AKS "ImagePullBackOff ... ACR not authorized" in CI
After kubectl apply, the AKS pod stays in ImagePullBackOff because the kubelet could not pull the image from ACR. The cluster identity has no AcrPull permission, or the cluster was never attached to the registry.
What this error means
kubectl get pods shows ImagePullBackOff/ErrImagePull, and describe shows "401 Unauthorized" or "unauthorized: authentication required" pulling from <name>.azurecr.io.
Failed to pull image "myacr.azurecr.io/api:abc123": failed to authorize:
failed to fetch oauth token: unexpected status from GET request to
https://myacr.azurecr.io/oauth2/token...: 401 Unauthorized
Warning Failed kubelet Error: ImagePullBackOffCommon causes
The cluster is not attached to the registry
AKS pulls from ACR using the cluster (kubelet) identity. If the cluster was never attached to the ACR, that identity has no AcrPull and the pull is unauthorized.
No imagePullSecret for a non-attached registry
For a registry not integrated with the cluster identity, the deployment needs an imagePullSecret that was not configured.
How to fix it
Attach the cluster to the ACR
- Attach the AKS cluster to the registry so the kubelet identity gets AcrPull.
- Delete the stuck pods so they re-pull.
- Confirm the pods reach Running.
az aks update --resource-group rg --name my-aks --attach-acr myacrOr grant AcrPull to the kubelet identity
If you cannot attach, grant AcrPull to the cluster managed identity on the registry scope.
az role assignment create \
--assignee "$KUBELET_OBJECT_ID" --role AcrPull \
--scope $(az acr show -n myacr --query id -o tsv)How to prevent it
- Attach the AKS cluster to its ACR at provisioning time.
- Grant AcrPull to the kubelet identity, not just the push identity.
- Reference image tags that were actually pushed to the attached registry.