DEV Community πŸ‘©β€πŸ’»πŸ‘¨β€πŸ’»

Cover image for Deploy Azure Key Vault and Azure Container Registry for Document Signing with Notary
Josh Duffney for Microsoft Azure

Posted on

Deploy Azure Key Vault and Azure Container Registry for Document Signing with Notary

In this article, you'll deploy an Azure Key Vault and Azure Container Registry instance with Terraform.

Terraform is an infrastructure as code tool that lets you define your infrastructure resources with readable configuration files. You'll use it to deploy the necessary Azure infrastructure that your GitHub workflow depends on for signing container images.

By the end of this article, you'll have deployed all the Azure resources needed to digitally sign container images with Notary.

Create a service principal

Your GitHub workflow and Terraform both need an service principal for authenticating with Azure.

Create a new service principal by running the following az command:

az ad sp create-for-rbac --name notary-gh-sp --role contributor \
--scopes /subscriptions/<subscriptionId> --sdk-auth
Enter fullscreen mode Exit fullscreen mode

Replace subscriptionId with your Azure subscriptions Id.

TIP Store the JSON object in a secure place. You'll use it to create a credential to authenticate to Azure with the Azure Login GitHub Action.

Export Terraform environment variables

One of several ways to pass credentials to Terraform is through environment variables, without these variables Terraform will failed to authenticate to Azure.

Use the following export commands to set the necessary environment variables for the Azure Terraform provider.

export ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
export ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
export ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
export ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"
Enter fullscreen mode Exit fullscreen mode

Replace the 00000000 with the values provided in the JSON from the az ad sp create-for-rbac command.

Apply the Terraform configuration

With the service principal created and the environment variable set, you're now ready to apply the Terraform configuration.

  1. Change directories to the terraform folder.

    cd terraform
    
  2. Initialize Terraform

    terraform init
    
  3. Apply the Terraform configuration

    terraform apply
    

    When prompted type yes into the terminal and hit enter.

Terraform apply command

Create an Azure Container Registry Token

Your last task in this tutorial is to create a token that Notation, the command-line tool for Notary, will use to authenticate to the registry when signing images.

Run the following command to create an ACR token:

az acr token create \
--name exampleToken \
--registry <registryName> \
--scope-map _repositories_admin \
--query 'credentials.passwords[0].value' \
--only-show-errors \
--output tsv
Enter fullscreen mode Exit fullscreen mode

TIP Store the password value in a secure place. You'll need to store it as a GitHub secret later in the demo.

Top comments (0)

Timeless DEV post...

How to write a kickass README

Arguably the single most important piece of documentation for any open source project is the README. A good README not only informs people what the project does and who it is for but also how they use and contribute to it.

If you write a README without sufficient explanation of what your project does or how people can use it then it pretty much defeats the purpose of being open source as other developers are less likely to engage with or contribute towards it.