You are deploying an Azure Container App named shipping-service that pulls its container image from a private Azure Container Registry (ACR). You enable a system-assigned managed identity on the Container App, but the deployment fails with an error indicating that the image cannot be pulled. Which action should you perform to resolve this deployment failure?
- Assign the AcrPull role to the Container App's system-assigned managed identity at the scope of the Azure Container Registry.Answer
- BConfigure the Container App to pull the image using a user-assigned managed identity reference, while leaving only the system-assigned identity enabled.
- CRun the az acr login command from your local development machine to authenticate the Azure Container Apps environment to the registry.
- DCreate a Shared Access Signature (SAS) token for the Azure Container Registry and configure the Container App's registry settings to use the token.
Answer
Assign the AcrPull role to the Container App's system-assigned managed identity at the scope of the Azure Container Registry.
To allow an Azure Container App to securely pull images from a private Azure Container Registry, the Container App's managed identity must be granted the AcrPull role at the registry's scope. This allows the host environment to retrieve the image using Azure AD authentication.
Step-by-Step Solution
Key Concept
Configuring secure private registry access using managed identities in Azure Container Apps