容器中的Terraform azure cli身份验证

Question

我想创建容器，我将在其中运行我的terraform命令。我的dockerfile看起来像这样：

FROM mcr.microsoft.com/azure-cli
RUN apk add curl
ENV TERRAFORM_VERSION 0.12.21
RUN curl -sL https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip -o tf.zip \
  && unzip tf.zip \
  && mv terraform /sbin/ \
  && rm -rf tf.zip

我的main.tf看起来像这样：

provider "azurerm" {
  version         = "~>1.44"
  subscription_id = "xxx"
}
provider "azuread" {
  version = "~>0.6.0"
}
terraform {
  backend "azurerm" {}
}

我通常在Windows主机上执行的操作是az login，然后

terraform init \
    -backend-config=storage_account_name=xxx \
    -backend-config=container_name=terraform-state \
    -backend-config=access_key="xxx" \
    -backend-config=key=app.tfstate

问题是，当我在docker容器中执行同样的操作时，运行如下所示的docker run --rm -ti <IMAGE_ID> bash，而不是成功初始化，我得到奇怪的错误，如下所示：

Error: Failed to get existing workspaces: storage: service returned error: StatusCode=403, ErrorCode=AuthenticationFailed, ErrorMessage=Server failed to authenticate the request. Make sure the value of 
Authorization header is formed correctly including the signature.

这是不是与

Answer 1

由于某些未知的原因，当我使用ubuntu:18.04镜像代替mcr.microsoft.com/azure-cli并自己安装az时，一切都开始工作了。

FROM ubuntu:18.04
RUN apt update && apt install -y curl jq wget unzip ca-certificates gnupg lsb-release apt-transport-https 

# Install Azure CLI
COPY azure-cupi.pub /root/.ssh/azure-cupi.pub
RUN curl -sL https://aka.ms/InstallAzureCLIDeb | bash
RUN curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.asc.gpg > /dev/null
RUN AZ_REPO=$(lsb_release -cs) && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list
RUN apt update && apt install -y azure-cli

# Install Terraform
ARG TERRAFORM_VERSION="0.12.22"
RUN cd /tmp && \
    wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip && \
    unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip -d /usr/bin && \
    rm -rf /tmp/* && \
    rm -rf /var/cache/apk/* && \
    rm -rf /var/tmp/*

我没有发现显著的区别。