Open Kralizek opened 10 months ago
Update:
Adding an environment variable called AZURE_CLIENT_ID
set to the value azurerm_user_assigned_identity.this.client_id
solved the issue. I can't find the page now, but there was a page suggesting to use the principal id value for the environment variable. That didn't work.
@Kralizek you have to specify the client ID when using a user-assigned managed identity. new DefaultAzureCredential()
without any parameters will try to use a system-assigned identity and will fail if it's not there. It will also use the AZURE_CLIENT_ID
environment variable if it's set.
See here for more info: https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet#specify-a-user-assigned-managed-identity-with-defaultazurecredential
Adding the AZURE_CLIENT_ID environment variable fixed the issue. Since the container app has an identity attached, I was expecting the system to take care of providing what's needed for the application to use the identity to make calls to Azure services.
I recently started working with Azure after years at AWS and I had the conceptual map managed identities are the equivalent of the IAM execution role assigned to an instance or a container. Under that assumption, as mentioned, I was expected that either the environment was providing the credentials needed or the SDK could fetch them short-lived ones.
This issue is a: (mark with an x)
Issue description
I have a ASP.NET Core application running on Azure Container Instance and uses KV to fetch some secrets by using the configuration provider. The container instance is configured to use a user-assigned managed identity.
Running the same container in ACA with the same managed identity fails to start because the application is unable to access KV.
Steps to reproduce
Here are some Terraform constructs used to define the different parts. Since I'm copying from different areas, names might not match.
And this is the snippet used in my ASP.NET Core 8 RC2 app to access the KV.
This works correctly in ACI.
Expected behavior [What you expected to happen.]
Be able to access a KV vault from my ASP.NET Core application using the configuration provider.
Actual behavior [What actually happened.]
The revision is not provisioned and removed. These are some entries in the console log of the revision.