Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

You are configuring a new Azure Container App named shipping-tracker to host a containerized microservice. The container image is stored in a private Azure Container Registry (ACR) named shippingregistry.azurecr.io. You need to configure the Container App to securely pull the image from the registry without enabling the ACR admin user or using static credentials.

Which configuration should you apply to meet these requirements?

  1. Assign a user-assigned managed identity to the Container App, grant that identity the AcrPull role on the Azure Container Registry, and configure the Container App's registry settings to reference the user-assigned identity.Answer
  2. B
    Enable a system-assigned managed identity on the Container App, grant that identity the AcrPull role on the Azure Container Registry, and configure the Container App's registry settings to reference the system-assigned identity.
  3. C
    Configure a startup script within the Container App that runs the 'az acr login' command to authenticate the Container Apps environment to the registry prior to provisioning the container.
  4. D
    Assign a system-assigned managed identity to the Container Apps environment, grant that identity the Owner role on the Azure Container Registry, and configure the container to authenticate using the environment's default credential provider.

Answer

The correct configuration is to assign a user-assigned managed identity to the Container App, grant that identity the AcrPull role on the Azure Container Registry, and configure the Container App's registry settings to reference the user-assigned identity.
To securely pull an image from a private Azure Container Registry without using admin credentials, you must use a user-assigned managed identity. The identity is granted the AcrPull role on the registry, and its resource ID is referenced in the container app's registry configuration. This allows the Container App to authenticate and pull the image during provisioning.

Step-by-Step Solution

1
Create or identify a user-assigned managed identity in Azure.
A user-assigned managed identity resource is created with a unique resource ID.
Azure Container Apps requires a pre-existing user-assigned managed identity to authenticate container pulls from private registries before the Container App is fully deployed.
2
Assign the AcrPull role to the user-assigned managed identity at the Azure Container Registry scope.
The identity is granted read-only permission to pull container images from the registry.
This conforms to the principle of least privilege while providing the necessary permissions to retrieve the container image.
3
Configure the Container App registry settings with the registry server name and the resource ID of the user-assigned managed identity.
The Container App is configured to use the managed identity for authentication when pulling the image.
This establishes the secure link between the Container App and the registry, allowing successful deployment of the container.

Key Concept

Configuring Azure Container App registry authentication using user-assigned managed identities for secure image pulls from a private Azure Container Registry.
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic