You need to deploy a containerized application to Azure Container Instances (ACI). The container image is stored in a private Azure Container Registry (ACR) named `contosoacr`. You must use a user-assigned managed identity named `contoso-aci-identity` to authenticate the container group to pull the image from `contosoacr`. The solution must follow the principle of least privilege. Which sequence of Azure CLI commands should you perform to deploy the container instance?
- 1Run `az identity create` to create the user-assigned managed identity `contoso-aci-identity`.
- 2Run `az identity show` and `az acr show` to retrieve the principal ID of the managed identity and the resource ID of `contosoacr`.
- 3Run `az role assignment create` to assign the `AcrPull` role to the managed identity's principal ID at the scope of the registry's resource ID.
- 4Run `az container create` specifying the registry image URL, and pass the resource ID of the managed identity to both the `--assign-identity` and `--acr-identity` parameters.
Cevap
To deploy a container in ACI that pulls an image from a private ACR using a user-assigned managed identity, you must first create the identity, retrieve its principal ID and the ACR resource ID, assign the AcrPull role to the identity at the ACR scope, and finally run the container creation command referencing the identity.
The correct order follows the logical dependency chain of Azure resources. The user-assigned managed identity must first exist. Once it exists, its principal ID and the target ACR resource ID are retrieved to configure the role assignment. The role assignment granting 'AcrPull' must be active before deployment is initiated. Finally, the container group is deployed using the container creation CLI command, which references the identity to pull the image.
Adım Adım Çözüm
Anahtar Kavram
Deploying container groups to ACI with secure registry authentication using user-assigned managed identities.