使用 KeyVault (Terraform) 从 ACR 中提取图像时出现 Azure 应用服务错误

Question

我正在尝试将图像从 ACR 拉到 Azure 应用服务。我已将 ACR 的凭据存储在 Key Vault 上。我在我的应用服务 Terraform 配置中使用由 Key Vault 生成的端点。我的 TF 脚本是这样的

  module "my-ui-service-temp" {
  source                   = "app-service-noconn"
  location                 = "${local.location}"
  name                     = "webapp-temp"
  resource_group_name      = "${module.create-resource-group.name}"
  app_service_plan_id      = "${module.create-app-service-plan.id}"
  app_service_plan_name    = "${module.create-app-service-plan.name}"
  namespace                = "${local.namespace}-temp"
  dotnetframework_version  = "v4.0"
  java_version = "1.8"
  process_32bitworker      = "true"
  websockets_enabled       = "true"
  remote_debugging_enabled = "true"
  local_mysql_enabled      = "true"
  php_version              = "5.5"
  remote_debugging_version = "VS2017"
  tls_version              = "1.2"
  linuxfx_version          = "DOCKER|myregistry.azurecr.io/my-webapp:latest"
  //cors_allowed_origins = "*"

  //ip_address_restriction = "10.198.54.79"

  #ip_address_restriction = "198.203.177.177"
  default_documents      = [ "Default.htm", "Default.html", "Default.asp", "index.htm", "index.html", "iisstart.htm", "default.aspx", "index.php", "hostingstart.html"]

  http2_enabled = "false"
  scm_type      = "none"
  subnet_mask   = "255.255.255.255"

  app_settings {
    "DOCKER_REGISTRY_SERVER_URL" = "myregistry.azurecr.io"
    "DOCKER_REGISTRY_SERVER_USERNAME" = "https://myapp-kv-az.vault.azure.net/secrets/my-secret-kv-az/redacted"
    "DOCKER_REGISTRY_SERVER_PASSWORD" = "https://myapp-kv-az.vault.azure.net/secrets/my-pass-az-pass/redacted"
  }

}

这是我遇到的错误

2019-06-17 16:06:20.651 错误 - 拉取泊坞窗图像 registry.azurecr.io/myApp-webapp：最新失败：2019-06-17 16:06:20.651 信息 - 从 Docker 集线器拉取图像： registry.azurecr.io/myApp-webapp：最新 2019-06-17 16:06:20.676 错误 - DockerApiException: Docker API 响应状态码=InternalServerError, response={"message":"Get https://registry.azurecr.io/v2/myApp-webapp/manifests/latest: 未经授权：需要身份验证"}

2019-06-17 16:06:20.687 错误 - 图像拉取失败：验证 docker 图像 配置和凭据（如果使用私有存储库）

如果我在没有 KeyVault 的情况下直接传递我的 ACR 凭据，我可以毫无问题地提取和构建映像。我假设它与 Key Vault 访问策略有关。

但是，错误消息显示 - Docker API 以 status code=InternalServerError, response={"message":"Get https://registry.azurecr.io/v2/myApp-webapp/manifests/latest: authorized: authentication required"} 响应，这让我很困扰！

我正在通过 keyvault 传递身份验证详细信息，但应用服务无法进行身份验证。

Answer 1

修复它。而不是传递@Microsoft.keyvault(SecretUri="")。

我用过

data "azurerm_key_vault_secret" "myacrServer" { 
name = "myApp-acr-server-az" 
vault_uri = "myApp-kv-az-acr.vault.azure.net" 
} 

然后在 web 应用服务的 app_settings 中，我将传入该数据机密值。

app_settings { 
"DOCKER_REGISTRY_SERVER_USERNAME" = "${data.azurerm_key_vault_secret.myacrusname.value}" 
} 

Answer 2

如果您想使用对密钥保管库的引用，您可以使用 official way 这样做。所以它看起来像这样：

app_settings {
    "DOCKER_REGISTRY_SERVER_URL" = "myregistry.azurecr.io"
    "DOCKER_REGISTRY_SERVER_USERNAME" = "@Microsoft.KeyVault(SecretUri="https://myapp-kv-az.vault.azure.net/secrets/my-secret-kv-az/redacted)"
    "DOCKER_REGISTRY_SERVER_PASSWORD" = "@Microsoft.KeyVault(SecretUri=https://myapp-kv-az.vault.azure.net/secrets/my-pass-az-pass/redacted)"
}