主页 / coding / 问题 / 78970847
Accepted
Elarbe
Asked: 2024-09-11 02:25:04 +0800 CST

在 docker 映像构建期间，凭据未从 Azure Keyvault 正确传递

  • 772

我有一个使用 azure.identity 库提供的 DefaultAzureCredential() 函数的 python 脚本。当我登录到具有正确权限的 Azure 帐户并运行脚本时，此脚本在本地运行良好。

我现在想使用存储在密钥保管库中的环境变量从 docker 容器内部运行脚本。据我所知，这应该可行。该映像是通过托管标识构建并推送到我的 Azure 容器注册表的。但是，当我拉取映像并尝试运行它时，我收到以下错误：

default_credential = DefaultAzureCredential()
                         ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/azure/identity/_credentials/default.py", line 149, in __init__
    credentials.append(EnvironmentCredential(authority=authority, _within_dac=True, **kwargs))
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/azure/identity/_credentials/environment.py", line 70, in __init__
    self._credential = ClientSecretCredential(
                       ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/azure/identity/_credentials/client_secret.py", line 45, in __init__
    raise ValueError("client_id should be the id of a Microsoft Entra application")
ValueError: client_id should be the id of a Microsoft Entra application

我的 yaml 文件如下所示：

parameters:
- name: KVConnection
  type: string
  default: 'read-keyvault'
- name: keyVault
  type: string
  default: 'bi-pv-kv'
- name: containerRegistry
  type: string
  default: 'dcr'
- name: CRconnection
  type: string
  default: 'buildandpushdocker'

steps:
- task: AzureKeyVault@2
  displayName: "Get KV secrets"
  inputs:
    azureSubscription: ${{ parameters.KVConnection }}
    KeyVaultName: ${{ parameters.keyVault }}
    SecretsFilter: '*'
    RunAsPreJob: true
  
- bash: |
    echo "##vso[task.setvariable variable=clientid]$(sp-client-id)"
    echo "##vso[task.setvariable variable=clientcred]$(sp-az-secret)"
    echo "##vso[task.setvariable variable=tenantid]$(sp-tenant-id)"
  displayName: Set environment variables

- task: Docker@2
  displayName: Build Planview image 
  inputs: 
    command: build
    repository: planview
    containerRegistry: ${{ parameters.containerRegistry }}
    identity: ${{ parameters.CRconnection }}
    arguments: '--build-arg AZURE_CLIENT_ID=$(clientid) --build-arg AZURE_TENANT_ID=$(tenantid)
      --build-arg AZURE_CLIENT_SECRET=$(clientcred)'
    tags: | 
      planview

- task: Docker@2
  displayName: Push Planview image 
  inputs: 
    command: push
    repository: planview
    containerRegistry: ${{ parameters.containerRegistry }}
    identity: ${{ parameters.CRconnection }}
    tags: |
      planview

其中是否存在明显的错误或如何改进？服务连接均已正确添加。我尝试将保险库中的确切凭据硬编码到本地运行的本地 dockerfile 中，它也在那里工作，这表明问题实际上是由于未正确处理 3 个机密造成的。

非常感谢任何建议或帮助。

1 个回答

  1. Best Answer

    据我根据您的管道工作流程进行的测试，问题似乎并非源于管道本身。我建议您仔细检查 Python 脚本如何读取 Dockerfile 中定义的环境变量。

    为了您的参考，我提供了我的示例文件，当我运行容器时，这些文件成功打印了预期的环境变量值。

    azure-pipelines.yml

    trigger: none

parameters:
- name: KVConnection
  type: string
  default: 'ARMSvcCnnWIFAutoSub1'
- name: keyVault
  type: string
  default: 'azkeyvaultxxxxxx '
- name: containerRegistry
  type: string
  default: 'DockerHubSvcCnn'
# - name: CRconnection
#   type: string
#   default: 'buildandpushdocker'

steps:
- task: AzureKeyVault@2
  displayName: "Get KV secrets"
  inputs:
    azureSubscription: ${{ parameters.KVConnection }}
    KeyVaultName: ${{ parameters.keyVault }}
    SecretsFilter: '*'
    RunAsPreJob: true
- bash: |
    echo "##vso[task.setvariable variable=clientid]$(sp-client-id)"
    echo "##vso[task.setvariable variable=clientcred]$(sp-az-secret)"
    echo "##vso[task.setvariable variable=tenantid]$(sp-tenant-id)"
  displayName: Set environment variables
- task: Docker@2
  displayName: Build Planview image 
  inputs: 
    command: build
    repository: azdockerhubxxx/planview
    containerRegistry: ${{ parameters.containerRegistry }}
    # identity: ${{ parameters.CRconnection }}
    arguments: '--build-arg AZURE_CLIENT_ID=$(clientid) --build-arg AZURE_TENANT_ID=$(tenantid) --build-arg AZURE_CLIENT_SECRET=$(clientcred)'
    tags: | 
      planview
- task: Docker@2
  displayName: Push Planview image 
  inputs: 
    command: push
    repository: azdockerhubxxx/planview
    containerRegistry: ${{ parameters.containerRegistry }}
    # identity: ${{ parameters.CRconnection }}
    tags: |
      planview

    打印环境.py

    import os

def print_env_variables():
    client_id = os.getenv('AZURE_CLIENT_ID')
    tenant_id = os.getenv('AZURE_TENANT_ID')
    client_cred = os.getenv('AZURE_CLIENT_SECRET')

    print(f"Client ID: {client_id}")
    print(f"Tenant ID: {tenant_id}")
    print(f"Client Secret: {client_cred}")

if __name__ == "__main__":
    print_env_variables()

    Dockerfile

    # Base image with Python
FROM python:3.9-slim

# Set environment variables (will be replaced by build arguments)
ARG AZURE_CLIENT_ID
ARG AZURE_TENANT_ID
ARG AZURE_CLIENT_SECRET

# Set them as environment variables inside the container
ENV AZURE_CLIENT_ID=$AZURE_CLIENT_ID
ENV AZURE_TENANT_ID=$AZURE_TENANT_ID
ENV AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET

# Copy the Python script into the container
COPY print_env.py /app/print_env.py

# Set the working directory
WORKDIR /app

# Run the Python script to verify environment variables
RUN python print_env.py

# Default command for the image
CMD ["python", "print_env.py"]

    图像

    • 1

相关问题