You need to assign this role on the ACR to the identity that is associated with your AKS cluster.
AcrPull