Examkin

Question

Difficulty: HardDeploy and Configure Azure Container Apps

You are deploying an Azure Container App named `task-processor` using a Bicep template. The container app needs to scale dynamically based on the number of messages in an Azure Storage Queue named `taskqueue` located in a storage account named `tasksstorage`.

You have created a user-assigned managed identity named `worker-identity` and granted it the Storage Queue Data Reader role on the storage account.

The identity block in your Bicep template is configured as follows:

bicep
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${workerIdentity.id}': {}
}
}

You need to configure the custom scale rule in the Bicep template to use the user-assigned managed identity for authenticating against the queue.

Which of the following configuration snippets must you use inside the custom scale rule?

  1. custom: {
    type: 'azure-queue'
    metadata: {
    queueName: 'taskqueue'
    accountName: 'tasksstorage'
    queueLength: '5'
    }
    auth: [
    {
    triggerParameter: 'connection'
    identity: workerIdentity.id
    }
    ]
    }    Answer
  2. B
    custom: {
    type: 'azure-queue'
    metadata: {
    queueName: 'taskqueue'
    accountName: 'tasksstorage'
    queueLength: '5'
    }
    auth: [
    {
    triggerParameter: 'connection'
    identity: 'system'
    }
    ]
    }
  3. C
    custom: {
    type: 'azure-queue'
    metadata: {
    queueName: 'taskqueue'
    accountName: 'tasksstorage'
    queueLength: '5'
    }
    auth: [
    {
    triggerParameter: 'connection'
    identity: 'UserAssigned'
    }
    ]
    }
  4. D
    custom: {
    type: 'azure-queue'
    metadata: {
    queueName: 'taskqueue'
    accountName: 'tasksstorage'
    queueLength: '5'
    }
    auth: [
    {
    triggerParameter: 'connection'
    identity: 'worker-identity'
    }
    ]
    }

Answer

The configuration that sets identity to the resource ID of the user-assigned managed identity (workerIdentity.id) and maps it to the connection trigger parameter.
The correct configuration correctly maps the connection trigger parameter to the resource ID of the user-assigned managed identity (workerIdentity.id). This allows the Container Apps runtime to authenticate the KEDA scaler with the target Azure Storage Queue using the assigned user-assigned identity.

Step-by-Step Solution

1
Identify the authentication mechanism required for the Azure Container App scale rule.
Managed identity authentication is required to access the Azure Storage Queue.
The scenario specifies using the user-assigned managed identity instead of storage connection strings or secrets.
2
Determine the parameter mapping for the KEDA azure-queue scaler when using managed identity.
The metadata must include 'accountName' and the auth array must map 'triggerParameter: connection' to the identity.
When using managed identity, KEDA connects using the storage account name and utilizes the identity mapped to the connection parameter.
3
Identify the correct way to reference the user-assigned managed identity in the Bicep template's scale rule.
The identity property in the scale rule auth block must be set to the resource ID of the user-assigned managed identity (workerIdentity.id).
Literal strings like 'system', 'UserAssigned', or the resource's short name 'worker-identity' are invalid because the API expects the fully qualified resource ID.

Key Concept

Configuring KEDA scale rules in Azure Container Apps using user-assigned managed identities.
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic