使用 Terraform 的 Azure 容器注冊表權限

Question

使用 terraform 設置azurerm_container_registry ，我想知道如何更改某些用戶的權限（例如ReadOnly ），或者創建一個可以從我的 CI-Pipeline 使用但根本不需要用戶的access_key 。

Answer 1

此 Terraform 配置創建 ACR 注冊表和 Azure 服務主體，並授予 SP contributor訪問 ACR 注冊表的權限。 這可以更新給reader 。

可以在此處找到有關 ACR 身份驗證和服務主體的更多信息。

resource "azurerm_resource_group" "acr-rg" {
  name     = "acr-rg-007"
  location = "West US"
}

resource "azurerm_container_registry" "acr" {
  name                = "acr00722"
  resource_group_name = "${azurerm_resource_group.acr-rg.name}"
  location            = "${azurerm_resource_group.acr-rg.location}"
  sku                 = "standard"
}

resource "azurerm_azuread_application" "acr-app" {
  name = "acr-app"
}

resource "azurerm_azuread_service_principal" "acr-sp" {
  application_id = "${azurerm_azuread_application.acr-app.application_id}"
}

resource "azurerm_azuread_service_principal_password" "acr-sp-pass" {
  service_principal_id = "${azurerm_azuread_service_principal.acr-sp.id}"
  value                = "Password12"
  end_date             = "2020-01-01T01:02:03Z"
}

resource "azurerm_role_assignment" "acr-assignment" {
  scope                = "${azurerm_container_registry.acr.id}"
  role_definition_name = "Contributor"
  principal_id         = "${azurerm_azuread_service_principal_password.acr-sp-pass.service_principal_id}"
}

output "docker" {
  value = "docker login ${azurerm_container_registry.acr.login_server} -u ${azurerm_azuread_service_principal.acr-sp.application_id} -p ${azurerm_azuread_service_principal_password.acr-sp-pass.value}"
}