Examkin

Question

Difficulty: HardManage Container Images in Azure Container Registry

Your organization uses an Azure Virtual Machine to run continuous deployment tasks. You need to configure the VM to push a locally built container image named `webapp:v1` to an Azure Container Registry (ACR) named `corpacr`.

To comply with security guidelines, you must not use admin credentials or service principal keys. Instead, you have configured the following:
- A system-assigned managed identity on the VM, which has only the `Reader` role on the resource group containing the ACR.
- A user-assigned managed identity named `cicd-identity` (Client ID: `11111111-2222-3333-4444-555555555555`), which has the `AcrPush` role on `corpacr`.

Which of the following command sequences should you execute on the Azure Virtual Machine to successfully authenticate and push the image to the registry?

  1. az login --identity --username 11111111-2222-3333-4444-555555555555
    az acr login --name corpacr
    docker tag webapp:v1 corpacr.azurecr.io/webapp:v1
    docker push corpacr.azurecr.io/webapp:v1    Answer
  2. B
    az login --identity
    az acr login --name corpacr
    docker tag webapp:v1 corpacr.azurecr.io/webapp:v1
    docker push corpacr.azurecr.io/webapp:v1
  3. C
    az login --identity --username 11111111-2222-3333-4444-555555555555
    docker login corpacr.azurecr.io
    docker tag webapp:v1 corpacr.azurecr.io/webapp:v1
    docker push corpacr.azurecr.io/webapp:v1
  4. D
    az acr login --name corpacr --username 11111111-2222-3333-4444-555555555555
    docker tag webapp:v1 corpacr.azurecr.io/webapp:v1
    docker push corpacr.azurecr.io/webapp:v1

Answer

Use the sequence that starts by logging in to Azure with the user-assigned managed identity using its client ID, logs in to the container registry using az acr login, and then tags and pushes the image.
The correct command sequence first logs in to the Azure CLI using the user-assigned managed identity by specifying its client ID (11111111-2222-3333-4444-555555555555). It then calls the az acr login command to retrieve an OAuth2 access token for the registry and log in the local Docker daemon. Finally, it tags the local image with the registry's fully qualified login server domain (corpacr.azurecr.io) and pushes the image.

Step-by-Step Solution

1
Authenticate the Azure CLI session using the user-assigned managed identity.
The CLI is authenticated as the user-assigned managed identity (Client ID: 11111111-2222-3333-4444-555555555555).
This identity has the AcrPush role required to upload images to the registry, whereas the system-assigned identity only has Reader permissions.
2
Call the az acr login command.
The Docker daemon is authenticated to the corpacr.azurecr.io login server.
This command uses the active Azure CLI credentials to acquire an access token for the registry and configures the local Docker context.
3
Tag the local image with the registry's login server path.
The image is tagged as corpacr.azurecr.io/webapp:v1.
Docker requires images to be tagged with the registry's fully qualified domain name (FQDN) to know where to route the push request.
4
Push the image to the registry.
The image webapp:v1 is successfully uploaded to corpacr.
The authenticated Docker daemon pushes the tagged image to the private registry.

Key Concept

Azure Container Registry authentication using user-assigned managed identities via Azure CLI
Estimated Time:2m 30s
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic