Question

Your team maintains an Azure Pipelines YAML pipeline that builds a Docker image and pushes it to a private Azure Container Registry (ACR), then deploys it to Azure Kubernetes Service (AKS). Currently the pipeline stores the ACR admin username and password as pipeline secret variables. Security has flagged that the ACR admin account is enabled and long-lived credentials are being used. You must eliminate stored registry credentials while allowing the pipeline to push images to ACR, following least-privilege and Microsoft-recommended practices. What should you do?

Accepted Answer

Create an Azure Resource Manager service connection using a workload identity federation (service principal), grant it the AcrPush role on the registry, and use the Docker task with that service connection.

Answer

Rotate the ACR admin credentials on a monthly schedule using a scheduled pipeline and store the new values in Azure Key Vault referenced as secret variables.

Answer

Generate an ACR repository-scoped token with push permissions and store the token password as a secret variable in a variable group.

Answer

Enable anonymous pull on the registry and continue using the admin account only for pushes during the build stage.