Examkin

Question

Difficulty: Very hardManage Container Images in Azure Container Registry

You are configuring a multi-registry container build workflow in Azure. You have a main Azure Container Registry (ACR) named `prodacr` where you want to build and store application images, and a secured ACR named `sharedacr` that hosts the base images.

You need to configure an ACR task named `AppBuildTask` in `prodacr` to build an image from a GitHub repository. The build process must pull the base image from `sharedacr` using the task's system-assigned managed identity.

Which sequence of steps should you perform to configure the task?

  1. 1Run the `az acr task create` command with the `--assign-identity` parameter to create the task and enable its system-assigned managed identity.
  2. 2Run the `az acr task show` command with a query to retrieve the `principalId` of the newly created system-assigned managed identity.
  3. 3Run the `az role assignment create` command to assign the `AcrPull` role to the retrieved `principalId` at the scope of the `sharedacr` registry.
  4. 4Run the `az acr task credential add` command with the `--login-server` and `--use-identity [system]` parameters to configure the task to authenticate to `sharedacr`.

Answer

First, create the task with a system-assigned managed identity. Second, retrieve the principal ID of the identity. Third, assign the AcrPull role to the identity at the scope of the base registry. Fourth, add the base registry credentials to the task using the system-assigned identity.
The correct order establishes the identity during task creation, retrieves its principal ID, authorizes it to pull from the base registry, and configures the task credentials to use that identity.

Step-by-Step Solution

1
Run `az acr task create` with the `--assign-identity` parameter.
The task is created and the system-assigned managed identity is provisioned.
System-assigned identities are tied to the resource lifecycle, meaning the task must exist before the identity can be referenced or assigned roles.
2
Run `az acr task show` querying `identity.principalId`.
The security principal ID (object ID) of the managed identity is retrieved.
This ID is necessary to bind Azure RBAC roles to the identity in subsequent steps.
3
Run `az role assignment create` assigning the `AcrPull` role to the principal ID at the scope of `sharedacr`.
The identity is authorized to pull images from the base registry.
ACR Tasks require explicit read access to retrieve base images from registries other than the one hosting the task.
4
Run `az acr task credential add` specifying the base registry login server and using `[system]` for the identity.
The registry credentials configuration is added to the task definition.
This instructs the ACR Task to use the system-assigned identity to authenticate against the specified login server during run execution.

Key Concept

ACR Tasks cross-registry authentication using system-assigned managed identities
Estimated Time:3m 0s
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic