Azure / Azure/azure-cli-docker

map login secrets into a container on k8s

Offen
#55 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Dockerfile
Sterne
40
Forks
42
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

I'm attempting to save login creds as a k8s secrets that I then mount into the azcli container running as a pod. I then hoping to set the AZURE_CONFIG_DIR to point to this directory and have everything magically work!

I could get it to work with a few work arounds and hacks... I was wondering if there was a better way to do this? For GCP its possible to export a single JSON that you can then map into your container. See https://cloud.google.com/docs/authentication/getting-started

I am trying to update kubeflow pipelines to support azure (similar to: https://github.com/rakelkar/pipelines/blob/master/sdk/python/kfp/gcp.py)

Here is how I passed creds in:

```
# have to store 3 files into a secret!
kubectl create secret generic azcreds --from-file=$HOME/.azure/accessTokens.json --from-file=$HOME/.azure/azureProfile.json --from-file=$HOME/.azure/az.json
kubectl apply -f azcli.yaml

```

azcli.yaml
Had to add a hack to copy the secrets into a rw folder... :-( ideally would have loved to keep in an ro folder...
```
apiVersion: v1
kind: Pod
metadata:
name: azcli
spec:
containers:
- name: azcli
image: microsoft/azure-cli
command: ["/bin/sh"]
args: ["-c", "cp -r /mappedcreds /azcreds && while true; do sleep 20;done"]
env:
- name: AZURE_CONFIG_DIR
value: "/azcreds"
volumeMounts:
- name: azcredvol
mountPath: "/mappedcreds"
volumes:
- name: azcredvol
secret:
secretName: azcreds
```

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Rechercherichtung

Start with the azcli.yaml example and the Kubernetes Secret volume mounted at /mappedcreds, then review how AZURE_CONFIG_DIR is used by the microsoft/azure-cli container. Define the supported credential-mapping behavior and verify that login works without the copy-to-writable-directory workaround.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
azure, docker, kubernetes
Bereich
cli, cloud, infrastructure
Issue-Typ
Feature
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Veraltet
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
25/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.