Examkin

Question

Difficulty: Very hardManage Container Images in Azure Container Registry

You are configuring an Azure Container Registry (ACR) task named `build-task` in a registry named `myregistry`. The task must build a container image from a remote GitHub repository and push it to `myregistry`. The build process requires pulling a private base image from an external Azure Container Registry named `sharedregistry.azurecr.io`.

You create a user-assigned managed identity named `task-identity` and assign it the `AcrPull` role on `sharedregistry.azurecr.io`.

You associate the identity with the task by running the following command:
azurecli
az acr task create \
--registry myregistry \
--name build-task \
--image myimage:latest \
--context https://github.com/myorg/myrepo.git#main \
--file Dockerfile \
--assign-identity /subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/task-identity

When the task executes, the build fails during the base image pull from `sharedregistry.azurecr.io` with an HTTP 401 Unauthorized error.

Which command should you execute to enable the task to authenticate successfully to the external registry?

  1. az acr task credential add --name build-task --registry myregistry --login-server sharedregistry.azurecr.io --user-assigned-identity 11111111-1111-1111-1111-111111111111Answer
  2. B
    Add a RUN az acr login --name sharedregistry.azurecr.io instruction inside the Dockerfile before the FROM instruction
  3. C
    az acr task update --name build-task --registry myregistry --auth-mode ManagedIdentity
  4. D
    az acr task credential add --name build-task --registry myregistry --login-server sharedregistry.azurecr.io --use-system-assigned

Answer

Execute the command: az acr task credential add --name build-task --registry myregistry --login-server sharedregistry.azurecr.io --user-assigned-identity 11111111-1111-1111-1111-111111111111
Executing the command that adds the credential with the user-assigned managed identity client ID matches the target login server to the identity. When ACR Tasks initiates the build and pulls the base image from the external login server, it retrieves an OAuth token representing the user-assigned managed identity to authenticate the pull request.

Step-by-Step Solution

1
Identify the authentication failure source
The task fails when trying to pull the base image from the external registry sharedregistry.azurecr.io because it lacks credentials for it.
By default, the task only has built-in credentials for its home registry, not for external registries.
2
Determine the authentication mechanism
The task must use the user-assigned managed identity to authenticate to the external registry.
The user-assigned managed identity has already been granted the AcrPull role on the external registry.
3
Map the identity to the external registry in the task configuration
Execute the az acr task credential add command, specifying the home registry, task name, target login server, and the client ID of the user-assigned managed identity.
This registers the credentials within the ACR Task context so it can automatically inject the managed identity token when communicating with the external registry.

Key Concept

ACR Tasks cross-registry authentication using managed identities
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic