Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

You are deploying a microservice named `order-service` to Azure Container Apps. The container image for the microservice is stored in a private Azure Container Registry (ACR) named `myregistry.azurecr.io`.

To ensure secure image retrieval, you must configure the Container App to pull the image using a user-assigned managed identity named `app-pull-identity`. The identity has already been granted the `AcrPull` role on the registry.

Which Bicep configuration block must you use to satisfy this requirement?

  1. identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity'
    }
    ]
    }
    }    Answer
  2. B
    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: 'system'
    }
    ]
    }
    }
  3. C
    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: 'app-pull-identity'
    }
    ]
    }
    }
  4. D
    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    username: 'app-pull-identity'
    passwordSecretRef: 'acr-pull-secret'
    }
    ]
    }
    }

Answer

The configuration that sets the full resource ID of the user-assigned managed identity in both the identity block and the registries block is correct.
The correct configuration enables the user-assigned managed identity on the Container App resource by listing its resource ID under the userAssignedIdentities property and setting the type to 'UserAssigned'. It then specifies the same full resource ID in the registries configuration block under properties.configuration.registries. This instructs Azure Container Apps to use the designated user-assigned managed identity to authenticate and pull the image from the specified Azure Container Registry.

Step-by-Step Solution

1
Define the user-assigned managed identity on the Container App resource.
The identity type is set to 'UserAssigned' and the resource ID is added to the userAssignedIdentities dictionary.
Before an identity can be used to authenticate with a registry, it must be assigned to the resource.
2
Configure the registry authentication under properties.configuration.registries.
The registry server is set to 'myregistry.azurecr.io' and the identity is set to the full resource ID of the user-assigned identity.
For user-assigned identities, Azure Container Apps requires the full Azure resource ID to verify permissions and retrieve the token to pull the image.

Key Concept

Configuring registry authentication for Azure Container Apps using Bicep and user-assigned managed identities.
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic