregistry.azurecr.io.
A scope map is a registry object that groups repository permissions you apply to a token. It provides a graph of access to one or more repositories. You can apply scoped repository permissions to a token or reapply them to other tokens. If you don’t apply a scope map when creating a token, a scope map is automatically created for you, to save the permission settings.
A scope map helps you configure multiple users with identical access to a set of repositories.
Figure 2
As customers use containers and other artifacts for their IoT deployment, the number of devices can grow into the millions. In order to support the scale of IoT, Azure Container Registry has implemented repository based RBAC, using tokens (figure 3). Tokens are not a replacement for service principals or managed identities. You can add tokens as an additional option providing scalability of IoT deployment scenarios.
This article shows how to create a token with permissions restricted to a specific repository within a registry. With the introduction of token-based repository permissions, you can now provide users or services with scoped and time-limited access to repositories without requiring an Azure Active Directory identity. In the future, we will support tokens backed by Azure Active Directory objects. Check out this new feature and let us know your feedback on GitHub.
Figure 3
Availability and feedback
Azure CLI experience is now in preview. As always, we love to hear your feedback on existing features as well as ideas for our product roadmap.
Roadmap: For visibility into our planned work.
UserVoice: To vote for existing requests or create a new request.
Issues: To view existing bugs and issues, or log new ones.
ACR documents: For ACR tutorials and documentation.
