如何在部署过程中使用Azure密钥库传递安全参数值？

Question

我有一个用于在Azure管道中部署Service Fabric集群的ARM模板：

- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy SF cluster'
  inputs:
    deploymentScope: 'Resource Group'
    subscriptionId: '${{ parameters.SubscriptionId }}'
    azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '${{ parameters.ResourceGroupName }}'
    location: 'West Europe'
    templateLocation: 'Linked artifact'
    csmFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster.json'
    csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster-params.json'
    overrideParameters: '-certificateThumbprint $(Thumbprint) -sourceVaultResourceId $(KeyvaultId) -certificateUrlValue $(SecretId)'
    deploymentMode: 'Incremental'

ARM模板工作良好（因为许多天和在5个不同的管道），当我使用：

"osProfile": {
    "adminUsername": "RdpUsername",
    "adminPassword": "RdpPassword",

    "computernamePrefix": "[variables('vmNodeType0Name')]",
    "secrets": [
        {
            "sourceVault": {
                "id": "[parameters('sourceVaultResourceId')]"
            },
            "vaultCertificates": [
                {
                    "certificateStore": "My",
                    "certificateUrl": "[parameters('certificateUrlValue')]"
                }
            ]
        }
    ]
},

然而，具有硬编码的RDP凭据是一个安全问题，因此我希望在部署期间使用Azure密钥库传递安全参数值

"osProfile": {
    "adminUsername": {
        "reference": {
            "keyVault": {
                "id": "[parameters('sourceVaultResourceId')]"
            },
            "secretName": "RdpUsername"
        }
    },
    "adminPassword": {
        "reference": {
            "keyVault": {
                "id": "[parameters('sourceVaultResourceId')]"
            },
            "secretName": "RdpPassword"
        }
    },

    "computernamePrefix": "[variables('vmNodeType0Name')]",
    "secrets": [
        {
            "sourceVault": {
                "id": "[parameters('sourceVaultResourceId')]"
            },
            "vaultCertificates": [
                {
                    "certificateStore": "My",
                    "certificateUrl": "[parameters('certificateUrlValue')]"
                }
            ]
        }
    ]
},

我的ARM模板是基于azure-quickstart-templates/service-fabrice-secure-cluster-5-node-1-nodeType的，正如上面写的那样，使用硬编码值工作。

更新：

这里是我的sfcluster-params.json（但也请注意下面列出的管道任务中的overrideParameters，它填充了Keyvault部署设置的管道变量）：

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "clusterName": {
            "value": "sfcluster"
        }
    }
}

  # deploy KeyVault by ARM template and output VinHashKey and SF Cluster certificate thumbsprint
  - task: AzureResourceManagerTemplateDeployment@3
    displayName: 'Deploy Keyvault'
    inputs:
      deploymentScope: 'Resource Group'
      subscriptionId: '${{ parameters.SubscriptionId }}'
      azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
      action: 'Create Or Update Resource Group'
      resourceGroupName: '${{ parameters.ResourceGroupName }}'
      location: 'West Europe'
      templateLocation: 'Linked artifact'
      csmFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault.json'
      csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault-params.json'
      deploymentMode: 'Incremental'

  # collect outputs from the above ARM task and put them into pipeline vars
  - task: ARM Outputs@5
    displayName: 'Collect Keyvault output'
    inputs:
      ConnectedServiceNameSelector: 'ConnectedServiceNameARM'
      ConnectedServiceNameARM: '${{ parameters.ArmConnection }}'
      resourceGroupName: '${{ parameters.ResourceGroupName }}'
      whenLastDeploymentIsFailed: 'fail'

  # import the certificate my-self-signed-cert into the Keyvault if it is missing there
  - task: AzurePowerShell@5
    displayName: 'Import certificate'
    inputs:
      azureSubscription: '${{ parameters.ArmConnection }}'
      ScriptType: 'InlineScript'
      azurePowerShellVersion: '3.1.0'
      Inline: |
        $Cert = Get-AzKeyVaultCertificate -VaultName $(KeyVaultName) -Name my-self-signed-cert
        if (!$Cert) {
            $Pwd = ConvertTo-SecureString -String MyPassword -Force -AsPlainText
            $Base64 = 'MII....gfQ'
            $Cert = Import-AzKeyVaultCertificate -VaultName $(KeyVaultName) -Name my-self-signed-cert -CertificateString $Base64 -Password $Pwd
        }
        # set the pipeline variables Thumbprint and SecretId - needed for SF deployment
        echo "##vso[task.setvariable variable=Thumbprint]$($Cert.Thumbprint)"
        echo "##vso[task.setvariable variable=SecretId]$($Cert.SecretId)"

  # deploy SF cluster by ARM template and use the SF certificate thumbsprint as admin cert
  - task: AzureResourceManagerTemplateDeployment@3
    displayName: 'Deploy SF cluster'
    inputs:
      deploymentScope: 'Resource Group'
      subscriptionId: '${{ parameters.SubscriptionId }}'
      azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
      action: 'Create Or Update Resource Group'
      resourceGroupName: '${{ parameters.ResourceGroupName }}'
      location: 'West Europe'
      templateLocation: 'Linked artifact'
      csmFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster.json'
      csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster-params.json'
      overrideParameters: '-certificateThumbprint $(Thumbprint) -sourceVaultResourceId $(KeyvaultId) -certificateUrlValue $(SecretId)'
      deploymentMode: 'Incremental'

最后，这里是sfcluster.json-它太大了，不能放在StackOverflow中。

Answer 1

keyVault引用只能用作参数值-因此在param文件或部署的parameters属性中。不能将其直接用作资源上的属性值。