我们可以使用托管身份将 Ruby On Rails 中的主动存储连接到 Azure 吗？

Question

我已经阅读了这篇文章：- https://hix.dev/tutorials/ruby-on-rails/active-storage#azure-rails-configuration

导轨侧配置

azure:
  service: AzureStorage
  storage_account_name: <%= ENV['AZURE_STORAGE_ACCOUNT_NAME'] %>
  storage_access_key: <%= ENV['AZURE_STORAGE_ACCESS_KEY'] %>
  container: <%= ENV['AZURE_STORAGE_CONTAINER'] %>

此外，我正在关注这篇有关使用托管身份连接天蓝色存储的文章。 https://github.com/azure/azure-storage-ruby/tree/master/blob#access-token

所以，我尝试了以下配置

azure:
  service: AzureStorage
  storage_account_name: <%= VaultService.get_secret("AZURE-STORAGE::AZURE-STORAGE-ACCOUNT-NAME") %>
  signer: <%= Storage::Azure::Client.get_token_signer %> 
  container: <%= VaultService.get_secret('AZURE-ATTACHMENTS-BUCKET-NAME') %>

为了获得 signer 值，我按照上面附加的 github 链接操作。

      def self.get_token_signer
        # https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/tutorial-windows-vm-access-storage-sas#get-an-access-token-using-the-vms-identity-and-use-it-to-call-azure-resource-manager
        # https://github.com/azure/azure-storage-ruby/tree/master/blob#access-token
        access_token = AzureAd::ManagedIdentityTokenProvider.new('https://storage.azure.com/', client_id: ENV['AKS_MANAGED_IDENTITY_ID']).get_authentication_header.split(' ').last
        # Creating an instance of `Azure::Storage::Common::Core::TokenCredential`
        token_credential = ::Azure::Storage::Common::Core::TokenCredential.new access_token
        token_signer = ::Azure::Storage::Common::Core::Auth::TokenSigner.new token_credential
        token_signer
      end

AzureAd::ManagedIdentityTokenProvider，为此我参考了这段代码 https://github.com/Azure/azure-sdk-for-ruby/blob/master/runtime/ms_rest_azure/lib/ms_rest_azure/credentials/msi_token_provider.rb

我收到以下错误

##[error]#38 6.433 Errno::ECONNREFUSED: Connection refused - connect(2) for "169.254.169.254" port 80
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `initialize'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `open'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `block in connect'
##[error]#38 6.433 /usr/local/bundle/gems/timeout-0.3.2/lib/timeout.rb:189:in `block in timeout'
##[error]#38 6.433 /usr/local/bundle/gems/timeout-0.3.2/lib/timeout.rb:196:in `timeout'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1269:in `connect'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-instrumentation-net_http-0.19.4/lib/opentelemetry/instrumentation/net/http/patches/instrumentation.rb:59:in `block in connect'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace/tracer.rb:29:in `block in in_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace.rb:82:in `block in with_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/context.rb:87:in `with_value'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace/tracer.rb:29:in `in_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-instrumentation-net_http-0.19.4/lib/opentelemetry/instrumentation/net/http/patches/instrumentation.rb:58:in `connect'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1248:in `do_start'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1237:in `start'

有人可以帮忙吗？用上面的方法可以连接主动存储吗？

Answer 1

不幸的是，Azure SDK for ruby 已被弃用。作为参考，请检查此文档。

目前只有 Azure 存储 SDK 正在运行，该 SDK 将在 2024 年 9 月之前可用，因此无法获取访问令牌并通过 Azure Active Directory 进行身份验证。我认为不可能使用托管身份进行授权。 作为参考，请检查此文档。

据我所知，目前只能使用访问密钥来访问存储帐户。

我能够使用主键访问并使用访问键执行操作。

我的代码

test.rb

：

require 'azure/storage/blob'  
  
  
storage_account='blobbinding'  
storage_key = 'bl6mr2k440Kg6xxxxxxxxxxxxxxxxxxxxx'  
  
client = Azure::Storage::Blob::BlobService.new(storage_account_name:storage_account, storage_access_key:storage_key)  
  
# Create a container  
container = client.create_container('metrics')

OUTPUT

:

Answer 2

Azure Ruby SDK 和 Rails Azure Active Storage 适配器已弃用。 Rails 将在 8.1 中移除适配器

查看 azure-blob：https://github.com/testdouble/azure-blob。