Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

You are deploying a containerized microservice named `orders-api` to Azure Container Apps by using a Bicep template. The container image is stored in a private Azure Container Registry (ACR) named `myregistry.azurecr.io`. You configure a system-assigned managed identity on the Container App and assign it the `AcrPull` role on the registry.

How should you configure the registry credentials in the Bicep template to ensure the Container App can pull the image from the private registry using the system-assigned managed identity?

  1. A
    Set the `identity` property to the principal ID of the system-assigned managed identity of the Container App.
  2. Set the `identity` property to `'system'` in the registry configuration block under the registries array.Answer
  3. C
    Set the `identity` property to the resource ID of the Container App itself.
  4. D
    Configure a startup command in the Container App to run `az acr login` using the registry credentials.

Answer

To pull the image using a system-assigned managed identity, set the identity property to 'system' in the registry configuration block under the registries array.
The correct answer is to set the identity property to 'system' in the registry configuration block under the registries array. For system-assigned managed identity authentication to a private registry, Azure Container Apps requires the identity property of the registry object to be set to the string literal 'system'.

Step-by-Step Solution

1
Define the Container App resource in the Bicep template with a system-assigned managed identity enabled.
The Container App resource contains the identity block with type set to 'SystemAssigned'.
This generates a system-assigned managed identity for the Container App when deployed.
2
Reference the private Azure Container Registry and configure authentication.
An entry is added to the registries array under the configuration section.
Azure Container Apps needs to know which registry host requires authentication.
3
Assign the string literal 'system' to the identity property in the registry entry.
The configuration uses the system-assigned managed identity of the app for container image pull operations.
The Container Apps platform automatically resolves the keyword 'system' to the app's own system-assigned identity to authenticate the image pull.

Key Concept

Registry authentication using system-assigned managed identity in Azure Container Apps
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic