Examkin

Soru

Zorluk: ZorRun Containerized Solutions using Azure Container Instances

An organization is deploying a critical microservice to run on Azure Container Instances (ACI). The microservice container image is hosted in a private Azure Container Registry (ACR) named contosoregistry. Security policies dictate that you must avoid using ACR admin credentials or storing secrets in the deployment configuration, and instead use a user-assigned managed identity to authenticate and pull the image. You need to configure the environment and deploy the container group.

In which sequential order should you perform the steps to accomplish this goal?

  1. 1Create a user-assigned managed identity using the Azure CLI or Azure Portal.
  2. 2Assign the AcrPull role to the user-assigned managed identity, scoped to the contosoregistry instance.
  3. 3Retrieve the resource ID of the newly created user-assigned managed identity.
  4. 4Create a YAML deployment file that defines the container group, specifying the identity under the identity block, and referencing the identity resource ID in the imageRegistryCredentials property.
  5. 5Run the az container create command, specifying the target resource group and passing the YAML configuration file path to the --file parameter.

Cevap

To deploy an ACI container group pulling from a private ACR using a user-assigned identity, you must first create the user-assigned managed identity, assign the AcrPull role to it at the ACR scope, retrieve its resource ID, configure the YAML file with the identity block and imageRegistryCredentials referencing the resource ID, and finally run the az container create command referencing the YAML file.
The correct order requires creating the user-assigned identity first, granting it permission on the registry, retrieving its resource ID, incorporating it into the YAML deployment manifest, and then running the deployment command. This sequence ensures that all security and configuration dependencies are met before deployment is initiated.

Adım Adım Çözüm

1
Create the user-assigned managed identity.
A new managed identity resource is created in Microsoft Entra ID and Azure.
You cannot assign roles or reference the identity until the resource is created.
2
Assign the AcrPull role to the identity scoped to the ACR.
The identity is authorized to pull container images from the private registry.
This permission must be in place before ACI attempts to pull the image using this identity.
3
Retrieve the resource ID of the identity.
The resource ID string is obtained.
The YAML deployment file requires the fully qualified resource ID of the identity in both the identity definition and the registry credentials section.
4
Write the YAML manifest containing both the identity reference and the imageRegistryCredentials block.
A deployment YAML file is created.
The manifest must specify how ACI will authenticate (using the user-assigned identity) to the registry.
5
Execute the az container create command with the --file argument.
The container group is deployed to ACI.
This starts the creation process in Azure using the defined configuration.

Anahtar Kavram

Deploying Azure Container Instances using user-assigned managed identities to pull images from a private Azure Container Registry.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru