Examkin

Soru

Zorluk: ZorDeploy and Configure Azure Container Apps

You are deploying a new Azure Container App named order-api to an Azure Container Apps environment. The container image is hosted in a private Azure Container Registry (ACR) named contosoacr.azurecr.io.

You are writing a Bicep template to perform the initial deployment of the container app. You must configure the container app to pull the image from the registry securely using a managed identity. The deployment must succeed on the first run without requiring any post-deployment manual configuration or secondary deployments.

Which configuration strategy and Bicep resource definition snippet should you use?

  1. Use a user-assigned managed identity. Grant the identity the AcrPull role on the registry, assign it to the container app, and configure it under the registries list in the Bicep template:

    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '${userAssignedIdentity.id}': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'contosoacr.azurecr.io'
    identity: userAssignedIdentity.id
    }
    ]
    }
    }    Cevap
  2. B
    Use a system-assigned managed identity. Configure the Bicep template to enable the identity and reference 'system' in the registries configuration:

    identity: {
    type: 'SystemAssigned'
    userAssignedIdentities: {}
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'contosoacr.azurecr.io'
    identity: 'system'
    }
    ]
    }
    }
  3. C
    Use a user-assigned managed identity. Grant it access, then pass its client ID and a registry password secret to the registries configuration block:

    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '${userAssignedIdentity.id}': {}
    }
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'contosoacr.azurecr.io'
    username: userAssignedIdentity.properties.clientId
    passwordRef: 'acr-password-secret'
    }
    ]
    }
    }
  4. D
    Use a system-assigned managed identity, and use the Bicep reference function to dynamically retrieve its principal ID to authenticate the registry:

    identity: {
    type: 'SystemAssigned'
    }
    properties: {
    configuration: {
    registries: [
    {
    server: 'contosoacr.azurecr.io'
    identityId: reference(resourceId('Microsoft.App/containerApps', 'order-api'), '2023-05-01').identity.principalId
    }
    ]
    }
    }

Cevap

Use a user-assigned managed identity with the AcrPull role pre-assigned, and reference its resource ID in both the identity and registries configurations of the Bicep template.
For the initial deployment of an Azure Container App to succeed when pulling from a private Azure Container Registry using a managed identity, you must use a user-assigned managed identity. This is because the role assignment (AcrPull) must exist on the identity before the container app is created. A system-assigned managed identity is only created after the container app resource starts provisioning, making it impossible to assign the required role beforehand. In Bicep, a user-assigned identity is declared in the identity block and then referenced in the registries configuration using its resource ID.

Adım Adım Çözüm

1
Create a user-assigned managed identity prior to the container app deployment.
A managed identity resource with a stable resource ID is available.
This avoids the chicken-and-egg problem of authorizing an identity that doesn't yet exist.
2
Assign the AcrPull role to the user-assigned identity at the scope of the Azure Container Registry.
The identity has the necessary permission to pull images from the registry.
The container app environment needs this permission to authenticate with the registry during container provisioning.
3
Reference the user-assigned identity in the Bicep template's identity and configuration.registries blocks.
The container app is successfully created and retrieves the container image during initial deployment.
This establishes the identity configuration on the resource and configures the environment to use that identity for the registry credentials.

Anahtar Kavram

To pull images from a private Azure Container Registry during the initial provisioning of an Azure Container App, a pre-created and authorized user-assigned managed identity must be used. System-assigned identities cannot be pre-authorized since they are created alongside the app.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Deploy and Configure Azure Container Apps

Bu konudan daha fazla soru