No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

You need to add a "Network Contributor" assignment to the service principal attached to your AKS.

Admin access isn't really necessary, but if you have it enabled, instead of assigning a network contributor role to the AKS service principal, you could provide a value for the `imagePullSecrets` property of a deployment.

I mean, I'm pretty sure it's a permissions issue what you're seeing, that's why I suggested the above.

For pulling the image the AZ Role is:
AcrPull

I remember having to provide permission ‘AcrPull’, explicity assigned to the SPN of the AKS cluster.

Ah, yes, my bad :disappointed: `AcrPull` is what's needed. I've quickly glanced over my code, but `Network Contributor` was used for configuring a public IP. Looking a second time now, indeed I've used `AcrPull` for pulling private images.