目录
1新建AKV vk03-MSI
2新建VM01
3在VM的identity进行设置
4在key vault中设置access policy
5部署在VM01上的应用，就能够访问到AKV了
6通过RDP连接上VM01
6通过远程桌面连接 连接到VM01
7 SSH连接上VM
8 在VM上获取key vault中的secret ，并且不使用密码！！
10、直接通过powershell访问
11、在VM上直接HTTP请求
12、编写java代码并部署到VM上也可不通过密码获取secret
使用MI从AKV获取secret
1新建AKV vk03-MSI
2新建VM01
其他默认create
3在VM的identity进行设置
system asign -on
生成了Object(principal) ID, 复制这个ID
4在key vault中设置access policy
access policy
add access policy
secret management
选择权限
select principal
选择VM01 ，或者输入刚才复制的 Object(principal) ID 来搜索
5部署在VM01上的应用，就能够访问到AKV了
6通过RDP连接上VM01
打开VM并开启3389端口用于RDP连接
点击overview，connect，然后点击RDP，然后下载RDP文件，下载完成后打开，会提示输入用户名和密码，就是create VM的时候自己输入的，然后成功连接上了VM
6通过远程桌面连接 连接到VM01
在自己电脑上搜索并打开
输入VM overview中的Public IP address 也可以同样连接上VM
7 SSH连接上VM
之前新建的虚拟机的windows的，需要新建linux的虚拟机才行，我这重新建了个Ubuntu的虚拟机
其他默认，然后下载私钥并创建
然后同样的如xindows虚拟机一样，开启system托管标识,并且去key vault设置访问策略。
回到vm02，点击连接，SSH
打开XSHELL，新建会话，输入用户名，然后选择刚才下载的SSH文件即可
8 在VM上获取key vault中的secret ，并且不使用密码！！
VM上安装powershell
详谈Ubuntu PowerShell(小白入门必看教程) | 使用
pwsh
Install-Module Az
Import-Module Az
Connect-AzAccount -Identity
遇到个报错，报错的原因是因为新建key vault和VM时，选择的位置不同，所以我新建个位置在east-asia的kv04-MSI，并给他配置了
PS /home/azureuser> Install-Module Az
Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet.
Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): Y
PS /home/azureuser> Import-Module Az
PS /home/azureuser> Connect-AzAccount -Identity
Account SubscriptionName TenantId Environment
------- ---------------- -------- -----------
MSI@50342 9c6f33c6-0a22-45e9-b129-78843f81e5f8 AzureCloud
//获取值并保存到本机
PS /home/azureuser> $secret = Get-AzKeyVaultSecret -VaultName kv04-MSI -Name SQLConnectionString
//打印值
PS /home/azureuser> $secret.SecretValue |ConvertFrom-SecureString -AsPlainText
666666666666666666666666
可以看到，已经成功的在这台VM上获取到了key vault kv04-MSI中的值了。
9、编写java程序，并部署在VM02上，并且从kv04-MSI中获取值
VM上已经能够获取到KV中的值了。
在powershell中，将secret保存到txt中
PS /home/azureuser> $secret.SecretValue |ConvertFrom-SecureString -AsPlainText |Out-File xxx.txt -Encoding utf8 PS /home/azureuser> ls a.py jdk-8u212-linux-x64.tar.gz module software xxx.txt PS /home/azureuser> cat ./xxx.txt 666666666666666666666666
安装jdk
编写java程序从txt中读取想要的值
PS /home/azureuser> vim test.java PS /home/azureuser> javac ./test.java PS /home/azureuser> java test 666666666666666666666666 PS /home/azureuser> ls a.py jdk-8u212-linux-x64.tar.gz module software test.class test.java xxx.txt
import java.io.*;
public class test {
public static void main(String args[]) throws IOException {
String filePath = "/home/azureuser/xxx.txt";
FileInputStream fin = new FileInputStream(filePath);
InputStreamReader reader = new InputStreamReader(fin);
BufferedReader buffReader = new BufferedReader(reader);
String strTmp = "";
while ((strTmp = buffReader.readLine()) != null) {
System.out.println(strTmp);
}
buffReader.close();
}
}
暂时完成。
方法有点丑，暂时实现了不需要密码从key vault获取secret了，对powershell熟悉的话可以学下永久设置成环境变量，那java代码直接读取环境变量就行了。还可以编写sh文件自动执行脚本，不需手输。
垃圾微软云！！！！！真难用
========================================================
拓展：
将secret保存到环境变量中，方便java程序调用
10、直接通过powershell访问
教程：使用托管标识访问 Azure Key Vault - Windows - Azure AD - Microsoft Entra | Microsoft Docs
11、在VM上直接HTTP请求
教程`：`使用托管标识访问 Azure Key Vault - Linux - Azure AD - Microsoft Entra | Microsoft Docs
通过SSH登上VM
在终端窗口中，使用 CURL 向 Azure 资源终结点的本地托管标识发出请求，以获取 Azure Key Vault 的访问令牌。 下面是用于获取访问令牌的 CURL 请求。
azureuser@vmtest0614:~$ curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true
//返回的令牌信息
{"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImpTMVhvMU9XRGpfNTJ2YndHTmd2UU8yVnpNYyIsImtpZCI6ImpTMVhvMU9XRGpfNTJ2YndHTmd2UU8yVnpNYyJ9.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tLyIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzljNmYzM2M2LTBhMjItNDVlOS1iMTI5LTc4ODQzZjgxZTVmOC8iLCJpYXQiOjE2NTUyMDkwMzAsIm5iZiI6MTY1NTIwOTAzMCwiZXhwIjoxNjU1Mjk1NzMwLCJhaW8iOiJFMlpnWU9pSjUvdFRjM242dmY2ZmhRa0NoLzg3QWdBPSIsImFwcGlkIjoiZjRkMmRkYWEtNWQ0NS00OGUyLWI4MzAtMDNiODhiMDU3YWE2IiwiYXBwaWRhY3IiOiIyIiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvOWM2ZjMzYzYtMGEyMi00NWU5LWIxMjktNzg4NDNmODFlNWY4LyIsImlkdHlwIjoiYXBwIiwib2lkIjoiMTU0MzExM2UtNmQ4Ny00ZTBiLTlkMGQtODBlMTc3Y2I0YzQyIiwicmgiOiIwLkFYRUF4ak52bkNJSzZVV3hLWGlFUDRIbC1FWklmM2tBdXRkUHVrUGF3ZmoyTUJPSEFBQS4iLCJzdWIiOiIxNTQzMTEzZS02ZDg3LTRlMGItOWQwZC04MGUxNzdjYjRjNDIiLCJ0aWQiOiI5YzZmMzNjNi0wYTIyLTQ1ZTktYjEyOS03ODg0M2Y4MWU1ZjgiLCJ1dGkiOiIzTXI1SjF5bTJrYUJpQmUtSVVaakFBIiwidmVyIjoiMS4wIiwieG1zX21pcmlkIjoiL3N1YnNjcmlwdGlvbnMvMWUwODRlNDQtODZjYi00NDY5LWE3YjQtMTQ0Mjg1ZjBmMmNiL3Jlc291cmNlZ3JvdXBzL3JndGVzdDA2MTQvcHJvdmlkZXJzL01pY3Jvc29mdC5Db21wdXRlL3ZpcnR1YWxNYWNoaW5lcy92bXRlc3QwNjE0IiwieG1zX3RjZHQiOiIxNjUzNDgwMDA1In0.iqPWMbiCpp-Gbda3XAtkzdWoXm-iVA4SqIioHSy3_S75FramxbVR3qfMKH0MLp8ZPy4X9gh010UQN04Np__Q6EX8Cug8OVrVS_tj2OxQ9VWEHCyADcZ86i-IH8TPHz5j4DfB3Mlg9bQY-g1cC55nBL0lenbpnMC0PeOopiYrAoSMO2MYeOyrda-FLAtENKw7DZ9khsUpI8gt-vt8aqAky3V4O9G5Vxz-tDDlRbcCxuPyu4M4ZIi2APWfgdprnaLCseAY6sGkD1aTyzQJ6KNFWA0zxc1S_gz2ZSoWiJ8kjwsUmqPBv2W6hLgsd2Xk3tFtYp6uz00bLfUwswSz1hR7Xg","client_id":"f4d2ddaa-5d45-48e2-b830-03b88b057aa6","expires_in":"86400","expires_on":"1655295730","ext_expires_in":"86399","not_before":"1655209030","resource":"https://management.azure.com/","token_type":"Bearer"}
将令牌格式化之后为
{
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImpTMVhvMU9XRGpfNTJ2YndHTmd2UU8yVnpNYyIsImtpZCI6ImpTMVhvMU9XRGpfNTJ2YndHTmd2UU8yVnpNYyJ9.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tLyIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzljNmYzM2M2LTBhMjItNDVlOS1iMTI5LTc4ODQzZjgxZTVmOC8iLCJpYXQiOjE2NTUyMDkwMzAsIm5iZiI6MTY1NTIwOTAzMCwiZXhwIjoxNjU1Mjk1NzMwLCJhaW8iOiJFMlpnWU9pSjUvdFRjM242dmY2ZmhRa0NoLzg3QWdBPSIsImFwcGlkIjoiZjRkMmRkYWEtNWQ0NS00OGUyLWI4MzAtMDNiODhiMDU3YWE2IiwiYXBwaWRhY3IiOiIyIiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvOWM2ZjMzYzYtMGEyMi00NWU5LWIxMjktNzg4NDNmODFlNWY4LyIsImlkdHlwIjoiYXBwIiwib2lkIjoiMTU0MzExM2UtNmQ4Ny00ZTBiLTlkMGQtODBlMTc3Y2I0YzQyIiwicmgiOiIwLkFYRUF4ak52bkNJSzZVV3hLWGlFUDRIbC1FWklmM2tBdXRkUHVrUGF3ZmoyTUJPSEFBQS4iLCJzdWIiOiIxNTQzMTEzZS02ZDg3LTRlMGItOWQwZC04MGUxNzdjYjRjNDIiLCJ0aWQiOiI5YzZmMzNjNi0wYTIyLTQ1ZTktYjEyOS03ODg0M2Y4MWU1ZjgiLCJ1dGkiOiIzTXI1SjF5bTJrYUJpQmUtSVVaakFBIiwidmVyIjoiMS4wIiwieG1zX21pcmlkIjoiL3N1YnNjcmlwdGlvbnMvMWUwODRlNDQtODZjYi00NDY5LWE3YjQtMTQ0Mjg1ZjBmMmNiL3Jlc291cmNlZ3JvdXBzL3JndGVzdDA2MTQvcHJvdmlkZXJzL01pY3Jvc29mdC5Db21wdXRlL3ZpcnR1YWxNYWNoaW5lcy92bXRlc3QwNjE0IiwieG1zX3RjZHQiOiIxNjUzNDgwMDA1In0.iqPWMbiCpp-Gbda3XAtkzdWoXm-iVA4SqIioHSy3_S75FramxbVR3qfMKH0MLp8ZPy4X9gh010UQN04Np__Q6EX8Cug8OVrVS_tj2OxQ9VWEHCyADcZ86i-IH8TPHz5j4DfB3Mlg9bQY-g1cC55nBL0lenbpnMC0PeOopiYrAoSMO2MYeOyrda-FLAtENKw7DZ9khsUpI8gt-vt8aqAky3V4O9G5Vxz-tDDlRbcCxuPyu4M4ZIi2APWfgdprnaLCseAY6sGkD1aTyzQJ6KNFWA0zxc1S_gz2ZSoWiJ8kjwsUmqPBv2W6hLgsd2Xk3tFtYp6uz00bLfUwswSz1hR7Xg",
"client_id": "f4d2ddaa-5d45-48e2-b830-03b88b057aa6",
"expires_in": "86400",
"expires_on": "1655295730",
"ext_expires_in": "86399",
"not_before": "1655209030",
"resource": "https://management.azure.com/",
"token_type": "Bearer"
}
12、编写java代码并部署到VM上也可不通过密码获取secret
教程`：`使用托管标识访问 Azure Key Vault - Linux - Azure AD - Microsoft Entra | Microsoft Docs
Azure Identity client library for Java | Microsoft Docs
这里一定要里一个概念，这些云上的东西底层封装得太死了，比如新建java项目的时候，引入了azure的包，这个项目必须到之前开启了system managed identity的那台azure虚拟机上才行，然后直接调用包内提供的方法，会自动调用虚拟机后台去azure AD验证授权并且获取访问之前设置了access policy的key vault的token，而且这个token是直接存在框架里的，很不直观，构建了一个SecretClient，然后可以通过这个SecretClient对相应的key vault进行CRUD操作，能进行哪些操作还要看之前access policy中add的时候允许了一些什么。
从头开始理以下步骤：
创建VM，设置identity获取objectID（principle ID）
创建Key Vault，设置access policy，创建secret
本地编写java代码，打包后部署到VM上即可，开放对应的端口
访问测试
上述步骤依次完成后的截图
主要代码如下：
依赖包：
4.0.0 org.springframework.boot spring-boot-starter-parent2.6.8 com.example msikeyvault0.0.1-SNAPSHOT msikeyvault msikeyvault 1.8 org.springframework.boot spring-boot-starter-weborg.projectlombok lomboktrue org.springframework.boot spring-boot-starter-testtest com.azure azure-identity1.5.2 com.azure azure-security-keyvault-secrets4.4.1 org.springframework.boot spring-boot-maven-pluginorg.projectlombok lombok
package com.example.msikeyvault.test;
import com.azure.identity.ManagedIdentityCredential;
import com.azure.identity.ManagedIdentityCredentialBuilder;
import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;
import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
@Slf4j
@Service
public class ManagedIdentity {
// public void createManagedIdentityCredential() {
// ManagedIdentityCredential managedIdentityCredential = new ManagedIdentityCredentialBuilder()
// .clientId("") // only required for user assigned
// .build();
//
// // Azure SDK client builders accept the credential as a parameter
// SecretClient client = new SecretClientBuilder()
// .vaultUrl("https://{YOUR_VAULT_NAME}.vault.azure.net")
// .credential(managedIdentityCredential)
// .buildClient();
// KeyVaultSecret secrettest = client.getSecret("secrettest");
//
// System.out.println(secrettest.getValue());
// }
public String createManagedIdentityCredential() {
ManagedIdentityCredential managedIdentityCredential = new ManagedIdentityCredentialBuilder()
.build();
// Azure SDK client builders accept the credential as a parameter
SecretClient client = new SecretClientBuilder()
.vaultUrl("https://mykv0614.vault.azure.net")
.credential(managedIdentityCredential)
.buildClient();
KeyVaultSecret secrettest = client.getSecret("secrettest");
System.out.println(secrettest.getValue());
return secrettest.getValue();
}
}
package com.example.msikeyvault;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class MsikeyvaultApplication {
public static void main(String[] args) {
SpringApplication.run(MsikeyvaultApplication.class, args);
}
}
完整代码地址：
https://github.com/hebian1994/msikeyvault.git
