Skip to content

Instantly share code, notes, and snippets.

@guitarrapc
Last active June 2, 2020 22:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save guitarrapc/84675379912cf2ef2f1b68577b3b2f75 to your computer and use it in GitHub Desktop.
Save guitarrapc/84675379912cf2ef2f1b68577b3b2f75 to your computer and use it in GitHub Desktop.
trying use VMSS MSI to mount azure file share on Ubuntu 16.04, but failed.
resource "azurerm_role_definition" "custom_share" {
name = "custom_share"
scope = "${data.azurerm_resource_group.current.id}"
description = "This is a custom role created via Terraform"
permissions {
actions = [
"*",
"*/read",
]
not_actions = [
"Microsoft.Authorization/*/Delete",
"Microsoft.Authorization/*/Write",
"Microsoft.Authorization/elevateAccess/Action",
]
data_actions = [
"*",
"*/read",
]
}
assignable_scopes = [
"${data.azurerm_resource_group.current.id}",
]
}
resource "azurerm_role_assignment" "webap_vmss" {
scope = "${azurerm_storage_account.juizstoragevmss.id}"
#role_definition_name = "Contributor"
role_definition_id = "${azurerm_role_definition.custom_share.id}"
principal_id = "${lookup(azurerm_virtual_machine_scale_set.webap_vmss.identity[0], "principal_id")}"
}
YOUR AWESOME VMSS TERRAFORM
//<storage_account>.file.core.windows.net/<file_share> /storage/data/<to> cifs nofail,vers=3.0,credentials=/etc/smbcredentials/token.cred,dir_mode=0777,file_mode=0777,serverino 0 0
username=<msi_client_id>
password=<msi_access_token>
#!/bin/bash
curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fstorage.azure.com%2F' -H Metadata:true | jq '.client_id,.access_token' -r
#!/bin/bash
sudo mount -a
#!/bin/bash
umount -a
@guitarrapc
Copy link
Author

when mount cifs with mount -a following error will happen.

Converted password too long!
error 1 (Operation not permitted) opening credential file /etc/smbcredentials/token.cred

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment