Examkin

Soru

Zorluk: ZorDeploy and Configure Azure Container Apps

You are deploying a new Azure Container App named `shipment-processor` to an Azure Container Apps environment. The container image is stored in a private Azure Container Registry (ACR) named `contosoregistry.azurecr.io`.

Security policies prohibit enabling the admin user on the ACR. You must configure the Container App to pull the image from the ACR using a managed identity with the least privilege.

You want to perform this deployment in a single CLI command execution without using temporary public images or bootstrap steps.

Which of the following approaches should you use to achieve this goal?

  1. Create a user-assigned managed identity, assign the AcrPull role to the identity on the ACR scope, and run the `az containerapp create` command with the `--user-assigned` and `--registry-identity` parameters configured to use this identity.Cevap
  2. B
    Run the `az containerapp create` command with the `--system-assigned` parameter, set `--registry-identity` to `system`, and then assign the AcrPull role to the generated system-assigned identity on the ACR scope.
  3. C
    Enable a system-assigned identity on the Azure Container Apps environment, grant the AcrPull role to the environment's identity on the ACR scope, and run the `az containerapp create` command without specifying registry credentials.
  4. D
    Create a user-assigned managed identity, assign the Reader role to the identity on the ACR scope, and run the `az containerapp create` command with the `--user-assigned` and `--registry-identity` parameters configured to use this identity.

Cevap

Create a user-assigned managed identity, assign the AcrPull role to the identity on the ACR scope, and run the `az containerapp create` command with the `--user-assigned` and `--registry-identity` parameters configured to use this identity.
The correct approach uses a user-assigned managed identity because it can be pre-created and granted the AcrPull role on the Azure Container Registry prior to deploying the Container App. During the initial creation of the Container App, Azure needs to pull the container image from the private ACR. Since the user-assigned identity already has the required permissions, the deployment succeeds in a single step.

Adım Adım Çözüm

1
Create a user-assigned managed identity in Azure.
A user-assigned managed identity resource is created and receives a principal ID.
We need an identity that exists independently of the Container App lifecycle so it can be authorized before the Container App is deployed.
2
Assign the AcrPull role to the user-assigned identity on the Azure Container Registry.
The identity is authorized to pull images from the registry.
This provides the identity with the least-privilege permission required to access the registry data plane.
3
Execute the `az containerapp create` command with the `--user-assigned` and `--registry-identity` parameters referencing the identity.
The Container App is successfully deployed using the identity to authenticate to the ACR during the initial pull.
This allows the deployment command to succeed in a single execution since the identity already has the necessary read rights on the ACR.

Anahtar Kavram

Azure Container Apps deployment with private registry authentication using a user-assigned managed identity.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Deploy and Configure Azure Container Apps

Bu konudan daha fazla soru