Multicontainer Azure WebApp not working with Managed Identity

Question

Scenario/repro

I have multicontainer (tutorial here) azure web app. I assigned System Assigned identity to my web app. There are two containers in my docker compose:

Net core WebApi container
Antivirus ClamAv container

Everything had worked fine (my API is using antivirus to scan files) till the moment I add key vault Configuration provider with Managed Identity for Azure resources (link). This works perfectly with my standard web apps on linux.

// Program.cs
.ConfigureAppConfiguration((context, config) =>
{
  if (context.HostingEnvironment.IsProduction())
  {
    var builtConfig = config.Build();
    var secretClient = new SecretClient(new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
    new DefaultAzureCredential());
    config.AddAzureKeyVault(secretClient, new KeyVaultSecretManager());
  }
})

Problem My API returns 503 status code. It seems that I need to do some extra configuration to make it work with Docker compose.

EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
2021-06-14T11:42:46.912167603Z - ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.
2021-06-14T11:42:46.912175503Z - Operating system Linux 5.4.0-1031-azure #32~18.04.1-Ubuntu SMP Tue Oct 6 10:03:22 UTC 2020 isn't supported.
2021-06-14T11:42:46.912183204Z - Stored credentials not found. Need to authenticate user in VSCode Azure Account.
2021-06-14T11:42:46.912190304Z - Azure CLI not installed
2021-06-14T11:42:46.912197204Z - PowerShell is not installed.
2021-06-14T11:42:46.912205004Z ---> System.AggregateException: Multiple exceptions were encountered 
...
Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
...
Azure.Identity.CredentialUnavailableException: Operating system Linux 5.4.0-1031-azure #32~18.04.1-Ubuntu SMP Tue Oct 6 10:03:22 UTC 2020 isn't supported.

It seems that this feature is not fully supported. Any idea how to use key vault proivder in such scenario?

Please confirm if you have granted get and list permissions to the Managed Identity on the key vault secret resources. Here is the snippet from the tutorial you mentioned in your post: az keyvault set-policy --name {KEY VAULT NAME} --object-id {OBJECT ID} --secret-permissions get list — Mohsin Mehmood
– Mohsin Mehmood, Commented Jun 14, 2021 at 14:42
Yes I did. As I mentioned this works perfectly with my standard web apps. The problem is with docker compose apps. Exception details says that error is in web app environment. — zolty13
– zolty13, Commented Jun 14, 2021 at 15:44
Check if this helps: stackoverflow.com/questions/62817337/… — Mohsin Mehmood
– Mohsin Mehmood, Commented Jun 14, 2021 at 16:15
Web app environment set this variables on its own. It is not visible by user e.g. in Kudu — zolty13
– zolty13, Commented Jun 14, 2021 at 16:32

Kevin Evans · Accepted Answer · 2021-08-16 20:23:10Z

2

Managed identities are not supported in multicontainer apps. See: https://learn.microsoft.com/en-us/answers/questions/118045/are-managed-identities-for-multi-container-webapps.html

answered Aug 16, 2021 at 20:23

Kevin Evans

362 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Multicontainer Azure WebApp not working with Managed Identity

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related