应用程序网关与 Azure Key Vault 集成问题

Question

希望有人能提供帮助。

我正在尝试使用 ARM 模板将 Azure 应用程序网关与 Key Vault 集成并遇到问题：

SecretIdSpecifiedIsInvalid: SecretId '==' specified in '/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/rg-ProjectX-dev-infra/providers/Microsoft.Network/applicationGateways/appgw-ProjectX-dev/sslCertificates/appGwSslCert' is invalid. []

用户分配的应用程序网关托管标识具有适当的权限（'Get' 和 'List' [= Azure Key Vault 中的 31=]secrets 和 certificates)。

证书是在 Azure Key Vault 中自签名和生成的。如果我使用 Azure 门户添加证书但它无法使用 ARM 模板添加，它会按预期工作。

部署期间使用了以下指南： TLS termination with Key Vault certificates and Pass sensitive values

Parameters.json 文件:

"app-gateway-httpsvaultCert": {
  "reference": {
    "keyVault": {
      "id": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/rg-projeX-dev-infra/providers/Microsoft.KeyVault/vaults/kv-ProjectX-dev"
    },
    "secretName": "zzz-zzz-zzz-zzz"
  }
},

在模板文件中将参数定义为安全字符串：

"app-gateway-httpsvaultCert": {
        "type": "securestring",
        "metadata": {
            "description": "Secure access string from Azure Application Gateway to Key Vault."
        }
    },

Template.json 文件:

{
        "type": "Microsoft.Network/applicationGateways",
        "apiVersion": "2020-11-01",
        "name": "[variables('app-gateway-name')]",
        "location": "[parameters('location')]",
        "tags": "[parameters('resource-Tags')]",           
        "dependsOn": [
            "[resourceId('Microsoft.Insights/components', variables('app-insights-name'))]",
            "[resourceId('Microsoft.Network/publicIPAddresses', variables('public-ip-name'))]",
            "[resourceId('Microsoft.Network/virtualNetworks', variables('vnet-name'))]",
            "[resourceId('Microsoft.KeyVault/vaults', variables('kv-name'))]"
        ],
        "identity": {
            "type": "UserAssigned",
            "userAssignedIdentities": {
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('appgw-managed-id'))]": {
                }
            }
        },
        "properties": {
            "sku": {
                "name": "Standard_v2",
                "tier": "Standard_v2",
                "capacity": "[parameters('app-gateway-capacity')]"
            },
            "gatewayIPConfigurations": [
                {
                    "name": "appGatewayIpConfig",
                    "properties": {
                        "subnet": {
                            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet-name'), 'appgw-subnet')]"
                        }
                    }
                }
            ],
            "sslCertificates": [
                {
                    "name": "appGwSslCert",
                    "properties": {
                        "keyVaultSecretId": "[parameters('app-gateway-httpsvaultCert')]"
                    }
                }
            ],
            "trustedRootCertificates": [],
            "frontendIPConfigurations": [
                {
                    "name": "appGwPublicFrontendIp",
                    "properties": {
                        "privateIPAllocationMethod": "Dynamic",
                        "publicIPAddress": {
                            "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('public-ip-name'))]"
                        }
                    }
                }
            ],
            "frontendPorts": [
                {
                    "name": "port_443",
                    "properties": {
                        "port": 443
                    }
                }
            ],
            "backendAddressPools": [
                {
                    "name": "gatewayBackEnd",
                    "properties": {
                        "backendAddresses": [
                            {
                                "fqdn": "[concat(variables('apim-name'), '.azure-api.net')]"
                            },
                            {
                                "fqdn": "[concat(variables('fr-name'), '.cognitiveservices.azure.com')]"
                            }
                        ]
                    }
                }
            ],
            "backendHttpSettingsCollection": [
                {
                    "name": "global-gateway-https-setting",
                    "properties": {
                        "port": 443,
                        "protocol": "Https",
                        "cookieBasedAffinity": "Disabled",
                        "pickHostNameFromBackendAddress": true,
                        "requestTimeout": 20,
                        "probe": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/probes', variables('app-gateway-name'), 'global-gateway-probe')]"
                        }
                    }
                }
            ],
            "httpListeners": [
                {
                    "name": "global-listener-https",
                    "properties": {
                        "frontendIPConfiguration": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/frontEndIPConfigurations', variables('app-gateway-name'), 'appGwPublicFrontendIp')]"
                        },
                        "frontendPort": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/frontEndPorts', variables('app-gateway-name'), 'port_443')]"
                        },
                        "protocol": "Https",
                        "sslCertificate": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates', variables('app-gateway-name'), 'appGwSslCert')]"
                        },
                        "hostNames": [],
                        "requireServerNameIndication": false
                    }
                }
            ],
            "urlPathMaps": [],
            "requestRoutingRules": [
                {
                    "name": "global-routing-rule",
                    "properties": {
                        "ruleType": "Basic",
                        "httpListener": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('app-gateway-name'), 'global-listener-https')]"
                        },
                        "backendAddressPool": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('app-gateway-name'), 'gatewayBackEnd')]"
                        },
                        "backendHttpSettings": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('app-gateway-name'), 'global-gateway-https-setting')]"
                        }
                    }
                }
            ],
            "probes": [
                {
                    "name": "global-gateway-probe",
                    "properties": {
                        "protocol": "Https",
                        "port": 443,
                        "path": "/status-0123456789abcdef",
                        "interval": 30,
                        "timeout": 30,
                        "unhealthyThreshold": 3,
                        "pickHostNameFromBackendHttpSettings": true,
                        "minServers": 0
                    }
                }
            ],
            "rewriteRuleSets": [],
            "redirectConfigurations": [],
            "privateLinkConfigurations": [],
            "sslPolicy": {
                "policyType": "Predefined",
                "policyName": "AppGwSslPolicy20170401S"
            },
            "enableHttp2": true
        }
    },

Answer 1

已解决相应更改 template.json 和 parameters.json 文件的问题：

Template.json:

"app-gateway-httpsvaultCert": {
    "type": "String",
    "defaultValue": "https://[KeyVaultName].vault.azure.net/secrets/[CertName]",
    "metadata": {
        "description": "The base-64 encoded SSL certificate PFX data. Must be supplied via a parameters file references to a Key Vault / Secret Name."
    }
}

Parameters.json:

"app-gateway-httpsvaultCert": {
  "value": 
  "https://[KeyVaultName].vault.azure.net/secrets/[CertName]"
}

应用程序网关与 Azure Key Vault 集成问题

Application Gateway integration with Azure Key Vault issue

azure

ssl-certificate

azure-keyvault

azure-application-gateway