ACI mount gitrepo-url using Managed Identity from Azure DevOps

Question

Is it possible to use Managed Identity to access a repo in DevOps on az container create ?

I have the following, although the continer hangs on build:

az container create `
--resource-group rgname`
--name con-name `
--location centralus `
--os-type Linux `
--acr-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--assign-identity $(az identity show --name mi-name --resource-group rg-name --query id --output tsv) `
--image acrurl.azurecr.io/img:tag `
--cpu 1 `
--memory 1 `
--restart-policy Never `
--command-line "/bin/bash -c 'cd home/site/repo; git checkout docker-mi; dbt debug'" `
--protocol TCP `
--ports 80 `
--gitrepo-url "https://dev.azure.com/org/devops/_git/dbtproject" `
--gitrepo-mount-path home/site `

when using, the below I can build and connect the continer fine:

--gitrepo-url "https://azurereposuser:[email protected]/org/devops/_git/dbtproject" `
--gitrepo-mount-path home/site 

I'd like to use MI instead of a token.

Any pointers would be much appreciated

Answer 1

To use a Managed Identity (MI), to access repositories in Azure DevOps, you need to configure like as below:

1. In the target Azure DevOps organization, go to "Organization Settings" > "Users" page to add the MI as a user into the organization, and ensure the MI at least has Basic access level assigned.

2. Add the MI as a member into the projects where the repositories are in, and ensure the MI at least has Read permissions on the repositories.

3. Then you need to acquire an access token for the MI. The details steps to acquire the access token, see "Get a Microsoft Entra ID token".

4. Then you can use this access token to call Azure DevOps REST API, Azure DevOps CLI, and related git commands to access the repositories in the target Azure DevOps organization.

For more details, you can refer to the documentation "Use service principals & managed identities in Azure DevOps".

---