Examkin

Soru

Zorluk: ZorRun Containerized Solutions using Azure Container Instances

A company plans to host a web API in Azure Container Instances (ACI). The Docker image for the API is stored in a private Azure Container Registry (ACR). At startup, the API container must download a database connection string from Azure Key Vault. To maintain high security, the solution must meet these criteria: Avoid storing cleartext registry credentials in the ACI deployment template; Authenticate to the private ACR to download the image; Retrieve the connection string from Key Vault without embedding credentials in the application code. Which identity and authentication configuration should be implemented to support this deployment?

  1. Assign a UserAssigned identity to the container group. Grant this identity the AcrPull role on the ACR and Secret Get permissions on the Key Vault. Specify this identity under both the identity block and the image registry credentials of the deployment definition.Cevap
  2. B
    Assign a SystemAssigned identity to the container group. Grant this identity the AcrPull role on the ACR and Secret Get permissions on the Key Vault. Define this identity in the image registry credentials section of the deployment template.
  3. C
    Assign a UserAssigned identity to pull the image, and enable a SystemAssigned identity for database secret access. Grant the UserAssigned identity the AcrPull role on the ACR. Configure Key Vault firewall rules to allow access from the container group's subnet without granting explicit permissions to the identities.
  4. D
    Create a UserAssigned identity to pull the image. Save the ACR access credentials in Key Vault, and configure the container group's image registry credentials section to reference these Key Vault secret URIs directly.

Cevap

Assign a UserAssigned identity to the container group. Grant this identity the AcrPull role on the ACR and Secret Get permissions on the Key Vault. Specify this identity under both the identity block and the image registry credentials of the deployment definition.
Assigning a UserAssigned identity to the container group allows ACI to authenticate to the private Azure Container Registry (ACR) during the container provisioning phase. Since a SystemAssigned identity is only created after the container group is deployed, it cannot be used to pull the image. By using a UserAssigned identity, ACI can fetch the image securely. The same identity can be granted Get secret permissions in Key Vault, allowing the containerized application to fetch the database connection string at startup without storing credentials.

Adım Adım Çözüm

1
Evaluate identity requirements for private container registry image retrieval during ACI provisioning.
Determine that a UserAssigned identity is required because it exists before container group creation, allowing it to authenticate with ACR to pull the image.
SystemAssigned identities are created dynamically during provisioning, which is too late for the image pulling phase.
2
Determine the authorization requirements for Key Vault secret access.
Conclude that the UserAssigned identity (or another identity) must be granted explicit 'Get' secret permission in the Key Vault.
Network-level access configurations (like VNet firewalls) do not grant access to data plane operations such as reading secrets.
3
Map the identity configuration into the ACI YAML/ARM deployment schema.
Assign the identity in the root 'identity' block and reference its resource ID in the 'imageRegistryCredentials' block.
This links the pre-existing UserAssigned identity to the container registry pull credentials.

Anahtar Kavram

Using UserAssigned identities for ACR image pulling and Key Vault access in Azure Container Instances
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru