Examkin

Soru

Zorluk: OrtaDeploy and Configure Azure Container Apps

An organization is setting up a secure containerized API in Azure Container Apps. The container image is stored in a private Azure Container Registry (ACR). When deploying the Container App for the first time using a Bicep template, the deployment fails during the container creation phase because the registry authentication is not established. You need to configure the Bicep template to successfully authenticate to the private registry during this initial deployment using a managed identity. Which configuration strategy should you implement to ensure the initial deployment succeeds?

  1. Configure a user-assigned managed identity, grant it the AcrPull role on the registry, and reference this identity in both the identity and registries configuration blocks of the Bicep template.Cevap
  2. B
    Enable a system-assigned managed identity in the Bicep template, grant it the AcrPull role on the registry, and reference the system-assigned identity in the registries configuration block of the same template.
  3. C
    Run the az acr login command on the deployment machine to authenticate the session, and omit the registries configuration block from the Bicep template.
  4. D
    Configure a system-assigned managed identity and assign a Key Vault access policy to grant the Container App environment access to the registry credentials.

Cevap

Configure a user-assigned managed identity, grant it the AcrPull role on the registry, and reference this identity in both the identity and registries configuration blocks of the Bicep template.
The correct configuration strategy involves using a user-assigned managed identity. Since the user-assigned identity is a standalone Azure resource, it can be created and granted the AcrPull role on the private Azure Container Registry (ACR) before the Container App is deployed. When the Bicep template runs, referencing this identity in both the identity block and the registries configuration allows the Container Apps platform to authenticate and pull the image successfully on the initial deployment.

Adım Adım Çözüm

1
Create a user-assigned managed identity resource in Azure.
The identity is provisioned with a principal ID and client ID.
This identity must exist independently of the Container App so that it can be assigned permissions prior to the app's deployment.
2
Assign the AcrPull role to the user-assigned managed identity on the Azure Container Registry.
The identity receives read access to the private registry.
This allows the identity to pull container images from the registry.
3
Reference the user-assigned managed identity in the identity block and specify it under the registries array in the Container App Bicep configuration.
The Container App is configured to use the user-assigned identity to authenticate against the private ACR.
This ensures the Azure Container Apps service can authenticate as this identity to pull the image during the initial deployment.

Anahtar Kavram

Deploying Azure Container Apps with private registry authentication using a user-assigned managed identity.
Bu soruyu puanla

Konular

Deploy and Configure Azure Container Apps

Bu konudan daha fazla soru