已配置Azure AD RBAC的AKS的Azure DevOp管道身份验证? [英] Azure DevOp Pipelines authentication to AKS with Azure AD RBAC configured?

问题描述

我们已经将Azure Kubernetes群集配置为使用Azure Active Directory RBAC.这意味着在使用kubectl时，我们首先需要以AD用户身份进行身份验证(通常通过通过Web浏览器手动完成设备代码身份验证来完成).我们几乎完全按照MSDN文章将Azure Active Directory与Azure集成进行配置Kubernetes服务.

We have configured our Azure Kubernetes Clusters to use Azure Active Directory RBAC. This means when using kubectl we need to first authenticate as an AD user (usually done through manually completing device code authentication via the web browser). We have configured this almost exactly as per the MSDN article Integrate Azure Active Directory with Azure Kubernetes Service.

问题在于，Azure DevOp管道中的Kubernetes构建/发布任务现在也需要此身份验证，例如，当我们运行kubectl apply时:

The issue is that this authentication is now also required for Kubernetes build/release tasks in Azure DevOp Pipelines, for example when we run kubectl apply:

2019-01-02T08:48:21.2070286Z ##[section]Starting: kubectl apply
2019-01-02T08:48:21.2074936Z ==============================================================================
2019-01-02T08:48:21.2075160Z Task         : Deploy to Kubernetes
2019-01-02T08:48:21.2075398Z Description  : Deploy, configure, update your Kubernetes cluster in Azure Container Service by running kubectl commands.
2019-01-02T08:48:21.2075625Z Version      : 1.1.17
2019-01-02T08:48:21.2075792Z Author       : Microsoft Corporation
2019-01-02T08:48:21.2076009Z Help         : [More Information](https://go.microsoft.com/fwlink/?linkid=851275)
2019-01-02T08:48:21.2076245Z ==============================================================================
2019-01-02T08:48:25.7971481Z Found tool in cache: kubectl 1.7.0 x64
2019-01-02T08:48:25.7980222Z Prepending PATH environment variable with directory: C:\agents\HephaestusForge\_work\_tool\kubectl\1.7.0\x64
2019-01-02T08:48:25.8666111Z [command]C:\agents\HephaestusForge\_work\_tool\kubectl\1.7.0\x64\kubectl.exe apply -f C:\agents\HephaestusForge\_work\r8\a\_MyProject\kubernetes\deploy.yaml -o json
2019-01-02T08:48:26.3518703Z To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code CUYYYYYVV to authenticate.

对此有什么解决方法?是否可以让Azure DevOps将自身身份验证为服务器客户端而不是AD客户端?

What is a workaround for this? Is it possible to have Azure DevOps authenticate itself as a server client instead of an AD client?

推荐答案

您可以使用不需要交互式登录的管理员配置文件，但不幸的是绕过了您可能已设置的任何RBAC控件.

You can use the admin profile which doesn't require interactive login but unfortunately bypasses any RBAC controls you may have setup.

在这里投票: 查看全文