Reputation: 592
I'm currently trying to change the deployment model I have on my project so that I can deploy an existing Service Fabric application using ARM templates and enable Managed Identity in Azure.
During this process, I had to configure the managed identity on the application manifest:
<ManagedIdentities>
<ManagedIdentity Name="SystemAssigned" />
</ManagedIdentities>
and add identity binding policies to each of the services like so:
<Policies>
<IdentityBindingPolicy ServiceIdentityRef="KeyVaultUser" ApplicationIdentityRef="SystemAssigned" />
</Policies>
If I deploy this application manifest to Azure, I have no problems. However, locally is quite different since now I cannot deploy to my local development cluster, and this is the log of the deployment script:
>Application package is registered.
>Removing application package from image store...
>Remove application package succeeded
>Creating application...
>New-ServiceFabricApplication : Application managed identity PrincipalId cannot be null or empty.
>FileName: ManagedApplicationIdentity
>At C:\Program Files\Microsoft SDKs\Service
>Fabric\Tools\PSModule\ServiceFabricSDK\Publish-NewServiceFabricApplication.ps1:466 char:3
>+ New-ServiceFabricApplication -ApplicationName $ApplicationNam ...
>+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> + CategoryInfo : InvalidOperation: (Microsoft.Servi...usterConnection:ClusterConnection) [New-ServiceFabr
> icApplication], FabricException
> + FullyQualifiedErrorId : CreateApplicationInstanceErrorId,Microsoft.ServiceFabric.Powershell.NewApplication
>
>Finished executing script 'Deploy-FabricApplication.ps1'.
As far as I could investigate, there is no way to add the identity binding policies using the services ARM definitions, so those need to be in the manifest.
Any ideas on how to overcome this issue and be able to deploy both to Azure and local clusters?
Upvotes: 3
Views: 948