【Azure容器注册表】面向公众的Azure容器注册表参考架构

Architecture

 

Components

This solution uses the following components:

• Azure Key Vault: Key Vault is provisioned for storing sensitive values and keys used specifically for on-premises systems like build pipeline and user registration application to access ACR API and function App to publish data to on-premises applications.
• Azure App Gateway: Azure App Gateway with WAF v2 is used to load balance and route traffic to Azure Container registry and provide Layer 7 connectivity to authenticate/authorize customer applications and download container images.
• Container registry: The container images for the workload are stored in a managed container registry. In this architecture, a single Azure Container Registry is used for all Kubernetes instances in the cluster. Geo-replication for Azure Container Registry enables replicating images to the selected Azure regions and providing continued access to images even if a region is experiencing an outage.
• Log Analytics: Regional Log Analytics instances are used for storing regional networking metrics and diagnostic logs. Additionally, a shared Log Analytics instance is used to store metrics and diagnostic logs for the ACR instance.
• Logging and threat detection: Microsoft Defender for Cloud built-in threat detection capability for Container Registry provides another layer of security intelligence. It detects unusual and potentially harmful attempts to access or exploit the Container Registry resources.
• Azure Functions: Azure Functions serves as the processing engine to manage the life cycle of container images in ACR. These functions also process specific logs and monitor security events and notify security and monitoring operations control via Azure Event Hubs.
• Kubernetes Cluster: Kubernetes Cluster is a consuming application cluster deployed by consumers of the hosted container images in Azure Container Registry.
• Hybrid Cloud Networking: Host the applications and tools (DevOps) used by developers to create container images and publish them to Azure Container Registry. Gateway Network is implemented to provide a secure communication layer between on-premises applications and applications hosted in Azure.

Azure Resources Configuration

When deploying this architecture, ensure that the following configurations are set properly.

 

Azure Container Registry

 

Overview

The Azure Container Registry (ACR) must be set to private access, so that all public requests flow through the Application Gateway.

1. Rewrite Location Header: 

   The 'Rewrite Location Header' rule rewrites the 'Location' header in the HTTP response that matches ACR endpoint to the registry/login endpoint of the app gateway when the status code is 302.
   • Add a condition to evaluate whether the location header in the response contains the Azure Container Registry endpoint,  contososecurepublicacr.azurecr.io in this example:
     
     1. Select Add condition and then select the box containing the If instructions to expand it.
     2. In the Type of variable to check list, select HTTP header.
     3. In the Header type list, choose Response Header.
     4. Select Common header under Header name.
     5. In the Common header list, select Location.
     6. Under Case-sensitive, select No.
     7. In the Operator list, select equal (=).
     8. Enter the regular expression pattern: https:\/\/contososecurepublicacr.azurecr.io(.*)$, and make sure to substitute 'contososecurepublicacr.azurecr.io' with your ACR instance endpoint.
     9. Select OK

        
        

         

   • Add an action to rewrite the location header:
      
     1. In the Rewrite type list, select Response Header.
     2. In the Action type list, select Set.
     3. Under Header name, select Common header.
     4. In the Common header list, choose Location.
     5. Use https://acr-secure.contoso.com{http_resp_Location_1} as the header value, and be sure to substitute 'acr-secure.contoso.com' with your custom domain endpoint. This action replaces contososecurepublicacr.azurecr.io with acr-secure.contoso.com in the location header.
     6. Select OK.

        
        

         

2. Rewrite WWW-Authenticate Header:

   The 'Rewrite WWW-Authenticate Header' rule modifies the 'WWW-Authenticate' header in the HTTP response that matches ACR endpoint to the registry/login endpoint of the app gateway when the status code is 401.

   • Add a condition to evaluate whether the WWW-Authenticate header in the response contains the Azure Container Registry endpoint, contososecurepublicacr.azurecr.io/oauth2/token in this case:
     1. Select Add condition and then chooses the box containing the If instructions to expand it.
     2. In the Type of variable to check list, select HTTP header.
     3. In the Header type list, choose Response.
     4. In the Header name, select Common header.
     5. In the Common header list, choose WWW-Authenticate.
     6. Under Case-sensitive, select No.
     7. In the Operator list, select equal (=).
     8. Enter the regular expression pattern: ^(.*)https:\/\/contososecurepublicacr.azurecr.io\/oauth2\/token(.*)$, and make sure to replace 'contososecurepublicacr.azurecr.io' in the pattern with your custom domain endpoint.
     9. Select OK

        
        

         

   • Add an action to rewrite the WWW-Authenticate header:
     1. In the Rewrite type list, select Response Header.
     2. In the Action type list, choose Set.
     3. Under Header name, select Common header.
     4. In the Common header list, choose WWW-Authenticate.
     5. Specify the header value: {http_resp_WWW-Authenticate_1}https://acr-secure.contoso.com/oauth2/token{http_resp_WWW-Authenticate_2}, and be sure to substitute 'acr-secure.contoso.com' with your custom domain endpoint. This action rule replaces contososecurepublicacr.azurecr.io with acr-secure.contoso.com in the WWW-Authenticate header.
     6. Select OK.

        
        

         

3. Rewrite Data Location Header:

   The 'Rewrite Data Location Header' rule rewrites the 'Location' header in the HTTP Response that matches the ACR data endpoint to the data endpoint of the app gateway when the status code is 302.
   • Add a condition to evaluate whether the location header in the response contains contososecurepublicacr.eastus.data.azurecr.io:
     1. Select Add condition and then choose the box containing the If instructions to expand it.
     2. In the Type of variable to check list, select HTTP header.
     3. In the Header type list, choose Response Header.
     4. Select Common header under Header name.
     5. In the Common header list, choose Location.
     6. Under Case-sensitive, select No.
     7. In the Operator list, select equal (=).
     8. Enter the regular expression pattern: https:\/\/contososecurepublicacr.eastus.data.azurecr.io(.*)$, and make sure to substitute 'contososecurepublicacr.eastus.data.azurecr.io' with your ACR instance data endpoint url.
     9. Select OK

        
        

         

   • Add an action to rewrite the location header:
      
     1. In the Rewrite type list, select Response Header.
     2. In the Action type list, choose Set.
     3. Under Header name, select Common header.
     4. In the Common header list, choose Location.
     5. Specify the header value: https://acr-secure-data.contoso.com{http_resp_Location_1}, and make sure to substitute 'acr-secure-data.contoso.com' with your custom domain data endpoint. This action effectively replaces contososecurepublicacr.eastus.data.azurecr.io with acr-secure-data.contoso.com in the location header.
     6. Select OK.

        
        

         

Overview