Just looking for some generic opinion.
When creating a hub and spoke setup in Azure, if each spoke will run container apps that need to pull from a private ACR, would it be best to place the ACR directly in the hub (where all spokes will be peered to) or in a dedicated spoke (which will be peered with the hub, but not to other spokes)?
If the ACR is placed in the hub then it feels like the spokes will all just work/be able push/pull via their peering connection to the hub?
But if ACR is in a dedicated spoke, that feels like a lot more effort? I would potentially have to create a private endpoint in a hub subnet for the spoke ACR?.
Would that be enough to allow spokes to find/reach the ACR in the dedicate spoke (so one hop from spoke to hub, and then to ACR via the hub PEP)?
Or if the ACR is in a dedicate spoke, would I have to create a PEP for it in each spoke to allow them to find and use it?
Too many possibles am spinning a little.
Appreciate any suggestions/info.
Thanks.