An Azure-based worker service processes high-priority queue messages and must run to completion and terminate. The service's container image is located in a private Azure Container Registry (ACR), and the service requires access to secret keys stored in Azure Key Vault during execution.
Which two settings should be configured in the container group deployment to satisfy these requirements?
- Set the restart policy of the container group to OnFailure.Cevap
- Enable a user-assigned managed identity on the container group, authorize it to read secrets from the Key Vault and pull images from the registry, and reference the identity in the deployment configuration.Cevap
- CConfigure a system-assigned managed identity for the container group, and grant it the Key Vault Secret User and Azure Container Registry AcrPull roles.
- DReference the Key Vault secrets directly in the container group's YAML definition using the @Microsoft.KeyVault syntax within the image registry credentials.
Cevap
Configure the restart policy of the container group to OnFailure, and use a user-assigned managed identity that has permission to both Key Vault and the Azure Container Registry.
For run-to-completion tasks, setting the restart policy of the container group to OnFailure ensures that the container is restarted if the process exits with a non-zero exit code due to transient failures, but stops executing and does not restart once it successfully processes all queue messages and exits with a zero exit code. To pull a container image from a private Azure Container Registry using a managed identity, Azure Container Instances requires a user-assigned managed identity. A system-assigned managed identity cannot be used for the image pull because the identity is not created until after the container group is deployed. The same user-assigned identity can also be granted access to the Key Vault to read secrets.
Adım Adım Çözüm
Anahtar Kavram
Azure Container Instances supports running container groups with specific restart policies (Always, OnFailure, Never) and using user-assigned managed identities to authenticate against secure resources like private container registries and Key Vaults.