You are deploying a containerized application to Azure Container Instances (ACI). The application container needs to pull its image from a private Azure Container Registry (ACR) and retrieve a database connection string secret from an Azure Key Vault. Which two configurations are required to ensure the container can authenticate to the registry and access the secret? (Select two.)
- Configure the container group with registry credentials (server, username, and password) or enable a managed identity with permissions to pull from the registry.Cevap
- Assign a managed identity to the container group and grant it permissions to get secrets in the Azure Key Vault access policies.Cevap
- CGrant secrets access permissions to the Azure Container Instances resource provider directly in the Key Vault access policies.
- DConfigure the container group to pull the image anonymously from the private Azure Container Registry.
Cevap
Configure the container group with registry credentials or a managed identity with pull permissions, and assign a managed identity to the container group with Key Vault secret access permissions.
To pull from a private registry, ACI must be provided with registry server credentials or a managed identity assigned the AcrPull role. To access Key Vault secrets, the container group must have a managed identity that is granted GET secrets permission in Key Vault. These settings satisfy both secure pull and runtime secret access requirements.
Adım Adım Çözüm
Anahtar Kavram
Azure Container Instances authentication to ACR and Azure Key Vault