Examkin

Question

Difficulty: MediumManage Container Images in Azure Container Registry

You are configuring an on-premises CI/CD runner to build and push container images to an Azure Container Registry named corpacr. The runner does not have the Azure CLI installed, and you must minimize additional tool installations. You have created a Microsoft Entra service principal named sp-cicd to authenticate the runner. Which two actions should you perform to configure permissions and authenticate the runner? (Choose two.)

  1. Assign the AcrPush role to the sp-cicd service principal for the corpacr registry resource.Answer
  2. Execute the docker login command on the runner using the application ID of sp-cicd as the username and its client secret as the password.Answer
  3. C
    Assign the Reader role to the sp-cicd service principal for the corpacr registry resource.
  4. D
    Execute the az acr login --name corpacr command on the runner using the sp-cicd credentials.

Answer

To configure permissions and authenticate the on-premises runner without installing the Azure CLI, you must assign the AcrPush role to the service principal to allow image uploads, and execute a standard docker login command using the service principal's application ID and client secret.
To push images to Azure Container Registry, the identity must have the AcrPush role assigned. For environments without the Azure CLI installed, authentication is achieved by calling docker login with the registry login server, specifying the service principal application ID as the username and the client secret as the password.

Step-by-Step Solution

1
Assign the appropriate Role-Based Access Control (RBAC) role to the service principal.
The service principal has authorization to push images.
The AcrPush role provides both pull and push permissions, which are necessary for CI/CD pipelines to publish container images.
2
Authenticate from the runner using Docker CLI commands rather than Azure CLI.
The runner is authenticated to the registry.
Since the Azure CLI is not installed on the runner, standard docker login must be used with the service principal's application ID as the username and client secret as the password.

Key Concept

Azure Container Registry authentication and permission management using Service Principals.
Estimated Time:1m 30s
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic