docker - ACI mount gitrepo-url using Managed Identity from Azure DevOps - Stack Overflow

admin管理员组

文章数量:1300030

Is it possible to use Managed Identity to access a repo in DevOps on az container create ?

I have the following, although the continer hangs on build:

az container create `
--resource-group rgname`
--name con-name `
--location centralus `
--os-type Linux `
--acr-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--assign-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--image acrurl.azurecr.io/img:tag `
--cpu 1 `
--memory 1 `
--restart-policy Never `
--command-line "/bin/bash -c 'cd home/site/repo; git checkout docker-mi; dbt debug'" `
--protocol TCP `
--ports 80 `
--gitrepo-url "; `
--gitrepo-mount-path home/site `

when using, the below I can build and connect the continer fine:

--gitrepo-url "https://azurereposuser:[email protected]//devops/_git/dbtproject" `
--gitrepo-mount-path home/site 

I'd like to use MI instead of a token.

Any pointers would be much appreciated

Is it possible to use Managed Identity to access a repo in DevOps on az container create ?

I have the following, although the continer hangs on build:

az container create `
--resource-group rgname`
--name con-name `
--location centralus `
--os-type Linux `
--acr-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--assign-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--image acrurl.azurecr.io/img:tag `
--cpu 1 `
--memory 1 `
--restart-policy Never `
--command-line "/bin/bash -c 'cd home/site/repo; git checkout docker-mi; dbt debug'" `
--protocol TCP `
--ports 80 `
--gitrepo-url "https://dev.azure//devops/_git/dbtproject" `
--gitrepo-mount-path home/site `

when using, the below I can build and connect the continer fine:

--gitrepo-url "https://azurereposuser:[email protected]//devops/_git/dbtproject" `
--gitrepo-mount-path home/site 

I'd like to use MI instead of a token.

Any pointers would be much appreciated

• docker
• azure-devops
• azure-managed-identity
• azure-container-instances

Share Improve this question Follow asked Feb 11 at 15:08 marko0omarko0o 7588 bronze badges

Add a comment  | 

2 Answers 2

Sorted by: Reset to default 0

To use a Managed Identity (MI), to access repositories in Azure DevOps, you need to configure like as below:

1. In the target Azure DevOps anization, go to "Organization Settings" > "Users" page to add the MI as a user into the anization, and ensure the MI at least has Basic access level assigned.

2. Add the MI as a member into the projects where the repositories are in, and ensure the MI at least has Read permissions on the repositories.

3. Then you need to acquire an access token for the MI. The details steps to acquire the access token, see "Get a Microsoft Entra ID token".

4. Then you can use this access token to call Azure DevOps REST API, Azure DevOps CLI, and related git commands to access the repositories in the target Azure DevOps anization.

For more details, you can refer to the documentation "Use service principals & managed identities in Azure DevOps".

---

Thanks for the pointers.

adding the following to get a token did the trick: $(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)

I then added the get token as so:

--gitrepo-url "https://azurereposuser:$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)@dev.azure//devops/_git/dbtproject" 

本文标签： dockerACI mount gitrepourl using Managed Identity from Azure DevOpsStack Overflow