Examkin

Soru

Zorluk: OrtaRun Containerized Solutions using Azure Container Instances

You are deploying a containerized service to Azure Container Instances (ACI) that must pull its image from a private Azure Container Registry (ACR). Once running, the application inside the container must retrieve an API key from Azure Key Vault. You want to use a single managed identity to authenticate both the image pull from ACR and the secret retrieval from Key Vault. Which configuration should you use?

  1. A
    Configure a system-assigned managed identity, assign it the AcrPull role on the ACR, grant it Get secrets permission on the Key Vault, and configure the container group to use this identity for the image pull.
  2. B
    Configure a user-assigned managed identity, assign it the AcrPull role on the ACR, configure the container group to use this identity for the image pull, and run the container with default settings without assigning additional permissions for Key Vault.
  3. Configure a user-assigned managed identity, assign it the AcrPull role on the ACR, grant it Get secrets permission on the Key Vault, and configure the container group to use this identity for the image pull.Cevap
  4. D
    Configure a user-assigned managed identity, grant it Get secrets permission on the Key Vault, and configure the container's startup script to execute the Azure CLI command to authenticate to the registry before the image is pulled.

Cevap

Configure a user-assigned managed identity, assign it the AcrPull role on the ACR, grant it Get secrets permission on the Key Vault, and configure the container group to use this identity for the image pull.
A user-assigned managed identity is created independently of the container group, which allows it to be referenced in the container group's deployment configuration to authenticate the container image pull from a private Azure Container Registry. Because it is assigned to the container group, the same identity is available to the container at runtime to authenticate to Azure Key Vault and retrieve secrets, fulfilling the requirement of using a single identity.

Adım Adım Çözüm

1
Create a user-assigned managed identity and assign it the AcrPull role on the target Azure Container Registry.
The identity gains the necessary permissions to read and pull container images from the private registry.
Because ACI must pull the container image before the container group resource is fully provisioned, a pre-existing user-assigned managed identity is required; a system-assigned identity cannot be used.
2
Grant the user-assigned managed identity Get permissions (or the Key Vault Secrets User role) on the target Azure Key Vault.
The identity is authorized to retrieve the secrets needed by the application at runtime.
By default, managed identities do not have permission to read Key Vault secrets and must be explicitly authorized.
3
Reference the user-assigned managed identity in the ACI container group definition and configure the container group to use this identity for image registry credentials.
The ACI service successfully authenticates with ACR using the identity's credentials, pulls the image, and provisions the container group with the identity assigned.
This links the managed identity to both the image pull phase and the runtime execution phase of the container.

Anahtar Kavram

Azure Container Instances supports authenticating to a private Azure Container Registry and accessing Azure Key Vault using a user-assigned managed identity.
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru