Examkin

Soru

Zorluk: ZorRun Containerized Solutions using Azure Container Instances

You are deploying a multi-container group to Azure Container Instances (ACI) using a YAML manifest. The application container needs to pull a private image from an Azure Container Registry (ACR) named `myregistry.azurecr.io`.

The manifest contains the following snippet:

yaml
identity:
type: SystemAssigned
imageRegistryCredentials:
- server: myregistry.azurecr.io
identity: system

When you run `az container create`, the deployment fails with an image pull authentication error.

Which configuration change must you implement in the YAML manifest to resolve the issue?

  1. A
    Keep the identity type as SystemAssigned, change the identity property under imageRegistryCredentials to SystemAssigned, and grant the container group's service principal the AcrPull role.
  2. B
    Retrieve the registry credentials from Azure Key Vault by using Key Vault references in the imageRegistryCredentials section, and grant the system-assigned identity access to the Key Vault.
  3. Configure a user-assigned managed identity in the YAML manifest, assign it to the container group, and set the identity property under imageRegistryCredentials to the resource ID of the user-assigned identity.Cevap
  4. D
    Omit the imageRegistryCredentials block from the YAML manifest, and configure the container group to rely on default Azure Active Directory authentication using the system-assigned identity.

Cevap

Configure a user-assigned managed identity in the YAML manifest, assign it to the container group, and set the identity property under imageRegistryCredentials to the resource ID of the user-assigned identity.
To pull an image from a private Azure Container Registry using a managed identity, you must use a user-assigned managed identity. System-assigned managed identities cannot be used for this purpose because the identity is created and assigned only after the container group is deployed, which occurs after the image pull phase. Specifying the user-assigned identity's resource ID in both the identity block and the imageRegistryCredentials section allows the ACI service to authenticate to the registry during the deployment process.

Adım Adım Çözüm

1
Identify the phase at which the authentication failure occurs.
The failure occurs during the image pull phase, which takes place before the container group's system-assigned identity is created or active.
An identity must be active and resolved prior to the creation of the container group in order to authenticate the initial image pull from a private registry.
2
Select the appropriate managed identity type.
A user-assigned managed identity is chosen because it exists independently of the container group and is active prior to resource creation.
Only user-assigned managed identities can be referenced to authenticate container image pulls from a private registry at container group creation time.
3
Update the YAML manifest with the identity configuration.
Add the user-assigned identity's resource ID to the identity section and point to it in the imageRegistryCredentials section.
The ACI resource provider requires explicit mapping of the user-assigned identity in both the identity definition and registry credentials blocks to perform the authentication handshake.

Anahtar Kavram

Authenticating ACI to private ACR using Managed Identities
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru