Examkin

Question

Difficulty: MediumRun Containerized Solutions using Azure Container Instances

You are preparing to deploy a containerized application to Azure Container Instances (ACI). The container image is stored in a private Azure Container Registry (ACR). You need to configure the container group to pull the image from the registry using a managed identity to avoid using container registry credentials.

Which managed identity configuration must you use to allow the container group to pull the image?

  1. A user-assigned managed identity, because the identity must exist and have the appropriate permissions before Azure Container Instances initiates the image pull.Answer
  2. B
    A system-assigned managed identity, because the container group automatically creates the identity before initiating the image pull from the registry.
  3. C
    A system-assigned managed identity, because it is the only managed identity type supported for authenticating with private container registries.
  4. D
    A user-assigned managed identity, but you must also enable the admin user account on the Azure Container Registry to authenticate the image pull.

Answer

A user-assigned managed identity must be used because the identity must exist and have the appropriate permissions before Azure Container Instances initiates the image pull.
The correct answer is the option stating that a user-assigned managed identity must be used because the identity must exist and have the appropriate permissions before Azure Container Instances initiates the image pull. Because ACI needs to authenticate with ACR to retrieve the container image before the container group resource is fully provisioned, a system-assigned identity (which is only generated after the container group exists) cannot be used.

Step-by-Step Solution

1
Analyze the lifecycle of managed identities in Azure Container Instances (ACI).
System-assigned managed identities are created only when the container group resource is created, whereas user-assigned managed identities exist independently prior to container group deployment.
Understanding when each identity type is available is crucial for determining which one can be used for the initial image pull.
2
Determine the sequence of events during ACI deployment.
To spin up the container group, Azure must first pull the container image from the registry. Thus, the identity used for authentication must be fully active and authorized prior to the start of the container group creation.
This sequence explains why a system-assigned identity cannot be used, as it does not yet exist when the pull is initiated.
3
Select the correct identity type and configuration.
Use a user-assigned managed identity, assign it the AcrPull role on the registry, and configure the container group to use this identity for the image pull.
This ensures secure authentication without credentials and aligns with ACI's architectural constraints.

Key Concept

Managed Identity Authentication for Container Image Pulls in Azure Container Instances
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic