Examkin

Soru

Zorluk: OrtaRun Containerized Solutions using Azure Container Instances

You are deploying a multi-container group to Azure Container Instances (ACI) using a YAML file. The group contains two containers:
- `app-container`: A web application that pulls its image from a private Azure Container Registry (ACR) named `myregistry.azurecr.io` and retrieves a database connection string from Azure Key Vault at runtime.
- `sidecar-container`: A logging utility that shares a local directory with `app-container` to read its log files.

You must ensure that the container group can authenticate to the private ACR to pull the images, `app-container` can authenticate to Azure Key Vault using a managed identity, and the two containers can share the log directory.

Which three of the following configuration steps or blocks must you include in the YAML configuration or deployment process? (Select THREE)

  1. Define a user-assigned managed identity in the root identity block and reference its resource ID under the imageRegistryCredentials block in the YAML file.Cevap
  2. Define a volume of type emptyDir in the volumes list at the container group level, and configure volumeMounts in both container definitions pointing to the shared directory.Cevap
  3. Assign the Key Vault Secrets User role (or configure a Key Vault access policy with Get permission) for the managed identity to access the Key Vault secrets.Cevap
  4. D
    Configure a system-assigned managed identity in the identity block and reference it in the imageRegistryCredentials block to pull the image from the private ACR.
  5. E
    Add the Key Vault secret name and value directly as environment variables in the YAML file's environmentVariables block under app-container properties.
  6. F
    Run the az acr login --name myregistry command on your local machine prior to deploying the YAML file to authenticate the ACI service for image pulling.

Cevap

To successfully deploy the multi-container group with private ACR image pull, Key Vault authentication, and shared volume access, you must: define a user-assigned managed identity in the root identity block and reference it in the imageRegistryCredentials block; define an emptyDir volume in the volumes list at the container group level and mount it in both containers; and assign Key Vault Secrets User permissions to the managed identity.
The correct configuration requires: defining a user-assigned managed identity in the root identity block and referencing it in the imageRegistryCredentials block because system-assigned identities do not exist during the image pull phase; defining an emptyDir volume at the container group level to share local files between containers; and granting Key Vault Secrets User permissions to the managed identity to allow secret retrieval at runtime.

Adım Adım Çözüm

1
Select the correct identity type for ACR image pulling.
Since system-assigned identities are not created until after the container group is deployed, a user-assigned managed identity must be used. Define the user-assigned identity at the container group level and link it inside the image registry credentials block.
ACI needs a pre-existing identity (user-assigned) to pull container images from a private registry before it can instantiate the container group.
2
Set up shared local storage between the containers.
Define an emptyDir volume at the container group level, and configure volumeMounts in both containers pointing to the shared path.
An emptyDir volume provides a shared, transient directory that is accessible by all containers in the container group and is cleaned up when the group terminates.
3
Grant the managed identity access to Key Vault secrets.
Assign Key Vault Secrets User RBAC role or configure a Key Vault access policy granting Get secret permission to the user-assigned managed identity.
For the application container to retrieve the connection string secret at runtime using the managed identity, the identity must have authorization permissions on the Key Vault.

Anahtar Kavram

Deploying multi-container groups in ACI with private registry access, Key Vault integration, and shared volume storage.
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru