Examkin

Soru

Zorluk: Çok zorDeploy and Configure Azure Container Apps

You are configuring an existing Azure Container App named `my-app` to pull container images from a private Azure Container Registry (ACR) named `myregistry.azurecr.io`. You want to use a User-Assigned Managed Identity for authentication to adhere to the principle of least privilege. What is the correct sequence of steps to configure the container app to use the managed identity and deploy the image?

  1. 1Create the User-Assigned Managed Identity by running the command `az identity create --name my-identity --resource-group my-rg`.
  2. 2Assign the `AcrPull` role to the managed identity's principal ID at the Azure Container Registry scope using `az role assignment create`.
  3. 3Associate the managed identity with the Container App by running `az containerapp identity assign --name my-app --resource-group my-rg --user-assigned <identityResourceId>`.
  4. 4Configure the Container App registry credentials to map the server and the managed identity by running `az containerapp registry set --name my-app --resource-group my-rg --server myregistry.azurecr.io --identity <identityResourceId>`.
  5. 5Deploy the private container image to the Container App by running `az containerapp update --name my-app --resource-group my-rg --container-name my-container --image myregistry.azurecr.io/my-image:v1`.

Cevap

Create the User-Assigned Managed Identity, assign the AcrPull role to it over the registry scope, associate the identity with the Container App, configure the Container App registry credential helper, and then update the Container App image.
The correct order resolves dependencies strictly. The User-Assigned Managed Identity must be created first to obtain its configuration details. Then, permissions must be granted to the identity to authenticate with the container registry. Next, the identity must be bound to the Container App before configuring the app's registry settings to use it. Finally, the container image can be updated, allowing the app to authenticate, pull the image, and spin up a new revision.

Adım Adım Çözüm

1
Provision the User-Assigned Managed Identity using the Azure CLI.
The identity resource is generated with a unique principal ID and resource ID.
You must establish the identity principal first to retrieve its properties for downstream role assignments and associations.
2
Grant the AcrPull role to the identity over the Azure Container Registry.
The managed identity is authorized to pull images from the ACR.
Authentication relies on role-based access control (RBAC). Without this permission, the Container App will fail to pull the image even if the identity is correctly assigned.
3
Assign the User-Assigned Managed Identity to the Container App resource.
The container app is associated with the identity's resource ID in its identity block.
Azure Resource Manager validates that the identity is associated with the Container App before letting you configure it for container registry authentication.
4
Establish the registry configuration on the Container App.
The Container App registry block is updated to specify the target ACR server and user-assigned identity.
This links the ACR server path to the identity credentials so the platform knows how to authenticate for subsequent pull requests.
5
Update the image on the Container App.
A new revision is created and the private image is pulled successfully.
Since the registry mappings, identity association, and RBAC permissions are configured, the platform resolves the registry reference and pulls the private image with zero authentication failures.

Anahtar Kavram

Deploying Azure Container Apps with private registry pull using User-Assigned Managed Identity
Bu soruyu puanla

Konular

Deploy and Configure Azure Container Apps

Bu konudan daha fazla soru