Azure虚拟机量表集需要使用预先存在的Azure密钥库中的秘密。
Terraform是用于创建Azure Virtual Machine量表集的工具。
必须使用哪些特定的Terraform代码来配置虚拟机量表中的虚拟机，以便能够从创建虚拟机量表设置之前存在的命名密钥库自动检索秘密？
terraform 可以接收 key_vault_id 的块选项，但我们无法找到示例。
我们需要的是在虚拟机刻度内运行的bash脚本，以便能够从预先存在的密钥库中检索秘密。特别是 cloud-init 启动脚本。
到目前为止，我们一直在使用CLI向Cloud-Init脚本中的密钥库提出请求，但是我们正在获得访问拒绝的错误。
这个问题的答案应包括1个。用于创建虚拟机刻度集的TerraForm代码，以及2。从该密钥库中检索秘密的简单代码，可以将其添加到在虚拟机量表集中运行的bash脚本中，例如云脚本。
VMS是否需要作为某种身份运行才能实现这一目标？
An Azure virtual machine scale set needs to use secrets from a pre-existing Azure key vault.
Terraform is the tool being used to create the Azure virtual machine scale set.
What specific terraform code must be used in order to configure the virtual machines in the virtual machine scale set to be able to automatically retrieve secrets from a named key vault which exists before the virtual machine scale set is created?
The terraform azurerm_linux_virtual_machine_scale_set resource has a secrets block option that can receive a key_vault_id, but we have not been able to find examples.
What we need is for bash scripts running within the virtual machine scale set to be able to retrieve secrets from the pre-existing key vault. Specifically the cloud-init startup script.
So far, we have been using the CLI to make requests to the key vault in the cloud-init script, but we are getting access denied errors.
The answer to this question should include 1. terraform code for creating the virtual machine scale set, and 2. simple code to retrieve a secret from that key vault that can be added to a bash script running in the virtual machine scale set, such as the cloud-init script.
Does the VMSS need to run as some sort of identity to make this happen?
发布评论