使用 linkedtemplate 从 Keyvault 检索密码

Question

阅读了来自 here and here and here and looking at this example

的一些文章后

我已尝试使用 LinkedTemplate 从 KeyValut 检索密码。

为了实现这个目标，我创建了这样一个链接臂模板 azuredeploy.json:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "type": "string",
      "metadata": {
        "description": "The name of the keyvault that contains the secret."
      }
    },
    "secretName": {
      "type": "string",
      "metadata": {
        "description": "The name of the secret."
      }
    },
    "vaultResourceGroupName": {
      "type": "string",
      "metadata": {
        "description": "The name of the resource group that contains the keyvault."
      }
    },
    "vaultSubscription": {
      "type": "string",
      "defaultValue": "[subscription().subscriptionId]",
      "metadata": {
        "description": "The name of the subscription that contains the keyvault."
      }
    }
  },
  "resources": 
  [
    {
      "apiVersion": "2018-05-01",
      "name": "dynamicSecret",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "contentVersion": "1.0.0.0",
          "uri": "https://arm0storage.blob.core.windows.net/linkedtemplate/azuredeploy.json?sp=r&st=2019-07-17T13:28:26Z&se=2019-07-16T21:28:26Z&spr=https&sv=2018-03-28&sig=xxxv%2xxxxxxxxxxxxxxx%2FHmg9Yxxxxxxxxxxxxxxxxxxxxxxx%3D&sr=b"
        },
        "parameters": {
          "adminPassword": {
            "reference": {
              "keyVault": {
                "id": "[resourceId(parameters('vaultSubscription'), parameters('vaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
              },
              "secretName": "[parameters('secretName')]"
            }
          }
        }
      }
    }
  ],
  "outputs": {
    "SQLPassword": {
      "type": "string",
      "value": "[reference('dynamicSecret').outputs.value]"
    }
  }
}

如果我尝试验证此模板，我收到此错误消息：

Deployment template validation failed: 'The template parameters 'adminPassword' in the parameters file are not valid; they are not present in the original template and can therefore not be provided at deployment time. The only supported parameters for this template are 'vaultName, secretName, vaultResourceGroupName, vaultSubscription'. Please see https://aka.ms/arm-deploy/#parameter-file for usage details.'.

在我的 azuredeploy.parameters.json 中我有：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "value": "kvnamer"
    },
    "secretName": {
      "value": "ExamplePassword"
    },
    "vaultResourceGroupName": {
      "value": "rgname"
    }
  }
}

你有什么想法可以解决我的问题吗？

Answer 1

关于这个问题，请检查您的链接模板是否有参数"adminPassword"。详情请参考document。你也可以参考我的JSON文件。

1.Create azuredeploy.json

  {
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "type": "string",
      "metadata": {
        "description": "The name of the keyvault that contains the secret."
      }
    },
    "secretName": {
      "type": "string",
      "metadata": {
        "description": "The name of the secret."
      }
    },
    "vaultResourceGroupName": {
      "type": "string",
      "metadata": {
        "description": "The name of the resource group that contains the keyvault."
      }
    },
    "vaultSubscription": {
      "type": "string",
      "defaultValue": "[subscription()]",
      "metadata": {
        "description": "The name of the subscription that contains the keyvault."
      }
    }
  },
  "resources": [{
    "apiVersion": "2015-01-01",
    "name": "linkedTemplate",
    "type": "Microsoft.Resources/deployments",
    "properties": {
      "mode": "incremental",
      "templateLink": {
        "uri": "https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/keyvaultparameter/sqlserver.json",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "adminPassword": {
          "reference": {
            "keyVault": {
              "id": "[resourceId(parameters('vaultSubscription'), parameters('vaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
            },
            "secretName": "[parameters('secretName')]" 
          }
        },
        "adminLogin": {
            "value": "jimtest"
        },
        "sqlServerName": {"value": "jimteste12378902"}
      }
    }
  }],
  "outputs": {
    "SQLPassword": {
      "type": "string",
      "value": "[reference('linkedTemplate').outputs.value]"
    }
  }
}

2.Create azuredeploy.parameters.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "value": ""
    },
    "secretName": {
      "value": ""
    },
    "vaultResourceGroupName": {
      "value": ""
    },
    "vaultSubscription": {
      "value": ""
    }
  }
}

Answer 2

您在此处的嵌套部署中使用的模板：

"https://arm0storage.blob.core.windows.net/linkedtemplate/azuredeploy.json?sp=r&st=2019-07-17T13:28:26Z&se=2019-07-16T21:28:26Z&spr=https&sv=2018-03-28&sig=xxxv%2xxxxxxxxxxxxxxx%2FHmg9Yxxxxxxxxxxxxxxxxxxxxxxx%3D&sr=b"

那个模板是什么样子的？您收到的错误消息表明它没有名为 "adminPassword" 的参数 - 但您的嵌套部署资源正在尝试将其传入。

上面模板中的输出称为 "SQLPassword"，它们不一定相关，但我猜是因为我们看不到您链接到的模板。

使用 linkedtemplate 从 Keyvault 检索密码

using linkedtemplate to retrieve password from Keyvault

azure

azure-resource-manager