Examkin

Question

Difficulty: MediumRun Containerized Solutions using Azure Container Instances

You are deploying a containerized application to Azure Container Instances (ACI). The container image is stored in a private Azure Container Registry (ACR). You create a user-assigned managed identity and assign it the AcrPull role on the ACR. However, when you attempt to deploy the container group, the deployment fails with an error indicating that the image cannot be pulled. What is the most likely cause of this failure?

  1. The container group deployment configuration is missing the identity reference within the image registry credentials section.Answer
  2. B
    The developer did not execute the az acr login command to authenticate the local shell before initiating the container group deployment.
  3. C
    The container group must use a system-assigned managed identity instead of a user-assigned managed identity to authenticate registry pulls.
  4. D
    The user-assigned managed identity lacks GET secret permissions in the associated Azure Key Vault access policy.

Answer

The container group deployment configuration is missing the identity reference within the image registry credentials section.
The correct option is correct because assigning a user-assigned managed identity to the container group is a two-step process: you must define the identity on the container group, and you must explicitly link that identity to the registry credentials under the image registry credentials section in the deployment template or command. If the second step is omitted, ACI will attempt to pull the image anonymously, which fails for private registries.

Step-by-Step Solution

1
Assign the user-assigned managed identity to the container group.
The identity is attached to the container group resource, but not yet linked to the private registry credentials.
This establishes the identity relationship with the container group, making it available for Azure resource operations.
2
Configure the imageRegistryCredentials property in the deployment definition.
The configuration links the private ACR registry login server with the resource ID of the user-assigned managed identity.
ACI needs explicit instructions to map the registry pull request to the specific user-assigned identity.
3
Deploy the container group.
The ACI resource provider successfully authenticates against the private ACR using the specified identity and pulls the image.
With both the identity assigned and the credentials mapping configured, ACI has the necessary context to authenticate.

Key Concept

Azure Container Instances image pull authentication using managed identities
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic