Open backwind1233 opened 1 year ago
A workaround to this issue: Add an environment variable called WEBSITE_SITE_NAME with a non null value in the Azure Container Apps.
azure-identity can work in Azure Contanier apps with Managed Identity, but our library can't, we should figure out the reason.
Container Apps Environments do not expose or proxy the IMDS endpoint to running Apps or Jobs. Instead, they offer a dedicated endpoint for retrieving tokens:
A container app with a managed identity exposes the identity endpoint by defining two environment variables:
IDENTITY_ENDPOINT
- local URL from which your container app can request tokens.IDENTITY_HEADER
- a header used to help mitigate server-side request forgery (SSRF) attacks. The value is rotated by the platform.
To get a token for a resource, make an HTTP GET request to the endpoint, including the following parameters: Parameter name In Description resource Query The Microsoft Entra resource URI of the resource for which a token should be obtained. The resource could be one of the Azure services that support Microsoft Entra authentication or any other resource URI. api-version Query The version of the token API to be used. Use "2019-08-01" or later. X-IDENTITY-HEADER Header The value of the IDENTITY_HEADER
environment variable. This header mitigates server-side request forgery (SSRF) attacks.client_id Query (Optional) The client ID of the user-assigned identity to be used. Can't be used on a request that includes principal_id
,mi_res_id
, orobject_id
. If all ID parameters (client_id
,principal_id
,object_id
, andmi_res_id
) are omitted, the system-assigned identity is used.principal_id Query (Optional) The principal ID of the user-assigned identity to be used. object_id
is an alias that may be used instead. Can't be used on a request that includes client_id, mi_res_id, or object_id. If all ID parameters (client_id
,principal_id
,object_id
, andmi_res_id
) are omitted, the system-assigned identity is used.mi_res_id Query (Optional) The Azure resource ID of the user-assigned identity to be used. Can't be used on a request that includes principal_id
,client_id
, orobject_id
. If all ID parameters (client_id
,principal_id
,object_id
, andmi_res_id
) are omitted, the system-assigned identity is used.
Finally, the identity client consults this list of environment variables, whereas the keyvault libraries only consider the legacy app service case.
Describe the bug Applications dependend on azure-spring-boot-starter-keyvault-certificates can't work in Azure Contanier apps using Managed Identity.
Following this doc Tutorial: Secure Spring Boot apps using Azure Key Vault certificates but using in a container app.
This is the error I got when using
Exception or Stack Trace