Skip to content

Commit e4a3c09

Browse files
dlepowdlepow
committed
Reverted some updates to KV scenario
1 parent 09ea99d commit e4a3c09

File tree

1 file changed

+48
-75
lines changed

1 file changed

+48
-75
lines changed

‎articles/container-registry/container-registry-tasks-authentication-key-vault.md

Lines changed: 48 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -63,26 +63,33 @@ In a real-world scenario, secrets would likely be set and maintained in a separa
6363

6464
## Define task steps in YAML file
6565

66-
The steps for this example task are defined in a [YAML file](container-registry-tasks-reference-yaml.md). Create a file named `dockerhubtask.yaml` in a local working directory and paste the following contents. Be sure to replace the `hubuser/hubrepo` alias with the name of your private repo in Docker Hub.
66+
The steps for this example task are defined in a [YAML file](container-registry-tasks-reference-yaml.md). Create a file named `dockerhubtask.yaml` in a local working directory and paste the following contents. Be sure to replace the key vault name in the file with the name of your key vault.
6767

6868
```yml
6969
version: v1.1.0
70-
# Replace hubuser/hubrepo with name of private repo in Docker Hub
71-
alias:
72-
values:
73-
REPO: hubuser/hubrepo
70+
# Replace mykeyvault with the name of your key vault
71+
secrets:
72+
- id: username
73+
keyvault: https://mykeyvault.vault.azure.net/secrets/UserName
74+
- id: password
75+
keyvault: https://mykeyvault.vault.azure.net/secrets/Password
7476
steps:
77+
# Log in to Docker Hub
78+
- cmd: bash echo '{{.Secrets.password}}' | docker login --username '{{.Secrets.username}}' --password-stdin
7579
# Build image
76-
- build: -t $REPO:$ID https://github.com/Azure-Samples/acr-tasks.git -f hello-world.dockerfile
80+
- build: -t {{.Values.PrivateRepo}}:$ID https://github.com/Azure-Samples/acr-tasks.git -f hello-world.dockerfile
7781
# Push image to private repo in Docker Hub
7882
- push:
79-
- $REPO:$ID
83+
- {{.Values.PrivateRepo}}:$ID
8084
```
8185
8286
The task steps do the following:
87+
88+
* Manage secret credentials to authenticate with Docker Hub.
89+
* Authenticate with Docker Hub by passing the secrets to the `docker login` command.
8390
* Build an image using a sample Dockerfile in the [Azure-Samples/acr-tasks](https://github.com/Azure-Samples/acr-tasks.git) repo.
84-
* Tag the image for a private Docker Hub repository
85-
* Push the image to the Docker Hub repository.
91+
* Push the image to the private Docker Hub repository.
92+
8693

8794
## Option 1: Create task with user-assigned identity
8895

@@ -135,93 +142,59 @@ az keyvault set-policy --name mykeyvault \
135142
--secret-permissions get
136143
```
137144

138-
## Add Docker Hub credentials to the task
139-
140-
Now use the [az acr task credential add][az-acr-task-credential-add] command to enable the task to authenticate with Docker Hub using the credentials accessed from the key vault. The managed identity has access to the credentials in the vault.
141-
142-
Run the command corresponding to the type of managed identity you enabled in the task. If you enabled a user-assigned identity, pass `--use-identity` with the client ID of the identity. If you enabled a system-assigned identity, pass `--use-identity [system]`.
143-
144-
```azurecli
145-
# Add credentials to task accessed with user-assigned identity
146-
az acr task credential add \
147-
--name dockerhubtask \
148-
--registry myregistry \
149-
--login-server docker.io \
150-
--username https://mykeyvault.vault.azure.net/secrets/UserName \
151-
--password https://mykeyvault.vault.azure.net/secrets/Password \
152-
--use-identity $clientID
153-
154-
# Add credentials to task accessed with system-assigned identity
155-
az acr task credential add \
156-
--name dockerhubtask \
157-
--registry myregistry \
158-
--login-server docker.io \
159-
--username https://mykeyvault.vault.azure.net/secrets/UserName \
160-
--password https://mykeyvault.vault.azure.net/secrets/Password \
161-
--use-identity [system]
162-
```
163-
164145
## Manually run the task
165146

166147
To verify that the task in which you enabled a managed identity runs successfully, manually trigger the task with the [az acr task run][az-acr-task-run] command.
167148

168149
```azurecli
169-
az acr task run --name dockerhubtask --registry myregistry
150+
az acr task run --name dockerhubtask --registry myregistry --set PrivateRepo=hubuser/hubrepo
170151
```
171152

172153
When the task runs successfully, output shows successful authentication to Docker Hub, and the image is successfully built and pushed to the private repo:
173154

174155
```console
175-
Queued a run with ID: cfr
156+
Queued a run with ID: cf24
176157
Waiting for an agent...
177-
2020/01/15 22:01:45 Alias support enabled for version >= 1.1.0, please see https://aka.ms/acr/tasks/task-aliases for more information.
178-
2020/01/15 22:01:47 Creating Docker network: acb_default_network, driver: 'bridge'
179-
2020/01/15 22:01:47 Successfully set up Docker network: acb_default_network
180-
2020/01/15 22:01:47 Setting up Docker configuration...
181-
2020/01/15 22:01:48 Successfully set up Docker configuration
182-
2020/01/15 22:01:48 Logging in to registry: myregistry.azurecr.io
183-
2020/01/15 22:01:49 Successfully logged into myregistry.azurecr.io
184-
2020/01/15 22:01:49 Logging in to registry: docker.io
185-
2020/01/15 22:01:51 Successfully logged into docker.io
186-
2020/01/15 22:01:51 Executing step ID: acb_step_0. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
187-
2020/01/15 22:01:51 Scanning for dependencies...
188-
2020/01/15 22:01:52 Successfully scanned dependencies
189-
2020/01/15 22:01:52 Launching container with name: acb_step_0
158+
2019/06/20 18:05:55 Using acb_vol_b1edae11-30de-4f2b-a9c7-7d743e811101 as the home volume
159+
2019/06/20 18:05:58 Creating Docker network: acb_default_network, driver: 'bridge'
160+
2019/06/20 18:05:58 Successfully set up Docker network: acb_default_network
161+
2019/06/20 18:05:58 Setting up Docker configuration...
162+
2019/06/20 18:05:59 Successfully set up Docker configuration
163+
2019/06/20 18:05:59 Logging in to registry: myregistry.azurecr.io
164+
2019/06/20 18:06:00 Successfully logged into myregistry.azurecr.io
165+
2019/06/20 18:06:00 Executing step ID: acb_step_0. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
166+
2019/06/20 18:06:00 Launching container with name: acb_step_0
167+
[...]
168+
Login Succeeded
169+
2019/06/20 18:06:02 Successfully executed container: acb_step_0
170+
2019/06/20 18:06:02 Executing step ID: acb_step_1. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
171+
2019/06/20 18:06:02 Scanning for dependencies...
172+
2019/06/20 18:06:04 Successfully scanned dependencies
173+
2019/06/20 18:06:04 Launching container with name: acb_step_1
174+
Sending build context to Docker daemon 129kB
190175
[...]
191-
Sending build context to Docker daemon 157.2kB
192-
Step 1/1 : FROM hello-world
193-
---> fce289e99eb9
194-
Successfully built fce289e99eb9
195-
Successfully tagged myrepo/hello-world:cfr
196-
2020/01/15 22:01:54 Successfully executed container: acb_step_0
197-
2020/01/15 22:01:54 Executing step ID: acb_step_1. Timeout(sec): 600, Working directory: '', Network: 'acb_default_network'
198-
2020/01/15 22:01:54 Pushing image: myrepo/hello-world:cfr, attempt 1
199-
The push refers to repository [docker.io/myrepo/hello-world]
200-
af0b15c8625b: Preparing
201-
af0b15c8625b: Layer already exists
202-
cfr: digest: sha256:92c7f9c92844bbbb5d0a101b22f7c2a7949e40f8ea90c8b3bc396879d95e899a size: 524
203-
2020/01/15 22:01:56 Successfully pushed image: myrepo/hello-world:cfr
204-
2020/01/15 22:01:56 Step ID: acb_step_0 marked as successful (elapsed time in seconds: 2.890404)
205-
2020/01/15 22:01:56 Populating digests for step ID: acb_step_0...
206-
2020/01/15 22:01:59 Successfully populated digests for step ID: acb_step_0
207-
2020/01/15 22:01:59 Step ID: acb_step_1 marked as successful (elapsed time in seconds: 2.852518)
208-
2020/01/15 22:01:59 The following dependencies were found:
209-
2020/01/15 22:01:59
176+
2019/06/20 18:06:07 Successfully pushed image: hubuser/hubrepo:cf24
177+
2019/06/20 18:06:07 Step ID: acb_step_0 marked as successful (elapsed time in seconds: 2.064353)
178+
2019/06/20 18:06:07 Step ID: acb_step_1 marked as successful (elapsed time in seconds: 2.594061)
179+
2019/06/20 18:06:07 Populating digests for step ID: acb_step_1...
180+
2019/06/20 18:06:09 Successfully populated digests for step ID: acb_step_1
181+
2019/06/20 18:06:09 Step ID: acb_step_2 marked as successful (elapsed time in seconds: 2.743923)
182+
2019/06/20 18:06:09 The following dependencies were found:
183+
2019/06/20 18:06:09
210184
- image:
211185
registry: registry.hub.docker.com
212-
repository: myrepo/hello-world
213-
tag: cfr
186+
repository: hubuser/hubrepo
187+
tag: cf24
214188
digest: sha256:92c7f9c92844bbbb5d0a101b22f7c2a7949e40f8ea90c8b3bc396879d95e899a
215189
runtime-dependency:
216190
registry: registry.hub.docker.com
217191
repository: library/hello-world
218192
tag: latest
219-
digest: sha256:4df8ca8a7e309c256d60d7971ea14c27672fc0d10c5f303856d7bc48f8cc17ff
193+
digest: sha256:0e11c388b664df8a27a901dce21eb89f11d8292f7fca1b3e3c4321bf7897bffe
220194
git:
221-
git-head-revision: d6a675eb39338cb3632fab648e11b8e9a9a943cb
222-
195+
git-head-revision: b0ffa6043dd893a4c75644c5fed384c82ebb5f9e
223196
224-
Run ID: cfr was successful after 22s
197+
Run ID: cf24 was successful after 15s
225198
```
226199

227200
To confirm the image is pushed, check for the tag (`cf24` in this example) in the private Docker Hub repo.

0 commit comments

Comments
 (0)