Examkin

Question

Difficulty: Very hardCreate and Configure Azure Functions

An organization is configuring an existing Linux-based Azure Function App named `contosofn` running on an Elastic Premium plan to deploy and pull its custom container image from a private Azure Container Registry (ACR) named `contosoacr`. You have created a user-assigned managed identity named `fn-pull-identity`. You must configure `contosofn` to pull the custom image from `contosoacr` using `fn-pull-identity`. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Associate the user-assigned managed identity `fn-pull-identity` with the `contosofn` Function App.
  2. 2Assign the `AcrPull` role to `fn-pull-identity` at the scope of the `contosoacr` registry.
  3. 3Configure the `AcrUseManagedIdentityCreds` app setting to `true` and the `AcrUserManagedIdentityID` app setting to the client ID of `fn-pull-identity`.
  4. 4Update the container settings of `contosofn` to specify the target Docker image from `contosoacr`.

Answer

Associate the user-assigned managed identity with the Function App, assign the AcrPull role to the identity at the registry scope, configure the AcrUseManagedIdentityCreds and AcrUserManagedIdentityID app settings, and then update the container image configuration.
To configure a containerized Azure Function to pull from a private ACR using a user-assigned managed identity, you must first register the identity with the resource, authorize the identity at the source registry using the AcrPull role, configure the application settings to use the identity (AcrUseManagedIdentityCreds = true and AcrUserManagedIdentityID = client ID), and finally set the image setting. Setting the image setting triggers the image pull, so the authorization infrastructure must be fully set up beforehand.

Step-by-Step Solution

1
Associate the user-assigned identity with the Function App resource.
The Function App resource is aware of the user-assigned managed identity and can request tokens on its behalf.
Before the identity can be used by the function runtime or reference client IDs in settings, it must be linked to the resource.
2
Assign the AcrPull role to the user-assigned identity at the scope of the container registry.
The identity is authorized to pull container images from the Azure Container Registry.
Access control must be granted before the platform tries to pull the image to avoid authorization errors.
3
Add the AcrUseManagedIdentityCreds and AcrUserManagedIdentityID app settings to the Function App.
The deployment engine is configured to use the managed identity for registry pulls.
Setting AcrUseManagedIdentityCreds to true and specifying the client ID via AcrUserManagedIdentityID directs the App Service platform to request tokens for the target identity.
4
Update the container image settings on the Function App.
The Function App deploys the new container image.
Updating the container image triggers the platform deployment engine to pull the target image. This must occur last so that permissions and settings are already active.

Key Concept

Configuring identity-based container deployment for Azure Functions using user-assigned managed identities.
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic