python - Azure Functions 中的凭据、传递一个凭据还是根据需要调用？

Question

我的耐用功能应用程序间歇性出现凭据问题。

ManagedIdentityCredential will use App Service managed identity

EnvironmentCredential.get_token failed: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.

DefaultAzureCredential - EnvironmentCredential is unavailable

在每个事件中我调用DefaultAzureCredential

# some activity function
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()

def my_func()...

在我的协调器中创建一个凭证一次并将其传递给我的事件会更好吗？我也在使用系统分配的身份，因此我应该使用 ManagedIdentityCredential 来避免 DefaultAzureCredential 所做的常量检查吗？

from azure.identity import ManagedIdentityCredential
import azure.durable_functions as df


def orchestrator_function(context: df.DurableOrchestrationContext):
    
    # Create the credentials
    credentials = ManagedIdentityCredential()

    # Pass it to my activity instead of my activity creating its own
    activity = yield context.call_activity("my_activity", credentials)
    

Answer 1

Would it be better to create a credential in my orchestrator, once, and pass it around to my activities?

据我了解，如果您的Orchestrator function调用Activity function多次，最好通过Credential在 Orchestrator function ;如果只调用一次，我认为创建一个 Credential 是一样的在 Activity function .

I am also using system assigned identity, so should I use ManagedIdentityCredential instead to avoid the constant checks DefaultAzureCredential does?

如果您使用System assigned identity ，可以直接使用ManagedIdentityCredential ，因为DefaultAzureCredential将检查多个身份，直到其中一个提供 token 。

为了更好的理解，可以引用这个official document .

EnvironmentCredential is unavailable是由 DefaultAzureRedential 引起的无法从 EnvironmentCredential 请求 token ，这是预期的结果。