Examkin

Question

Difficulty: HardRun Containerized Solutions using Azure Container Instances

You are deploying a containerized API application to Azure Container Instances (ACI). The container image is stored in a private Azure Container Registry (ACR). The application must retrieve database connection strings from Azure Key Vault at startup.

You want to implement a secure solution that uses managed identities to authenticate both the image pull from ACR and the secret retrieval from Key Vault, avoiding hardcoded credentials.

You attempt to deploy the container group using a system-assigned managed identity, but the deployment fails with an image pull authorization error.

Which of the following actions should you perform to resolve this deployment failure?

  1. Configure the container group to use a user-assigned managed identity, grant that identity the AcrPull role on the Azure Container Registry, and specify this identity for the registry credentials and container identity.Answer
  2. B
    Grant the container group's system-assigned managed identity the AcrPull role on the Azure Container Registry, and configure the registry credentials parameters to reference the system identity.
  3. C
    Grant the Azure Container Registry service principal GET permissions in the Azure Key Vault access policy, and reference the registry credentials.
  4. D
    Authenticate to the Azure Container Registry using the Azure CLI on your local machine, and then deploy the container group without specifying credentials.

Answer

Configure the container group to use a user-assigned managed identity, grant that identity the AcrPull role on the Azure Container Registry, and specify this identity for the registry credentials and container identity.
To pull an image from a private Azure Container Registry using a managed identity, you must use a user-assigned managed identity. A system-assigned managed identity cannot be used because it is created concurrently with the container group, meaning it does not exist when the image pull request is initiated. By using a user-assigned identity and assigning it the AcrPull role, Azure Container Instances can successfully authenticate to the registry and pull the image before creating the container.

Step-by-Step Solution

1
Create a user-assigned managed identity in Azure.
A standalone identity resource is provisioned with its own Principal ID and Client ID.
We need an identity that exists independently of the container group's lifecycle so it is available during the container image pull phase.
2
Assign the AcrPull role to the user-assigned managed identity on the Azure Container Registry scope, and grant it secret access permissions on the Azure Key Vault.
The identity is authorized to pull images from the registry and read secrets from the Key Vault.
This establishes the necessary permissions required for both phases of the container group lifecycle (deployment and execution).
3
Deploy the container group specifying the user-assigned managed identity for the container group identity and the registry credentials configuration.
The deployment succeeds as Azure Container Instances uses the pre-existing user-assigned identity to authenticate the image pull and runs the container with the same identity to fetch secrets.
This binds the identity to both the registry access configuration and the container group's runtime identity.

Key Concept

Authentication to Azure Container Registry from Azure Container Instances using a user-assigned managed identity.
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic