Azure ACR-如何通过terraform分配服务原则？

尝试将分配给Azure容器注册表无效。州政府声明如下

您可以将服务主体分配给注册表，并且您的应用程序或服务可以使用它进行无头身份验证

我希望通过terraform实现这一点，但我在

我希望找到一个

service\u principal

节，比如在

---

我是不是想错了？在服务主体如何发挥作用方面，似乎和许多Azure资源存在脱节。我认为应该归咎于不断发展的API，但这似乎是一个简单的问题。。。也许我在这里完全不靠谱。想法？

AKS和ACR与服务负责人之间有些不同

对于AKS，它需要为访问ACR的POD或服务创建一个秘密，该秘密在yaml文件中设置。因此，它同时需要客户端id和客户端机密

但对于ACR，您需要一个具有特定权限的服务主体，以便其他人访问它。因此，您只需使用权限设置和客户端id将服务主体分配给ACR。地形代码如下所示：

resource "azurerm_resource_group" "rg" {
  name     = "resourceGroup1"
  location = "West US"
}

resource "azurerm_container_registry" "acr" {
  name                   = "containerRegistry1"
  resource_group_name    = "${azurerm_resource_group.rg.name}"
  location               = "${azurerm_resource_group.rg.location}"
  sku                    = "Premium"
  admin_enabled          = false
  georeplication_locations = ["East US", "West Europe"]
}

resource "azurerm_azuread_service_principal" "test" {
  application_id = "${azurerm_azuread_application.test.application_id}"
}

resource "azurerm_azuread_service_principal_password" "test" {
  service_principal_id = "${azurerm_azuread_service_principal.test.id}"
  value                = "VT=uSgbTanZhyz@%nL9Hpd+Tfay_MRV#"
  end_date             = "2020-01-01T01:02:03Z"
}

resource "azurerm_role_assignment" "test" {
  scope              = "${azurerm_container_registry.acr.id}"
  role_definition_id = "Contributor"
  principal_id       = "${azurerm_azuread_service_principal_password.test.service_principal_id}"
}

---

有关更多详细信息，请参阅。希望这对你有帮助。如果您需要更多帮助，请告诉我。

还有问题吗？很好，有道理。是的，我确实做到了。我得到的未经授权的错误与一个坏的cli软件包无关，这是一个骗人的把戏。升级消除了noauth错误。但是，是的，服务主体确实可以对注册表进行身份验证-谢谢！

resource "azurerm_kubernetes_cluster" "test" {

  // [...]

  service_principal {
    client_id     = "00000000-0000-0000-0000-000000000000"
    client_secret = "00000000000000000000000000000000"
  }
}

resource "azurerm_resource_group" "rg" {
  name     = "resourceGroup1"
  location = "West US"
}

resource "azurerm_container_registry" "acr" {
  name                   = "containerRegistry1"
  resource_group_name    = "${azurerm_resource_group.rg.name}"
  location               = "${azurerm_resource_group.rg.location}"
  sku                    = "Premium"
  admin_enabled          = false
  georeplication_locations = ["East US", "West Europe"]
}

resource "azurerm_azuread_service_principal" "test" {
  application_id = "${azurerm_azuread_application.test.application_id}"
}

resource "azurerm_azuread_service_principal_password" "test" {
  service_principal_id = "${azurerm_azuread_service_principal.test.id}"
  value                = "VT=uSgbTanZhyz@%nL9Hpd+Tfay_MRV#"
  end_date             = "2020-01-01T01:02:03Z"
}

resource "azurerm_role_assignment" "test" {
  scope              = "${azurerm_container_registry.acr.id}"
  role_definition_id = "Contributor"
  principal_id       = "${azurerm_azuread_service_principal_password.test.service_principal_id}"
}