You are deploying a secure web application named web-app to Azure Container Apps. The application needs to retrieve database credentials stored as a secret in an existing Azure Key Vault named kv-prod. You must configure the Container App to access the Key Vault secret securely using a user-assigned managed identity. Which sequence of steps should you perform to configure the Container App?
- 1Create a user-assigned managed identity and assign it the Key Vault Secrets User role on the kv-prod Key Vault.
- 2Associate the user-assigned managed identity with the web-app Container App.
- 3Add a secret to the Container App that contains a Key Vault reference URL and specifies the user-assigned managed identity.
- 4Update the container definition in the Container App to map the Container App secret to an environment variable.
Cevap
To configure the Container App to securely retrieve the secret, you must first create a user-assigned managed identity and grant it the Key Vault Secrets User role on the Key Vault. Next, associate this managed identity with the Container App. Then, add a secret to the Container App that references the Key Vault secret URL and specifies the identity. Finally, update the container definition to map the Container App secret to an environment variable.
The correct order follows the lifecycle dependencies of Azure resources. The identity must exist and have permissions (Step 1) before it can be assigned to the Container App (Step 2). Once associated with the Container App, the identity can be referenced in the Container App's secrets configuration (Step 3). Finally, once the secret is defined at the app level, it can be mapped to individual container environment variables (Step 4).
Adım Adım Çözüm
Anahtar Kavram
Azure Container Apps Key Vault references with User-Assigned Managed Identity
Tahmini Süre:2m 0s