Your registry is Premium with public network access disabled. An AKS cluster in a peered VNet cannot pull images. What is the most likely missing piece?
- A The registry needs geo-replication enabled
- B A private endpoint plus a private DNS zone linked to the AKS VNet (correct answer)
- C The AcrPush role on the kubelet identity
- D Content Trust must be disabled
Shortcut: With public access off, pulls must traverse a private endpoint. io private DNS zone linked, otherwise the login server still resolves to the public IP and the pull fails.
With public access off, pulls must traverse a private endpoint. The AKS VNet also needs the privatelink.azurecr.io private DNS zone linked, otherwise the login server still resolves to the public IP and the pull fails.