Skip to content

feat(registry-scanner): Add initContainer to registry-scanner so that managedIdentity can be used for ACR access - #2689

Open
Layer8Err wants to merge 5 commits into
sysdiglabs:mainfrom
Layer8Err:main
Open

feat(registry-scanner): Add initContainer to registry-scanner so that managedIdentity can be used for ACR access#2689
Layer8Err wants to merge 5 commits into
sysdiglabs:mainfrom
Layer8Err:main

Conversation

@Layer8Err

Copy link
Copy Markdown

What this PR does / why we need it:

This PR adds an init container to handle the token request process on AKS using a managed identity. This is useful for teams using Azure Container Registries and AKS clusters who want to use Managed Identities instead of secrets that require rotation and secure storage.

In order to use Azure Managed Identities for ACR auth you will need to set the following values:

config:
  registryType: acr
  acr_workloadidentity: true
  registryUser: "00000000-0000-0000-0000-000000000000"

serviceAccount:
  annotations:
    azure.workload.identity/client-id: "<managed identity GUID>

customLabels:
  azure.workload.identity/use: "true"

If the registry-scanner image is able to handle the token request, an init container is not needed.

Checklist

  • Title of the PR starts with type and scope, (e.g. feat(agent,node-analyzer,sysdig-deploy):)
  • Chart Version bumped for the respective charts
  • Variables are documented in the README.md (or README.tpl in some charts)
  • Check GithubAction checks (like lint) to avoid merge-check stoppers
  • All test files are added in the tests folder of their respective chart and have a "_test" suffix

@Layer8Err
Layer8Err requested a review from a team as a code owner July 16, 2026 15:30
@github-actions

Copy link
Copy Markdown
Contributor

Hi @Layer8Err. Thanks for your PR.

After inspecting your changes someone with write access to this repo needs
to approve and run the workflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant