Skip to content

Commit f4d0236

Browse files
dlepowdlepow
committed
simplified KV access policy
1 parent fecba5f commit f4d0236

File tree

1 file changed

+35
-100
lines changed

1 file changed

+35
-100
lines changed

‎articles/container-registry/container-registry-transfer-images.md

Lines changed: 35 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Storage authentication uses SAS tokens, managed as secrets in key vaults. The pi
5454

5555
### Things to know
5656
* The ExportPipeline and ImportPipeline will typically be in different Active Directory tenants associated with the source and destination clouds. This scenario requires separate managed identities and key vaults for the export and import resources. For testing purposes, these resources can be placed in the same cloud, sharing identities.
57-
* ExportPipelines and ImportPipelines also support system-assigned identities. In this case, assign the identity permissions to your key vault after the ExportPipeline resource is created and before running.
57+
* The pipeline examples create system-assigned managed identities to access key vault secrets. ExportPipelines and ImportPipelines also support user-assigned identities. In this case, you must configure the key vaults with access policies for the identities.
5858

5959
## Create and store SAS keys
6060

@@ -89,16 +89,6 @@ az keyvault secret set \
8989
--vault-name $SOURCE_KV
9090
```
9191

92-
In the command output, take note of the secret's URI (`id`). You use the URI in the export pipelines. The following example uses the [az keyvault secret show][az-keyvault-secret-show] command to store the value in the EXPORT_KV_URI variable:
93-
94-
```azurecli
95-
EXPORT_KV_URI=$(az keyvault secret show \
96-
--name acrexportsas \
97-
--vault-name $SOURCE_KV \
98-
--query 'id' \
99-
--output tsv)
100-
```
101-
10292
### Generate SAS token for import
10393

10494
Run the [az storage container generate-sas][az-storage-container-generate-sas] command to generate a SAS token for the container in the target storage account, used for artifact import.
@@ -128,70 +118,6 @@ az keyvault secret set \
128118
--vault-name $TARGET_KV
129119
```
130120

131-
In the command output, take note of the secret's URI (`id`). You use the URI in the export pipelines. The following example uses the [az keyvault secret show][az-keyvault-secret-show] command to store the value in the IMPORT_KV_URI variable:
132-
133-
```azurecli
134-
IMPORT_KV_URI=$(az keyvault secret show \
135-
--name acrimportsas \
136-
--vault-name $TARGET_KV \
137-
--query 'id' \
138-
--output tsv)
139-
```
140-
141-
## Create identities
142-
143-
Create user-assigned managed identities to access source and target key vaults by running the [az identity create][az-identity-create] command.
144-
145-
```azurecli
146-
# Managed identity to access source vault
147-
az identity create \
148-
--resource-group $SOURCE_RG \
149-
--name sourceId
150-
151-
# Managed identity to access target vault
152-
az identity create \
153-
--resource-group $TARGET_RG \
154-
--name targetId
155-
```
156-
157-
Set the following variables using the [az identity show][az-identity-show] command:
158-
159-
```azurecli
160-
SOURCE_PR_ID=$(az identity show \
161-
--resource-group $SOURCE_RG \
162-
--name sourceId --query principalId --output tsv)
163-
164-
SOURCE_RES_ID=$(az identity show \
165-
--resource-group $SOURCE_RG \
166-
--name sourceId --query id --output tsv)
167-
168-
TARGET_PR_ID=$(az identity show \
169-
--resource-group $TARGET_RG \
170-
--name targetId --query principalId --output tsv)
171-
172-
TARGET_RES_ID=$(az identity show \
173-
--resource-group $TARGET_RG \
174-
--name targetId --query id --output tsv)
175-
```
176-
177-
## Grant each identity access to key vault
178-
179-
Run the [az keyvault set-policy][az-keyvault-set-policy] command to grant the source and target identities access to their respective key vaults:
180-
181-
```azurecli
182-
# Source key vault
183-
az keyvault set-policy --name $SOURCE_KV \
184-
--resource-group $SOURCE_RG \
185-
--object-id $SOURCE_PR_ID \
186-
--secret-permissions get
187-
188-
# Target key vault
189-
az keyvault set-policy --name $TARGET_KV \
190-
--resource-group $TARGET_RG \
191-
--object-id $TARGET_PR_ID \
192-
--secret-permissions get
193-
```
194-
195121
## Create ExportPipeline with Resource Manager
196122

197123
Create an ExportPipeline resource for your source container registry using Azure Resource Manager template deployment. The ExportPipeline resource is provisioned with the source user-assigned identity you created in the previous section.
@@ -205,15 +131,16 @@ Enter the following parameter values in the file `azuredeploy.parameters.json`:
205131
|registryName | Name of your source container registry |
206132
|exportPipelineName | Name you choose for the export pipeline |
207133
|targetUri | URI of the storage container in your source environment (the target of the export pipeline).<br/>Example: `https://sourcestorage.blob.core.windows.net/transfer` |
208-
|keyVaultUri | URI of the SAS token secret in the source key vault, stored previously in the EXPORT_KV_URI variable. <br/>Example: `https://sourcevault.vault-int.azure-int.net/secrets/acrexportsas/xxxxxxxxxx` |
134+
|keyVaultName | Name of the source key vault |
135+
|sasTokenSecretName | Name of the SAS token secret in the source key vault <br/>Example: acrexportsas
209136

210137
### Export options
211138

212-
The `Options` property for the export pipelines supports optional boolean values. The following values are recommended:
139+
The `options` property for the export pipelines supports optional boolean values. The following values are recommended:
213140

214141
|Parameter |Description |
215142
|---------|---------|
216-
|Options | OverwriteBlobs - Existing target blobs are overwritten<br/>ContinueOnErrors - Continue export of remaining artifacts in the source registry if one artifact export fails.
143+
|options | OverwriteBlobs - Existing target blobs are overwritten<br/>ContinueOnErrors - Continue export of remaining artifacts in the source registry if one artifact export fails.
217144

218145
### Create the resource
219146

@@ -224,14 +151,17 @@ az deployment group create \
224151
--resource-group $SOURCE_RG \
225152
--template-file azuredeploy.json \
226153
--name exportPipeline \
227-
--parameters azuredeploy.parameters.json \
228-
--parameters userAssignedIdentity=$SOURCE_RES_ID
154+
--parameters azuredeploy.parameters.json
229155
```
230156

231-
Take note of the resource ID (`id`) of the pipeline, which is used in later steps. Example:
157+
In the command output, take note of the resource ID (`id`) of the pipeline. You can store this value in an environment variable for later use by running the [az deployment group show][az-deployment-group-show]. For example:
232158

233-
```
234-
"/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.ContainerRegistry/registries/<sourceRegistryName>/exportPipelines/myExportPipeline"
159+
```azurecli
160+
EXPORT_RES_ID=$(az group deployment show \
161+
--resource-group $SOURCE_RG \
162+
--name exportPipeline \
163+
--query 'properties.outputResources[1].id' \
164+
--output tsv)
235165
```
236166

237167
## Create ImportPipeline with Resource Manager
@@ -247,15 +177,16 @@ Parameter |Value |
247177
|registryName | Name of your target container registry |
248178
|importPipelineName | Name you choose for the import pipeline |
249179
|sourceUri | URI of the storage container in your target environment (the source for the import pipeline).<br/>Example: `https://targetstorage.blob.core.windows.net/transfer/`|
250-
|keyVaultUri | URI of the SAS token secret in the target key vault, stored previously in the IMPORT_KV_URI variable.<br/>Example: `https://targetvault.vault-int.azure-int.net/secrets/acrimportsas/xxxxxxxxxx` |
180+
|keyVaultName | Name of the target key vault |
181+
|sasTokenSecretName | Name of the SAS token secret in the target key vault<br/>Example: acr importsas |
251182

252183
### Import options
253184

254-
The `Options` property for the import pipeline supports optional boolean values. The following values are recommended:
185+
The `options` property for the import pipeline supports optional boolean values. The following values are recommended:
255186

256187
|Parameter |Description |
257188
|---------|---------|
258-
|Options | OverwriteTags - Existing target tags are overwritten<br/>DeleteSourceBlobOnSuccess - Delete the source storage blob after successful import to the target registry<br/>ContinueOnErrors - Continue import of remaining artifacts in the target registry if one artifact import fails.
189+
|options | OverwriteTags - Existing target tags are overwritten<br/>DeleteSourceBlobOnSuccess - Delete the source storage blob after successful import to the target registry<br/>ContinueOnErrors - Continue import of remaining artifacts in the target registry if one artifact import fails.
259190

260191
### Create the resource
261192

@@ -266,25 +197,22 @@ az deployment group create \
266197
--resource-group $TARGET_RG \
267198
--template-file azuredeploy.json \
268199
--parameters azuredeploy.parameters.json \
269-
--name importPipeline \
270-
--parameters userAssignedIdentity=$TARGET_RES_ID
271-
```
272-
273-
If you plan to run the import manually, take note of the resource ID (`id`) of the pipeline, which is used in later steps. Example:
274-
275-
```
276-
"/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.ContainerRegistry/registries/<sourceRegistryName>/importPipelines/myImportPipeline
200+
--name importPipeline
277201
```
278202

279-
It can take several minutes for artifacts to import. When the import completes successfully, verify artifact import by listing the repositories in the target container registry. For example, run [az acr repository list][az-acr-repository-list]:
203+
If you plan to run the import manually, take note of the resource ID (`id`) of the pipeline. You can store this value in an environment variable for later use by running the [az deployment group show][az-deployment-group-show]. For example:
280204

281205
```azurecli
282-
az acr repository list --name <target-registry-name>
206+
IMPORT_RES_ID=$(az group deployment show \
207+
--resource-group $TARGET_RG \
208+
--name importPipeline \
209+
--query 'properties.outputResources[1].id' \
210+
--output tsv)
283211
```
284212

285213
## Create PipelineRun with Resource Manager
286214

287-
Create a PipelineRun resource for your source container registry using Azure Resource Manager template deployment. This resource runs the ExportPipeline resource you created in the previous step, and exports specified artifacts from your container registry as a blob to your source storage account.
215+
Create a PipelineRun resource for your source container registry using Azure Resource Manager template deployment. This resource runs the ExportPipeline resource you created previously, and exports specified artifacts from your container registry as a blob to your source storage account.
288216

289217
Copy PipelineRun Resource Manager [template files](https://github.com/Azure/acr/tree/master/docs/image-transfer/PipelineRun) to a local folder.
290218

@@ -296,7 +224,7 @@ Enter the following parameter values in the file `azuredeploy.parameters.json`:
296224
|pipelineRunName | Name you choose for the run |
297225
|pipelineResourceId | Resource ID of the export pipeline.<br/>Example: `/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.ContainerRegistry/registries/<sourceRegistryName>/exportPipelines/myExportPipeline`|
298226
|targetName | Name you choose for the artifacts blob exported to your source storage account, such as *myblob*
299-
|artifacts | Array of source artifacts to transfer, as tags or manifest digests<br/>Example: `[samples/hello-world:v1", "samples/nginx:v1"]`
227+
|artifacts | Array of source artifacts to transfer, as tags or manifest digests<br/>Example: `[samples/hello-world:v1", "samples/nginx:v1"]` |
300228

301229
Run [az deployment group create][az-deployment-group-create] to create the PipelineRun resource. The following example names the deployment *exportPipelineRun*.
302230

@@ -333,11 +261,17 @@ azcopy sync \
333261
--recursive
334262
```
335263

336-
If you enabled the `sourceTriggerStatus` parameter of the import pipeline (the default value), the import pipeline will trigger. Import may take place after several minutes.
264+
## Trigger ImportPipeline resource
265+
266+
If you enabled the `sourceTriggerStatus` parameter of the ImportPipeline (the default value), the pipeline is triggered after the blob is copied to the target storage account. It can take several minutes for artifacts to import. When the import completes successfully, verify artifact import by listing the repositories in the target container registry. For example, run [az acr repository list][az-acr-repository-list]:
267+
268+
```azurecli
269+
az acr repository list --name <target-registry-name>
270+
```
337271

338272
If you didn't enable the `sourceTriggerStatus` parameter of the import pipeline, run the ImportPipeline resource manually, as shown in the following section.
339273

340-
### Run the ImportPipeline resource manually (optional)
274+
### Run ImportPipeline resource manually (optional)
341275

342276
You can also use a PipelineRun resource to trigger an ImportPipeline for artifact import to your target container registry.
343277

@@ -413,6 +347,7 @@ az deployment group delete \
413347
[az-storage-blob-list]: /cli/azure/storage/blob#az-storage-blob-list
414348
[az-deployment-group-create]: /cli/azure/deployment/group#az-deployment-group-create
415349
[az-deployment-group-delete]: /cli/azure/deployment/group#az-deployment-group-delete
350+
[az-deployment-group-show]: /cli/azure/deployment/group#az-deployment-group-show
416351
[az-acr-repository-list]: /cli/azure/acr/repository#az-acr-repository-list
417352

418353

0 commit comments

Comments
 (0)