Comments (8)
Thank you for opening this issue, we will look into it.
from azure-cli-extensions.
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @calvinsID.
from azure-cli-extensions.
Hi @omni-htg
I checked the error log, error code is ForbiddenByFirewall
.
error message:
Client address is not authorized and caller is not a trusted service
You can refer this to authorize the client address IP(The managed environment's OutBoundIP) to the key vault:
https://stackoverflow.com/questions/52985252/client-address-is-not-authorized-and-caller-is-not-a-trusted-service-in-azure
from azure-cli-extensions.
Thank you for looking into this, @Greedygre .
When you mention
The managed environment's OutBoundIP
do you mean the Static Ip ?
I currently have my Container Apps (and environment) in a subnet on the same VNet as the KeyVault.
What I did not do was:
- Add that Static Ip to the Firewall IP list.
- Add the
Azure.KeyVault
service endpoint to the Container Apps subnet.
What is in place is:
- The "Allow trusted Microsoft services to bypass this firewall" exception.
- The Container Apps themselves seem to be able to access the KeyVault when adding a secret (or at least, they get added and don't report any issues).
I will do some trial and error on my side, but any confirmation on yours would be greatly appreaciated!
If possible, I'd love to avoid having to add the CAE IP to the Firewall.
On another note, is it intended that I don't recieve the error message ForbiddenByFirewall
on the CLI, and that the "latest" extension is not using the latest API version?
Thanks a ton!
from azure-cli-extensions.
ForbiddenByFirewall
Hi @omni-htg
The ForbiddenByFirewall
is not shown in CLI now.
The OutBoundIP
, you can get it from your containerapp with command:
az containerapp show -n {} -g {} --query "properties.outboundIpAddresses"
from azure-cli-extensions.
In my environment, the CAE is an Internal one, only available to the VNet where all the other Azure services (including the KeyVault) have been set up -- I believe this is why properties.outboundIpAddresses
is null
.
I have tried to add the staticIp
property from the CAE into the Firewall IP list in the KV, but was disallowed for it being a "private IP".
Please advise.
from azure-cli-extensions.
Can I know what you mean “I currently have my Container Apps (and environment) in a subnet on the same VNet as the KeyVault.”?
Azure keyvault supports add vnet/private endpoint, can you add Container apps env subnet to the allow list or create private endpoint for AKV, then container apps can access AKV via private endpoint.
thanks
Vincent
from azure-cli-extensions.
I apologize, tried to explain in a quick fashion and made it more convoluted.
Azure keyvault supports add vnet/private endpoint, can you add Container apps env subnet to the allow list
This is exactly what was needed.
Initially I had the KV as part of the VNet by "allowing" a KeyVault-specific Subnet, completely missing the point.
Once I added the Container Apps subnet it worked flawlessly.
So now I can close this, thank you!
I'll leave with the suggestion that, if possible, add a more verbose message on Azure Portal and CLI when it gets blocked by the Firewall like in my case.
from azure-cli-extensions.
Related Issues (20)
- Support --allow-insecure option in az containerapp compose create command HOT 4
- [az containerapp compose create] Support to enable Managed Identities for accessing to Azure App Configuration HOT 2
- [ az ml online-endpoint create ] can not create an Endpoint with a previously used name. HOT 1
- [az confcom acipolicygen] Command raises a sys.exit() after generation of the policy HOT 1
- AttributeError: module 'azure.core.pipeline.policies' has no attribute 'SensitiveHeaderCleanupPolicy' HOT 2
- Unable to utilize the az ml workspace update command HOT 7
- {Package} Upgrade setuptools and wheel to the latest version. HOT 2
- `az monitor data-collection rule update` fails updating stream declaration HOT 2
- [Bug]: `az network bastion ssh` does not allow configuration of ssh-client-folder HOT 3
- [az storage azcopy blob download] Expose azcopy's `--overwrite` parameter HOT 1
- serviceconnector-passwordless fails for sql HOT 8
- vm-repair: Invalid image "UbuntuLTS" HOT 3
- az network bastion create --vnet-name does not accept resource Id HOT 1
- az connectedk8s proxy fails with bad CPU on Mac M3 HOT 3
- `az extension list-available` is super slow - Store index.json somewhere else? HOT 2
- Preview versions in `index.json` is not valid semantic versions HOT 2
- Az Network Bastion RDP --configure switch HOT 4
- az vm repair create can fail due to policy restrictions HOT 4
- AKS App Routing Commands Fail with 2024-06-02-preview API HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from azure-cli-extensions.