将 Azure 密钥保险库配置为密码存储

使用 EKS/AKS 上的服务主体或工作负载身份身份验证，将 Azure 密钥保险库配置为密码存储。

您可以使用以下方法之一将 Azure 密钥保险库配置为密码存储：

• 服务主体身份验证
• 工作负载身份身份验证

默认情况下，所有敏感数据都在input.json中定义。您可以将此数据分为两部分：

• input.json - 仅包含配置数据。
• Azure 密钥保险库 - 安全存储凭据。

备注：

无法将证书路径或与证书相关的凭据作为密码存储区的一部分存储。

重要提示：

在配置密码存储之前， input.json中引用的所有凭据必须作为密码存在于 Azure 密钥保管库中。如果 Azure 密钥保险库中缺少任何引用的凭据，安装将失败。

使用服务主体身份验证

要使用服务主体身份验证将 Azure 密钥保险库配置为密码存储库，请执行以下步骤：

1. 为了使uipathctl能够识别凭据存储在 Azure 密钥保管库中，您必须将密码存储部分添加到input.json ，如以下示例所示：

   "secret_store": {
     "enabled": true,
     "provider_configs": [
       {
         "type": "azure",
         "credentials_secret_name": "azure-service-principal-secret",
         "refresh_interval": "5m",
         "name": "azure-secret-store",
         "environment_type": "PublicCloud",
         "azure_kv": {
           "vault_url": "https://eso-azure-kv.vault.azure.net/",
           "tenant_id": "00000000-0000-0000-0000-000000000000"
         }
       }
     ]
   }
   

2. 创建一个用于存储 Azure 服务主体凭据的 Kubernetes 密码，如以下示例所示：

   apiVersion: v1
   kind: Secret
   metadata:
     name: azure-service-principal-secret
   type: Opaque
   stringData:
     clientId: <client-id>
     clientSecret: <client-secret>
   

3. 使用以下命令在uipath命名空间中部署密码：

   kubectl apply -f azure-service-principal-secret -n uipath
   

4. 使用以下格式更新input.json中的凭据值，以引用存储在 Azure 密钥保管库中的密码：

   vault/<vault-name>/<key-stored-in-the-vault>
   

   其中：

   • vault - 静态关键字。
   • vault-name - secret_store.provider_configs[i].name的值（例如azure-secret-store ）。
   • key-stored-in-the-vault - Azure 密钥保险库中存储的密码的名称。更改之前，您的凭据可能如下所示：

   "admin_username": "admin",
   "admin_password": "password",
   

   将它们更新为引用 Azure 密钥保险库后，这些值应如下所示：

   "admin_username": "vault/azure-secret-store/admin-username-1234",
   "admin_password": "vault/azure-secret-store/admin-password-1234",
   

   下图显示了存储在 Azure Key Vault 中的密码。

   

以下示例显示了input.json配置，其凭据存储在 Azure 密钥保险库（只读）中。

{
  "admin_password": "vault/azure-secret-store/admin-password-1234",
  "admin_username": "vault/azure-secret-store/admin-username-1234",
  "apps": {
    "enabled": true,
    "external_object_storage": {
      "account_key": "vault/azure-secret-store/apps-external-object-storage-account-key-1234",
      "account_name": "as-storage-account",
      "azure_fqdn_suffix": "core.windows.net",
      "bucket_name": "uipath-as-platform",
      "create_bucket": true,
      "enabled": true,
      "region": "us-east-1",
      "storage_type": "azure",
      "use_instance_profile": true
    }
  },
  "exclude_components": [],
  "external_object_storage": {
    "account_key": "vault/azure-secret-store/external-object-storage-account-key-1234",
    "account_name": "as-storage-account",
    "azure_fqdn_suffix": "core.windows.net",
    "create_bucket": true,
    "enabled": true,
    "region": "us-east-1",
    "storage_type": "azure",
    "use_instance_profile": true
  },
  "fabric": {
    "redis": {
      "hostname": "redis-cache.mycompany.com",
      "password": "vault/azure-secret-store/fabric-redis-password-1234",
      "port": 6380,
      "tls": true
    }
  },
  "fqdn": "automationsuite.mycompany.com",
  "infra": {
    "docker_registry": {}
  },
  "ingress": {
    "gateway_selector": {
      "istio": "ingressgateway"
    },
    "service_annotations": {
      "service.beta.kubernetes.io/azure-load-balancer-internal": "false",
      "service.beta.kubernetes.io/azure-load-balancer-ipv4": "ip-address"
    }
  },
  "install_type": "online",
  "integrationservices": {
    "enabled": true,
    "external_object_storage": {
      "bucket_name": "uipath-as-platform"
    }
  },
  "istioMinProtocolVersion": "TLSV1_3",
  "kubernetes_distribution": "aks",
  "orchestrator": {
    "enabled": true,
    "external_object_storage": {
      "account_key": "vault/azure-secret-store/orchestrator-external-object-storage-account-key-1234",
      "account_name": "os-storage-account",
      "azure_fqdn_suffix": "core.windows.net",
      "bucket_name": "uipath-as-orchestrator",
      "create_bucket": true,
      "enabled": true,
      "region": "us-east-1",
      "storage_type": "azure",
      "use_instance_profile": true
    },
    "sql_connection_str": "vault/azure-secret-store/orchestrator-sql-connection-str-1234",
    "testautomation": {
      "enabled": true
    },
    "updateserver": {
      "enabled": true
    }
  },
  "platform": {
    "enabled": true
  },
  "pod_identity": {
    "aks_managed_identity_client_id": "client-id",
    "enabled": true
  },
  "postgresql_connection_string_template_sqlalchemy_pyodbc": "vault/azure-secret-store/postgresql-connection-string-template-sqlalchemy-pyodbc-1234",
  "profile": "ha",
  "proxy": {
    "enabled": true,
    "http_proxy": "\u003c\u003chttp://\u003cPROXY-SERVER-IP\u003e\u003e:\u003cPROXY-PORT\u003e",
    "https_proxy": "\u003c\u003chttp://\u003cPROXY-SERVER-IP\u003e\u003e:\u003cPROXY-PORT\u003e",
    "no_proxy": "paste list from Configuring the cluster section"
  },
  "registries": {
    "docker": {
      "password": "",
      "pull_secret_name": "registry-credentials",
      "url": "registry.uipath.com",
      "username": ""
    },
    "helm": {
      "password": "",
      "url": "registry.uipath.com",
      "username": ""
    }
  },
  "secret_store": {
    "enabled": true,
    "secret_name": "",
    "provider_configs": [
      {
        "type": "azure",
        "credentials_secret_name": "azure-service-principal-secret",
        "is_default": true,
        "refresh_interval": "5m",
        "name": "azure-secret-store",
        "azure_kv": {
          "vault_url": "https://eso-azure-kv.vault.azure.net/",
          "tenant_id": "00000000-0000-0000-0000-000000000000",
          "managed_identity_id": null
        },
        "aws_kv": {
          "role_arn": null
        },
        "hashicorp_kv": {}
      }
    ]
  },
  "snapshot": {
    "aks_infra_resource_group": "MC_ci-asaks4002399_ci-asaks4002399_eastus",
    "enabled": true,
    "external_object_storage": {
      "account_name": "storaccid2547865",
      "auth_mode": "ServicePrincipal",
      "bucket_name": "uipath-backup",
      "client_id": "1fbd7d95-5f8c-4f70-90a6-fdf20310d10e",
      "client_secret": "vault/azure-secret-store/snapshot-external-object-storage-client-secret-1234",
      "cloud_name": "AzurePublicCloud",
      "resource_group": "ci-asaks4002399",
      "storage_type": "azure",
      "subscription_id": "b65b0225-ce9b-4a79-9dd9-c00071d40d64",
      "tenant_id": "00000000-0000-0000-0000-000000000000"
    }
  },
  "sql_connection_string_template": "vault/azure-secret-store/sql-connection-string-template-1234",
  "sql_connection_string_template_jdbc": "vault/azure-secret-store/sql-connection-string-template-jdbc-1234",
  "sql_connection_string_template_odbc": "vault/azure-secret-store/sql-connection-string-template-odbc-1234",
  "sql_connection_string_template_sqlalchemy_pyodbc": "vault/azure-secret-store/sql-connection-string-template-sqlalchemy-pyodbc-1234",
  "storage_class": "managed-premium",
  "storage_class_single_replica": "azurefile-csi",
  "test_manager": {
    "enabled": true,
    "external_object_storage": {
      "bucket_name": "uipath-as-platform"
    }
  },
  "tolerations": []
}

配置 Azure 云环境

environment_type字段指定要用于访问密钥保管库的 Azure 云环境。此字段为可选字段，默认为PublicCloud 。

支持以下值：

值	描述
PublicCloud	Azure 公共云（默认）
USGovernmentCloud	Azure 美国政府云
ChinaCloud	Azure（中国）云
GermanCloud	Azure（德国）云

备注：

vault_url必须与 Azure 云环境匹配。例如：

• 公共云： https://<vault-name>.vault.azure.net/
• 美国政府: https://<vault-name>.vault.usgovcloudapi.net/
• 中国: https://<vault-name>.vault.azure.cn/
• 德国： https://<vault-name>.vault.microsoftazure.de/

以下示例显示了如何配置input.json中的environment_type字段：

"secret_store": {
  "enabled": true,
  "provider_configs": [
    {
      "type": "azure",
      "credentials_secret_name": "azure-service-principal-secret",
      "refresh_interval": "5m",
      "name": "azure-secret-store",
      "environment_type": "USGovernmentCloud",
      "azure_kv": {
        "vault_url": "https://eso-azure-kv.vault.azure.net/",
        "tenant_id": "00000000-0000-0000-0000-000000000000"
      }
    }
  ]
}

使用工作负载身份身份验证

您可以使用工作负载身份身份验证而不是服务主体，将 Azure 密钥保险库配置为密码存储。

Workload Identity 允许 Kubernetes Pod 访问 Azure 资源，而无需在 Kubernetes 密码中存储凭据。

根据您的设置，您可以使用适用于所有组件的全局工作负载身份，也可以专门为 Azure 密钥保险库配置单独的工作负载身份，如下所示：

• 使用全局工作负载身份

  "pod_identity": {
    "aks_managed_identity_client_id": "managed-identity-id",
    "enabled": true
  },
  "secret_store": {
    "enabled": true,
    "provider_configs": [
      {
        "type": "azure",
        "refresh_interval": "5m",
        "name": "azure-secret-store",
        "azure_kv": {
          "vault_url": "https://eso-azure-kv.vault.azure.net/"
        }
      }
    ]
  }
  

• 为 Azure 密钥保险库使用单独的工作负载身份

  "secret_store": {
    "enabled": true,
    "provider_configs": [
      {
        "type": "azure",
        "refresh_interval": "5m",
        "name": "azure-secret-store",
        "azure_kv": {
          "vault_url": "https://eso-azure-kv.vault.azure.net/",
          "managed_identity_id": "managed-identity-id"
        }
      }
    ]
  }
  

为外部密码运算符配置托管身份

要使外部 Secrets Orchestrator 能够使用工作负载身份访问 Azure 密钥保险库，请执行以下步骤：

1. 执行工作负载身份配置中描述的步骤，向所需的服务帐户提供联合凭据。

2. 除了工作负载身份配置的第 3 步之外，还请运行以下命令为外部密码运算符创建联合凭据：

   create_federated_credentials "uipath" "external-secrets"
   

3. 将所需角色分配给托管标识，以便它可以访问 Azure 密钥保险库中的密码：

   # Export the following variables with your correct values
   export SUBSCRIPTION_ID="<your-subscription-id>"
   export TARGET_RG="<your-resource-group-name>"
   export VAULT_NAME="<your-key-vault-name>"
   export USER_ASSIGNED_MANAGED_IDENTITY_OBJECT_ID="<your-managed-identity-object-id>"
   
   # Assign Key Vault roles to the managed identity
   az role assignment create --assignee $USER_ASSIGNED_MANAGED_IDENTITY_OBJECT_ID --role "Key Vault Secrets User" --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$TARGET_RG/providers/Microsoft.KeyVault/vaults/$VAULT_NAME"
   az role assignment create --assignee $USER_ASSIGNED_MANAGED_IDENTITY_OBJECT_ID --role "Key Vault Reader" --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$TARGET_RG/providers/Microsoft.KeyVault/vaults/$VAULT_NAME"
   

配置符合 OCI 的外部私有注册表

使用私有注册表时，如果您不想在input.json中配置注册表凭据，则可以将其作为 Kubernetes 密码提供，如以下示例所示：

"registries": {
  "docker": {
    "pull_secret_name": "registry-credentials",
    "url": "sfbrdevhelmweacr.azurecr.io"
  }
}

创建存储注册表凭据的 Kubernetes 密码，如以下示例所示：

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
type: Opaque
data:
  url: base64Encode(sfbrdevhelmweacr.azurecr.io)
  username: base64Encode(<registry-username>)
  password: base64Encode(<registry-password>)

使用以下命令在uipath命名空间中应用密码：

kubectl apply -f registry-credentials.yaml -n uipath