Examkin

Question

Difficulty: MediumManage Container Images in Azure Container Registry

You are configuring a deployment workflow on an Azure Virtual Machine (VM). The VM must build a container image locally and push it to a private Azure Container Registry (ACR) named gridregistry. You have created a User-Assigned Managed Identity named acr-pusher-identity and assigned it the AcrPush role on gridregistry. The VM is configured to use this identity. From the VM's command-line interface, you need to authenticate to Azure and push the local image app:v1 to the registry using the user-assigned managed identity. Which command sequence should you execute?

  1. az login --identity --username <client_id_of_acr-pusher-identity>
    az acr login --name gridregistry
    docker tag app:v1 gridregistry.azurecr.io/app:v1
    docker push gridregistry.azurecr.io/app:v1    Answer
  2. B
    az login --identity
    az acr login --name gridregistry
    docker tag app:v1 gridregistry.azurecr.io/app:v1
    docker push gridregistry.azurecr.io/app:v1
  3. C
    az login --identity --username <client_id_of_acr-pusher-identity>
    az acr login --name gridregistry.azurecr.io
    docker tag app:v1 gridregistry.azurecr.io/app:v1
    docker push gridregistry.azurecr.io/app:v1
  4. D
    az login --identity --username <client_id_of_acr-pusher-identity>
    az acr login --name gridregistry
    docker tag app:v1 gridregistry/app:v1
    docker push gridregistry/app:v1

Answer

Execute the sequence that logs in using the user-assigned identity's client ID, logs into the registry using the name 'gridregistry', tags the image with the login server 'gridregistry.azurecr.io/app:v1', and pushes the image.
The correct command sequence first authenticates the Azure CLI with the VM's user-assigned managed identity by explicitly passing the client ID via the --username parameter. It then logs in to the registry using the short name 'gridregistry'. Finally, it tags the image with the registry's fully qualified login server domain 'gridregistry.azurecr.io' and pushes it to the registry.

Step-by-Step Solution

1
Authenticate the Azure CLI session using the user-assigned managed identity.
az login --identity --username <client_id_of_acr-pusher-identity> is executed.
For VMs with a user-assigned managed identity, you must specify the identity's client ID, object ID, or resource ID using the --username parameter; otherwise, Azure CLI defaults to the system-assigned identity.
2
Authenticate the local Docker daemon to the Azure Container Registry.
az acr login --name gridregistry is executed.
The az acr login command uses the active Azure CLI session to obtain an access token and log in to Docker. The command expects the registry name (not the login server URL) for the --name parameter.
3
Tag the local container image with the target registry's login server domain.
docker tag app:v1 gridregistry.azurecr.io/app:v1 is executed.
Docker requires the image tag to begin with the registry's fully qualified login server name (registryname.azurecr.io) in order to route the push command to the correct registry.
4
Push the tagged image to the Azure Container Registry.
docker push gridregistry.azurecr.io/app:v1 is executed.
Uploads the container image layers to the gridregistry repository.

Key Concept

Azure Container Registry authentication and image pushing using a User-Assigned Managed Identity from an Azure VM.
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic