Azure / Azure/azure-cli-docker

map login secrets into a container on k8s

Aperta
#55 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Dockerfile
Stelle
40
Fork
42
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

I'm attempting to save login creds as a k8s secrets that I then mount into the azcli container running as a pod. I then hoping to set the AZURE_CONFIG_DIR to point to this directory and have everything magically work!

I could get it to work with a few work arounds and hacks... I was wondering if there was a better way to do this? For GCP its possible to export a single JSON that you can then map into your container. See https://cloud.google.com/docs/authentication/getting-started

I am trying to update kubeflow pipelines to support azure (similar to: https://github.com/rakelkar/pipelines/blob/master/sdk/python/kfp/gcp.py)

Here is how I passed creds in:

```
# have to store 3 files into a secret!
kubectl create secret generic azcreds --from-file=$HOME/.azure/accessTokens.json --from-file=$HOME/.azure/azureProfile.json --from-file=$HOME/.azure/az.json
kubectl apply -f azcli.yaml

```

azcli.yaml
Had to add a hack to copy the secrets into a rw folder... :-( ideally would have loved to keep in an ro folder...
```
apiVersion: v1
kind: Pod
metadata:
name: azcli
spec:
containers:
- name: azcli
image: microsoft/azure-cli
command: ["/bin/sh"]
args: ["-c", "cp -r /mappedcreds /azcreds && while true; do sleep 20;done"]
env:
- name: AZURE_CONFIG_DIR
value: "/azcreds"
volumeMounts:
- name: azcredvol
mountPath: "/mappedcreds"
volumes:
- name: azcredvol
secret:
secretName: azcreds
```

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start with the azcli.yaml example and the Kubernetes Secret volume mounted at /mappedcreds, then review how AZURE_CONFIG_DIR is used by the microsoft/azure-cli container. Define the supported credential-mapping behavior and verify that login works without the copy-to-writable-directory workaround.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
azure, docker, kubernetes
Ambito
cli, cloud, infrastructure
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.