Examkin

Question

Difficulty: HardDeploy and Configure Azure Container Apps

A developer needs to deploy an internal microservice as an Azure Container App named payment-processor. The application must meet the following requirements:

- Pull its container image from a private Azure Container Registry (ACR) named acrapps.azurecr.io.
- Authenticate to the ACR using a user-assigned managed identity named aca-pull-identity (the admin user must remain disabled on the ACR).
- Limit ingress so that the microservice is only accessible by other applications running inside the same Container Apps environment.

When writing the Bicep template to deploy the Container App, which two configuration blocks or properties must you include? (Select two.)

  1. In the identity block at the root level of the Container App resource, set type to 'UserAssigned' and declare the resource ID of aca-pull-identity within the userAssignedIdentities object.Answer
  2. In the properties.configuration.registries array, add an object that specifies the server as 'acrapps.azurecr.io' and sets the identity property to the resource ID of aca-pull-identity.Answer
  3. C
    In the properties.configuration.registries array, specify the server as 'acrapps.azurecr.io' and set the username and passwordRef properties to point directly to aca-pull-identity.
  4. D
    In the properties.configuration.ingress block, set the external property to true and configure the allowInternalOnly property to true.
  5. E
    In the properties.configuration.registries array, omit the identity property and instead configure the registry authentication type to SystemAssigned in the properties.template.containers block.

Answer

To configure the Container App to pull from the private ACR using a user-assigned managed identity and secure ingress, you must assign the user-assigned managed identity to the Container App resource's identity block and map the ACR server to that identity's resource ID under properties.configuration.registries.
For an Azure Container App to pull an image from a private Azure Container Registry (ACR) using a user-assigned managed identity, two things must occur: the identity must be assigned to the Container App at the resource level (identity block), and the registry configuration must map the ACR server name to the resource ID of that user-assigned identity. Ingress is restricted internally by setting properties.configuration.ingress.external to false.

Step-by-Step Solution

1
Assign the user-assigned managed identity to the Container App.
The identity is enabled on the resource level, allowing the Container Apps platform control plane to request tokens on its behalf.
A managed identity must be assigned to the resource before it can be referenced in its configuration.
2
Associate the managed identity with the private registry.
The registries array under properties.configuration maps the server to the identity's resource ID.
This instructs Container Apps to authenticate to the specified registry using the assigned user-assigned identity instead of credentials.
3
Configure the ingress to restrict access.
The ingress block under properties.configuration has external set to false.
This disables public endpoint routing, restricting access to only applications in the same Container Apps environment.

Key Concept

Configuring private registry access and ingress for Azure Container Apps
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic