Question

Difficulty: HardDeploy and Configure Azure Container Apps

You are defining an Azure Container App named `order-processor` within an Azure Resource Manager Bicep template. The container app has the following deployment requirements:
1. It must pull its container image from a private Azure Container Registry named `myregistry.azurecr.io` using a user-assigned managed identity. The identity's resource ID is `/subscriptions/.../resourceGroups/.../providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity`.
2. It must accept public HTTPS traffic from the internet on port 8080 using the HTTP/2 transport protocol.
3. It must scale between 2 and 10 replicas based on average CPU usage.

Which of the following configuration blocks must be defined inside the `properties.configuration` section of the Bicep template to satisfy the registry credentials and ingress requirements? (Select TWO)

  1. registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: '/subscriptions/.../resourceGroups/.../providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity'
    }
    ]
    Answer
  2. ingress: {
    external: true
    targetPort: 8080
    transport: 'http2'
    }
    Answer
  3. C
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: 'system'
    }
    ]
  4. D
    ingress: {
    public: true
    port: 8080
    protocol: 'http2'
    }

Answer

The correct configurations are the registries block referencing the user-assigned identity resource ID, and the ingress block configuring external access, targetPort of 8080, and http2 transport.
The registries configuration correctly maps the private ACR server to the resource ID of the user-assigned managed identity, allowing secure image pulling. The ingress configuration correctly exposes the container app externally on port 8080 using the required http2 transport.

Step-by-Step Solution

1
Analyze the registry authentication requirements to determine the correct Bicep syntax for pulling images with a user-assigned managed identity.
The configuration must include a registries array under properties.configuration. The target registry server must be defined, and the identity field must be set to the user-assigned identity's resource ID rather than 'system'.
Azure Container Apps requires explicit registry credentials setup under the configuration block to pull from private registries like ACR, pointing to the specific managed identity resource ID.
2
Analyze the ingress requirements to determine the correct Bicep property names for public traffic, target port, and transport protocol.
The configuration must define an ingress block under properties.configuration with 'external' set to true, 'targetPort' set to 8080, and 'transport' set to 'http2'.
Bicep properties for ingress configuration in Azure Container Apps are strictly named: 'external' (not public), 'targetPort' (not port), and 'transport' (not protocol).

Key Concept

Configuring ingress and private registry authentication via Bicep for Azure Container Apps.
Rate this question