Access to Azure Keyvault inside Azure Container Instance WebApi

Use Linux images. Deploy the .NET app into a Linux container. Is Windows one of your requirements?

Hi @Miguel, Thanks for the update.

I have deployed linux image and able to access the keyvault using managed identity.

However, I have few of questions.

1. Linux container is going to failed state after invoking first time and we need restart that again. any idea on it?
2. https://video2.skills-academy.com/en-us/azure/container-instances/container-instances-managed-identity -> As per this link, windows supports user-assigned managed idenity. I created a identity but unable to access. Am I doing correct scenario?
3. I created nomal image using .NET 8 and deployed as container Instace. Unable to access to it( .NET 8 images)
   1. 

Hello again @Balanjaneyulu Kantu (Quadrant Technologies) . Follow these steps to get a working example:

1. Go to the portal and open the Cloud Shell in bash mode
2. Set the environment variables

export AZ_RESOURCE_GROUP_NAME="mfc-resource-group"
export AZ_KEY_VAULT_NAME="mfc-key-vault"
export AZ_SECRET_NAME="top-secret"
export AZ_SECRET_VALUE="Top secret"
export AZ_USER_IDENTITY_NAME="mfc-user-identity"
export AZ_CONTAINER_NAME="mfc-container"

3. Double check all environment variables are set

env | grep AZ_

4. Create the Resource Group

az group create \
  --name $AZ_RESOURCE_GROUP_NAME \
  --location eastus

5. Create the Key Vault and get the resource id

az keyvault create \
  --name $AZ_KEY_VAULT_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME \
  --location eastus

AZ_KEY_VAULT_RESOURCE_ID=$(az keyvault show \
  --name $AZ_KEY_VAULT_NAME \
  --query id \
  --output tsv)

6. Assign to current user the role of Key Vault Administrator in order to add the secret

AZ_CURRENT_USER_PRINCIPAL_NAME=$(az ad signed-in-user show \
  --query userPrincipalName \
  --output tsv)

az role assignment create \
  --role "Key Vault Key Vault Administrator" \
  --assignee $AZ_CURRENT_USER_PRINCIPAL_NAME \
  --scope $AZ_KEY_VAULT_RESOURCE_ID

7. Add new secret

az keyvault secret set \
  --name $AZ_SECRET_NAME \
  --value "$AZ_SECRET_VALUE" \
  --vault-name $AZ_KEY_VAULT_NAME

8. Add an identity

az identity create \
  --name $AZ_USER_IDENTITY_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME

9. Get the principal id and the resource id of the identity

AZ_IDENTITY_PRINCIPAL_ID=$(az identity show \
  --name $AZ_USER_IDENTITY_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME \
  --query principalId \
  --output tsv)

AZ_IDENTITY_RESOURCE_ID=$(az identity show \
  --name $AZ_USER_IDENTITY_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME \
  --query id \
  --output tsv)

10. Add a role assignment to the identity in the Key Vault

az role assignment create \
  --role "Key Vault Secrets User" \
  --assignee $AZ_IDENTITY_PRINCIPAL_ID \
  --scope $AZ_KEY_VAULT_RESOURCE_ID

11. Now, you can check the identity has the role in the Key Vault
12. Create the Container. I used the azure-cli image with only the purpose to show the secret.

az container create \
  --name $AZ_CONTAINER_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME \
  --image mcr.microsoft.com/azure-cli \
  --assign-identity $AZ_IDENTITY_RESOURCE_ID \
  --restart-policy Never \
  --command-line "/bin/sh -c \"az login --identity && az keyvault secret show --name $AZ_SECRET_NAME --vault-name $AZ_KEY_VAULT_NAME\""

13. Wait for the container creation and check the log:

az container logs \
  --name $AZ_CONTAINER_NAME \
  --resource-group $AZ_RESOURCE_GROUP_NAME

Hope this helps, Miguel.