Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

A developer needs to host a backend service named `payment-worker` on Azure Container Apps. The container image is stored in a private Azure Container Registry (ACR) named `payreg.azurecr.io`. To secure the deployment, the developer wants to avoid hardcoding registry credentials and instead use a managed identity to authenticate the image pull. The solution must support the initial deployment creation of the Container App. Which identity type must be configured for the container app to authenticate the registry pull, and what is the minimum required Azure role-based access control (RBAC) role that must be assigned to the identity on the ACR?

  1. A
    A system-assigned managed identity, with the AcrPull role assigned to the identity on the Azure Container Registry.
  2. B
    A user-assigned managed identity, with the AcrPush role assigned to the identity on the Azure Container Registry.
  3. A user-assigned managed identity, with the AcrPull role assigned to the identity on the Azure Container Registry.Answer
  4. D
    A system-assigned managed identity, with the Reader role assigned to the identity on the Azure Container Registry.

Answer

A user-assigned managed identity, with the AcrPull role assigned to the identity on the Azure Container Registry.
For the initial creation and deployment of an Azure Container App that pulls an image from a private Azure Container Registry (ACR), a user-assigned managed identity must be used. Since a system-assigned managed identity is only created after the container app resource itself has been provisioned, it is not available to authenticate the initial image pull. Furthermore, the identity requires the AcrPull role on the ACR to read and download the container image.

Step-by-Step Solution

1
Determine the availability of managed identities during the container app resource lifecycle.
A system-assigned managed identity is only created after the container app resource has been successfully provisioned. A user-assigned managed identity is created beforehand and can be referenced during the initial creation.
Since the container app must pull the container image from the private registry during its initial creation, the system-assigned identity does not yet exist to authenticate the pull. Therefore, a user-assigned managed identity must be used.
2
Identify the minimum required RBAC role on the Azure Container Registry (ACR) for pulling images.
The AcrPull role provides read access to the container registry data plane, allowing container images to be pulled.
The Reader role only grants metadata access (control plane) and does not permit pulling image data. The AcrPush role allows writing data, which violates the principle of least privilege.

Key Concept

Configuring private registry authentication for Azure Container Apps using managed identities
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic