Question

我无法从已部署到具有系统托管身份的专用网络的Azure容器实例访问保管库。如果我使用服务主体通过将环境变量传递给容器来访问Vault，则我的代码可以正常工作。

https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=bash

我的代码：

import os
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential

keyVaultName = 'XXXXXXX'
KVUri = "https://" + keyVaultName + ".vault.azure.net"

credential = DefaultAzureCredential()
client = SecretClient(vault_url=KVUri, credential=credential)

def secretVal(name):
    logging.debug("Retriving the secret from vault for %s", name)
    val = client.get_secret(name)
    return val.value

错误

2020-05-21:02:09:37,349 INFO     [_universal.py:412] Request URL: 'http://169.254.169.254/metadata/identity/oauth2/token'
2020-05-21:02:09:37,349 INFO     [_universal.py:413] Request method: 'GET'
2020-05-21:02:09:37,349 INFO     [_universal.py:414] Request headers:
2020-05-21:02:09:37,349 INFO     [_universal.py:417]     'Metadata': 'REDACTED'
2020-05-21:02:09:37,349 INFO     [_universal.py:417]     'User-Agent': 'azsdk-python-identity/1.3.1 Python/3.8.3 (Linux-4.15.0-1082-azure-x86_64-with-glibc2.2.5)'
2020-05-21:02:09:37,352 DEBUG    [connectionpool.py:226] Starting new HTTP connection (1): 169.254.169.254:80
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/azure/identity/_credentials/default.py", line 105, in get_token
    return super(DefaultAzureCredential, self).get_token(*scopes, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/azure/identity/_credentials/chained.py", line 71, in get_token
    raise ClientAuthenticationError(message=error_message)
azure.core.exceptions.ClientAuthenticationError: No credential in this chain provided a token.
Attempted credentials:
        EnvironmentCredential: Incomplete environment configuration. See https://aka.ms/python-sdk-identity#environment-variables for expected environment variables
        ImdsCredential: IMDS endpoint unavailable

问题似乎与以下类似。

https://github.com/Azure/azure-sdk-for-python/issues/8557

我尝试在创建实例时使用以下命令暂停我的代码以使元数据服务可用。但这仍然行不通。

-命令行“ / bin / bash -c'sleep 90; / usr / local / bin / python xxxx.py'“

Answer 1

不幸的是，当您在虚拟网络中创建Azure容器实例时，它不支持托管身份。请参阅限制：

您不能在部署到容器的容器组中使用托管身份虚拟网络。

虚拟网络中的ACI当前是预览版本。 here显示了所有限制。因此，当它位于Vnet中时，请使用服务主体进行身份验证，它类似于托管身份，只是以不同的样式显示。

无法使用系统分配的身份从Azure容器实例访问Azure Vault

1 个答案: