知识图谱>> app-service-managed-identity-key-vault-csharp>> 返回
项目作者： Azure-Samples

项目描述 ：
An ASP.NET Core app for bootstrapping your next Web Apps for Containers service using Key Vault and Managed Identities
高级语言： C#
项目地址: git://github.com/Azure-Samples/app-service-managed-identity-key-vault-csharp.git


services:

  • app-service
  • key-vault
  • azure-app-service
  • azure-key-vault
    platforms:
  • dotnet
  • linux
    languages:
  • csharp
    products:
  • azure
  • dotnet
  • aspnet
  • azure-app-service
  • azure-key-vault
    author: aflinchb
    description: “A sample ASP.NET Core WebAPI for bootstrapping your next App Service app using Managed Identity and Key Vault”
    urlFragment: app-service-managed-identity-key-vault-csharp
    page_type: sample

Build an ASP.NET Core application using App Service, Managed Identity and Key Vault

This sample is an ASP.NET Core WebAPI application designed to “fork and code” with the following features:

  • Securely build, deploy and run an App Service (Web App for Containers) application
  • Securely store secrets in Key Vault
  • Securely use Key Vault secrets as Application Settings values with Key Vault reference strings
  • Use Managed Identity to securely access Key Vault secrets from App Services
  • Use Managed Identity to securely access Docker images from Container Registry

Prerequisites

  • Azure subscription with permissions to create:
    • Resource Group, Keyvault, App Service, Azure Container Registry
  • Bash shell (tested on Mac, Ubuntu, WSL2 and Cloud Shell)
  • Azure CLI (download)
  • Docker CLI (download)
  • .NET Core SDK (download)
  • Visual Studio Code (optional) (download)

Open with Codespaces

You must have access to Codespaces as an individual or part of a GitHub Team or GitHub Enterprise Cloud

  • Click the Code button on your repo
    • Click the Codespaces tab
    • Click New Codespace

Setup

  • Fork this repo and clone to your local machine (unless using Codespaces)
    • cd to the base directory of the repo

Login to Azure and select subscription

  2. az login
  4. # show your Azure accounts
  5. az account list -o table
  7. # select the Azure account (if necessary)
  8. az account set -s {subscription name or Id}

Choose a unique DNS name

  2. # this will be the prefix for all resources
  3. # do not include punctuation - only use a-z and 0-9
  4. # must be at least 5 characters long
  5. # must start with a-z (only lowercase)
  6. export MIKV_NAME=myname
  8. ### if nslookup doesn't fail to resolve, change MIKV_NAME
  9. nslookup $MIKV_NAME.azurewebsites.net
  10. nslookup $MIKV_NAME.vault.azure.net
  11. nslookup $MIKV_NAME.azurecr.io

Create Resource Group

  • When experimenting with this sample, you should create a new resource group to avoid accidentally deleting resources
    • If you use an existing resource group, please make sure to apply resource locks to avoid accidentally deleting resources
  2. # set location
  3. export MIKV_LOCATION=centralus
  5. # MySecret URI
  6. export MIKV_SECRET_URI=https://$MIKV_NAME.vault.azure.net/secrets/MySecret
  8. # resource group name
  9. export MIKV_RG=${MIKV_NAME}-rg
  11. # create the resource group
  12. az group create -n $MIKV_RG -l $MIKV_LOCATION

Save your environment variables for ease of reuse and picking up where you left off

  2. # run the saveenv.sh script at any time to save MIKV_* variables to ~/${MIKV_NAME}.env
  3. ./saveenv.sh -y
  5. # at any point if your terminal environment gets cleared, you can source the file
  6. # you only need to remember the name of the env file
  7. source ~/YourUniqueName.env

Create Azure Key Vault

  • All secrets are stored in Azure Key Vault for security
    • Use System Managed Identity to access Key Vault
  2. ## create the Key Vault
  3. az keyvault create -g $MIKV_RG -n $MIKV_NAME
  5. # add a secret
  6. az keyvault secret set \
  7.   --vault-name $MIKV_NAME \
  8.   --name "MySecret" \
  9.   --value "Hello from Key Vault and Managed Identity"

Create Azure Container Registry

Create the ACR with admin access disabled for security

  2. # create the ACR
  3. az acr create --sku Standard --admin-enabled false -g $MIKV_RG -n $MIKV_NAME
  5. # get the ACR_ID
  6. export MIKV_ACR_ID=$(az acr show -g $MIKV_RG -n $MIKV_NAME --query id --output tsv)
  8. # login to ACR
  9. # if you get an error that the login server isn't available,
  10. #   it's a DNS issue that will resolve in a minute or two, just retry
  11. az acr login -n $MIKV_NAME --expose-token
  13. # build the mikv container
  14. az acr build -r $MIKV_NAME -t $MIKV_NAME.azurecr.io/mikv .

Create App Service

App Service will fail to start until configured properly

  2. # create App Service plan
  3. az appservice plan create --sku B1 --is-linux -g $MIKV_RG -n ${MIKV_NAME}-plan
  5. # create Web App for Containers with System Managed Identity
  6. # the hello-world image is a placeholder
  7. az webapp create \
  8.   --deployment-container-image-name hello-world \
  9.   --assign-identity '[system]' \
  10.   -g $MIKV_RG \
  11.   -n $MIKV_NAME \
  12.   -p ${MIKV_NAME}-plan
  14. # stop the Web App while we update the config
  15. az webapp stop -g $MIKV_RG -n $MIKV_NAME

Grant access to Managed Identity

  2. # get the App Service Managed Identity
  3. export MIKV_MI_ID=$(az webapp identity show -g $MIKV_RG -n $MIKV_NAME --query principalId -o tsv)
  5. # grant Key Vault access to Managed Identity
  6. az keyvault set-policy \
  7.   -n $MIKV_NAME \
  8.   --secret-permissions get list \
  9.   --key-permissions get list \
  10.   --object-id $MIKV_MI_ID
  12. # grant acr pull access to the Managed Identity
  13. az role assignment create \
  14.   --assignee $MIKV_MI_ID \
  15.   --scope $MIKV_ACR_ID \
  16.   --role acrpull

Configure Web App

  2. # turn on container logging
  3. az webapp log config \
  4.   --docker-container-logging filesystem \
  5.   -g $MIKV_RG \
  6.   -n $MIKV_NAME
  8. # inject Key Vault secret
  9. az webapp config appsettings set \
  10.   -g $MIKV_RG \
  11.   -n $MIKV_NAME \
  12.   --settings MySecret="@Microsoft.KeyVault(SecretUri=$MIKV_SECRET_URI)"
  14. # get config endpoint
  15. export MIKV_CONFIG=$(az webapp show -n $MIKV_NAME -g $MIKV_RG --query id --output tsv)"/config/web"
  17. # save your MIKV_* environment variables for reuse
  18. ./saveenv.sh -y
  20. # configure the Web App to use Azure Container Registry with Managed Identity
  21. echo "ignore the warning message - the next command fixes the warning"
  22. az webapp config container set \
  23.   -n $MIKV_NAME \
  24.   -g $MIKV_RG \
  25.   -r https://$MIKV_NAME.azurecr.io \
  26.   -i $MIKV_NAME.azurecr.io/mikv:latest
  28. # use Managed Identity to connect to ACR
  29. az resource update \
  30.   --ids $MIKV_CONFIG \
  31.   --set properties.acrUseManagedIdentityCreds=true
  33. # start the Web App
  34. az webapp start -g $MIKV_RG -n $MIKV_NAME

Check Endpoints

  2. # this will eventually work, but may take up to a minute
  3. # you may get a 403 error, if so, just run the curl command again
  5. # curl the health check endpoint
  6. curl https://$MIKV_NAME.azurewebsites.net/healthz
  8. # curl the /api/secret endpoint
  9. curl https://$MIKV_NAME.azurewebsites.net/api/secret/MySecret

Clean up

  2. # delete Key Vault
  3. az keyvault delete -g $MIKV_RG -n $MIKV_NAME
  5. # purge Key Vault to permanently delete
  6. # Key Vaults use a "soft delete" by default
  7. az keyvault purge -n $MIKV_NAME
  9. # delete resource group
  10. az group delete -n $MIKV_RG --no-wait

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit Microsoft Contributor License Agreement.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services.

Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines.

Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.

Any use of third-party trademarks or logos are subject to those third-party’s policies.