> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Allow access to managed registries

Plerion Collector Manager needs access to private registries to scan the private images deployed in the Kubernetes cluster.

### AWS Elastic Container Registry (ECR)

#### 1. Create an IAM OIDC identity provider for your cluster.

```bash theme={"system"}
eksctl utils associate-iam-oidc-provider \
--cluster <your-cluster> \
--approve
```

#### 2. Override the existing `plerion-collector-manager` service account and attach the IAM policy to grant it permission to pull images from the ECR.

```bash theme={"system"}
export CLUSTER_NAME="<your cluster name>"

eksctl create iamserviceaccount \
  --name plerion-collector-manager \
  --namespace plerion-system \
  --cluster "${CLUSTER_NAME}" \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
  --approve \
  --override-existing-serviceaccounts
```

Please note that this command requires access to both AWS IAM and the Kubernetes cluster

* `AWS Access`: The user executing the eksctl command must have sufficient IAM permissions to create and manage IAM roles, as well as to attach policies like `AmazonEC2ContainerRegistryReadOnly`.
* `Kubernetes Access`: The same user must also have the necessary Kubernetes permissions (e.g., via `kubectl`) to manage service accounts within the specified Kubernetes namespace.

### Azure Container Registry (ACR)

#### 1. Prerequisites

Please ensure the following prerequisites are met before using the operator:

* The official steps for setting up Workload Identity on AKS can be found [here](https://azure.github.io/azure-workload-identity/docs/).

* Managed clusters or self-managed clusters installed, [see documentation](https://azure.github.io/azure-workload-identity/docs/installation.html)

* Mutating admission webhook installed, [see documentation](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html)

* `plerion-collector-manager` Upgraded to latest version (v1.1.7 or newer), [see Upgrade/Rollback](/guides/integrations/kubernetes/collector-manager/upgrade-rollbacks).

#### 2. Export the required variables in environment

```bash theme={"system"}
export RESOURCE_GROUP="<your resource group>" # replace it with your resource group name
export LOCATION="australiaeast" # replace it with the location of your cluster
export CLUSTER_NAME="<your cluster name>"
export SERVICE_ACCOUNT_NAMESPACE="default" # replace with your own value
export SERVICE_ACCOUNT_NAME="<service account name>" # replace with your own value
export AZURE_SUBSCRIPTION_ID="$(az account show --query id --output tsv)"
export AZURE_TENANT_ID="$(az account show --query tenantId --output tsv)"
export USER_ASSIGNED_IDENTITY_NAME="<your identity name>" # replace with your own value
export FEDERATED_IDENTITY_CREDENTIAL_NAME="<your own name>" # replace it with your own name
export ACR_NAME="<your acr name>" # replace it with your acr name
```

#### 3. Retrieve OIDC issuer url

[See azure documentation](https://azure.github.io/azure-workload-identity/docs/installation/managed-clusters.html) for retrieving OIDC issue url.

For AKS cluster use following command.

```bash theme={"system"}
export AKS_OIDC_ISSUER=$(az aks show --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}" --query "oidcIssuerProfile.issuerUrl" --output tsv)
```

#### 4. Create managed identity.

```bash theme={"system"}
az identity create \
  --name "${USER_ASSIGNED_IDENTITY_NAME}" \
  --resource-group "${RESOURCE_GROUP}" \
  --location "${LOCATION}" \
  --subscription "${AZURE_SUBSCRIPTION_ID}"
```

#### 5. Assign `AcrPull` IAM permissions to managed identity.

```bash theme={"system"}
export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group "${RESOURCE_GROUP}" --name "${USER_ASSIGNED_IDENTITY_NAME}" --query 'clientId' --output tsv)"
export ACR_ID=$(az acr show --name ${ACR_NAME} --query id -o tsv)

az role assignment create --assignee ${USER_ASSIGNED_CLIENT_ID} --role 'AcrPull' --scope ${ACR_ID}
```

#### 6. Create a Kubernetes service account.

```bash theme={"system"}
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    azure.workload.identity/client-id: "${USER_ASSIGNED_CLIENT_ID}"
    azure.workload.identity/tenant-id: "${AZURE_TENANT_ID}"
  name: "${SERVICE_ACCOUNT_NAME}"
  namespace: "${SERVICE_ACCOUNT_NAMESPACE}"
EOF
```

#### 7. Create federated identity.

```bash theme={"system"}
az identity federated-credential create \
 --name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} \
 --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" \
 --resource-group "${AZURE_RESOURCE_GROUP}" \
 --issuer "${AKS_OIDC_ISSUER}" \
 --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" \
 --audience api://AzureADTokenExchange
```

#### 8. Update `plerion-collector-manager` ServiceAccount to include workload identity annotations.

```bash theme={"system"}
helm upgrade plerion-collector-manager plerion/collector-manager --reuse-values \
  --namespace plerion-system \
  --set serviceAccount.annotations.'azure\.workload\.identity/client-id'=$USER_ASSIGNED_CLIENT_ID \
  --set serviceAccount.annotations.'azure\.workload\.identity/tenant-id'=$AZURE_TENANT_ID # Optional
```

#### 9. Update `plerion-collector-manager` to use `azWorkloadIdentity`

```bash theme={"system"}
helm upgrade plerion-collector-manager plerion/collector-manager --reuse-values \
  --namespace plerion-system \
  --set collector.azWorkloadIdentity=true
```

#### 10. Update service account for `plerion-collector-manager`.

```bash theme={"system"}
kubectl set serviceaccount deployment plerion-collector-manager $SERVICE_ACCOUNT_NAME
```