Importing Container Images to a Private Azure Container Registry

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

✅ Enterprise: Azure

Overview

This section explains how to import Kyvos container images into a private Azure Container Registry (ACR) so they can be used securely during Kubernetes-based Kyvos deployments, instead of pulling images directly from the public Kyvos registry.

Prerequisites

Confirm the following before you begin.

Requirement	Details

Requirement	Details
Role assignment	The user or managed identity performing the import must have the built-in Container Registry Data Importer and Data Reader roles on the private registry.
CLI access	Azure CLI (`az-cli`) installed locally, or access to Azure Cloud Shell (roles pre-authenticated, no local install needed).

On this page:

1 Overview
2 Prerequisites
3 Import the Image into the Private Registry
4 Configure Kyvos to Use the Imported Images
5 Quick Reference: Required Roles

Related topics:

Import the Image into the Private Registry

Action	Command

Action	Command
Log in to Azure	`az login` — skip this step if using Cloud Shell, which is already authenticated.
Import the image	Run the command below, replacing `<PRIVATE_REGISTRY_NAME>` with your registry name.

az acr import \
  --name <PRIVATE_REGISTRY_NAME> \
  --source http://kyvosk8s.azurecr.io/kyvos-compute-worker:2024.3v1 \
  --image kyvos-compute-worker:2024.3v1

Tip

Repeat this command for each additional Kyvos image you need to import, updating the source and target image tags accordingly.

Configure Kyvos to Use the Imported Images

Once the image is available in your private registry, perform the following steps so Kyvos pulls from it correctly.

Assign the pull role: Grant the managed identity attached to the User Pool Virtual Machine Scale Set (VMSS) the built-in AcrPull role on the private registry. This allows the cluster to pull images at deployment and runtime.
Create a private endpoint: Create a Private Endpoint on the Container Registry so it can be accessed via a private IP instead of over the public internet.
Update the worker YAML: Edit the image key in the worker template file: /data/kyvos/installs/kyvosmanager_war/kyvosmanager/cloud/azure/templates/kyvos-k8s/kyvos-compute-worker-job.yaml.template and point it to your private registry name.
Reconfigure the Kubernetes cluster: In Kyvos Manager, go to the Compute Cluster page and select Reconfigure Kubernetes Cluster to apply the change.

Quick Reference: Required Roles

Identity	Role	Scope	Purpose

Identity	Role	Scope	Purpose
User / managed identity running the import	Container Registry Data Importer	Private ACR	Allows importing images into the registry
User / managed identity running the import	Container Registry Data Reader	Private ACR	Allows reading registry data during import
VMSS managed identity (User Pool)	AcrPull	Private ACR	Allows the cluster to pull images at runtime