如何为容器“使用”.env变量”创建Azure应用程序服务？

Question

我已经使用Azure应用程序服务从容器注册表中的docker容器部署了一个Python web应用程序。在我的应用程序中，我使用dotenv加载机密，并在本地运行docker run --env-file=.env my-container来传递.env变量，但我真的不知道在部署到Azure时如何执行

我使用dotenv的方式如下：

import os
from dotenv import load_dotenv

load_dotenv()

SERVER = os.getenv("SERVER_NAME")
DATABASE = os.getenv("DB_NAME")
USERNAME = os.getenv("USERNAME")
PASSWORD = os.getenv("PASSWORD")
PORT = os.getenv("PORT", default=1433)
DRIVER = os.getenv("DRIVER")

如何让容器获取.env变量

我已经将这些秘密添加到Azure Key Vault，但我不确定如何将它们传递到容器

Answer 1

关于向Dockerfile传递变量，请检查我的答案here

请在from之后添加参数

FROM alpine

ARG serverName
RUN echo $serverName

然后像这样运行它

- task: Docker@2
  inputs:
    containerRegistry: 'devopsmanual-acr'
    command: 'build'
    Dockerfile: 'stackoverflow/85-docker/DOCKERFILE'
    arguments: ' build-arg a_version=$(SERVER_NAME)'

在从KeyVault获取值方面，您可以使用Azure Key Vault task

# Azure Key Vault
# Download Azure Key Vault secrets
- task: AzureKeyVault@1
  inputs:
    azureSubscription: 
    keyVaultName: 
    secretsFilter: '*'
    runAsPreJob: false # Azure DevOps Services only

请注意，此任务创建的by deault变量被标记为机密，因此它们不会映射到环境变量

You can still try to use your approach but first you need to map it.

- powershell: |
    Write-Host "Using an input-macro works: $(mySecret)"
    Write-Host "Using the env var directly does not work: $env:MYSECRET"
    Write-Host "Using a global secret var mapped in the pipeline does not work either: $env:GLOBAL_MYSECRET"
    Write-Host "Using a global non-secret var mapped in the pipeline works: $env:GLOBAL_MY_MAPPED_ENV_VAR" 
    Write-Host "Using the mapped env var for this task works and is recommended: $env:MY_MAPPED_ENV_VAR"
  env:
    MY_MAPPED_ENV_VAR: $(mySecret) # the recommended way to map to an env variable