Examkin

Soru

Zorluk: ZorRun Containerized Solutions using Azure Container Instances

You are designing an automated deployment for a batch processing workload using Azure Container Instances (ACI). The workload has the following requirements:

1. It must run two containers: a file downloader (producer) and a data analyzer (consumer).
2. Both containers must share a temporary directory that only needs to persist during the lifecycle of the container group.
3. The container images are hosted in a private Azure Container Registry (ACR).
4. The consumer container must securely retrieve a database connection string from an Azure Key Vault.
5. The container group must be deployed inside a subnet of an existing Azure Virtual Network to connect to a private database.

Which three actions should you perform to meet these requirements?

  1. Delegate the target subnet within the Azure Virtual Network to the Microsoft.ContainerInstance/containerGroups service before deployment.Cevap
  2. Configure a shared volume of type emptyDir in the container group YAML definition and mount it to both the producer and consumer containers.Cevap
  3. Create a user-assigned managed identity, grant it the AcrPull role on the Azure Container Registry, and configure the container group to pull images using this identity.Cevap
  4. D
    Enable a system-assigned managed identity on the container group and grant it the AcrPull role on the Azure Container Registry to authenticate image pulls.
  5. E
    Run the az acr login command in the local Azure CLI session to automatically authorize the Azure Container Instances service host to pull registry images.
  6. F
    Grant the container group's managed identity the Set and Delete secret permissions in the Azure Key Vault access policies to retrieve the database credentials.

Cevap

To deploy the solution, you must delegate the virtual network subnet to the container group service, configure an emptyDir volume for ephemeral shared storage, and configure a user-assigned managed identity with the AcrPull role on the private Azure Container Registry to authorize the image pull.
Delegating the subnet to the ACI service is required for VNet integration. Using an emptyDir volume provides shared, ephemeral file storage between containers in the same container group. Using a user-assigned managed identity with the AcrPull role is required because system-assigned identities do not exist in time to authorize the initial image pull during deployment.

Adım Adım Çözüm

1
Configure the virtual network by delegating a subnet to the Microsoft.ContainerInstance/containerGroups service resource type.
The subnet is reserved and configured to host Azure Container Instance container groups.
VNet integration for ACI requires a dedicated subnet that does not host other resource types.
2
Create a user-assigned managed identity and assign it the AcrPull role on the private Azure Container Registry.
The identity has the permission to pull images from the registry.
Since ACI must pull the image before creating the container group, a pre-existing user-assigned identity is required for authentication.
3
Define the container group in YAML or an ARM template, configuring an emptyDir volume and mounting it to both containers.
The containers share a temporary folder that persists for the lifecycle of the container group.
An emptyDir volume provides a shared, non-persistent directory suitable for temporary multi-container processing workloads.

Anahtar Kavram

Azure Container Instances networking, volumes, and private registry authentication
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru