Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Support managed-identity authentication to Azure Artifacts during AML environment builds

オープン
  • 何か問題がありますか？
#49,213 コメント 0 件 リアクション 2 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
azure, python
領域
authentication, cloud, security

調査の方向性

No repository files, tests, or entry points are identified. Start by locating the AML-managed environment-build service and the existing python_feed credential flow, then determine whether this repository owns the required change. Done means Azure Artifacts Python feeds can use a configured user-assigned managed identity during AML-managed Conda/pip builds, with actionable permission errors and existing credential authentication preserved.

索引モデルが issue の本文から書いたものです。

説明

Is your feature request related to a problem? Please describe.

We use private Python packages hosted in Azure Artifacts. Developers update dependencies locally and submit Azure Machine Learning jobs directly from their machines, relying on AML to build and cache the required environments.
The documented AML python_feed connection supports PAT or username/password authentication, but not managed identity. This requires recurring renewal of a user-owned PAT and updates to the corresponding AML feed connections.
This creates operational overhead, a dependency on an employee’s credentials, and a risk of environment-build failures when credentials expire or are revoked.

Describe the solution you'd like

Support a configured user-assigned managed identity for Azure Artifacts authentication during AML-managed Conda/pip environment builds.
After one-time identity and feed-permission configuration, the developer workflow should remain:

Edit dependencies locally → submit an AML job → AML builds/caches the environment → run.

AML should acquire and renew short-lived Microsoft Entra tokens as needed, without exposing credentials in build logs or persisting them in the resulting image. Missing permissions should produce actionable errors.
This does not assume that the submitting user’s credentials or the job’s compute identity are available during environment builds. An explicitly configured environment-build identity would be appropriate.
The initial scope could be limited to Azure Artifacts Python feeds and AML-managed builds using a Conda specification with pip dependencies. Arbitrary Dockerfile builds and other package repositories can remain separate requests. Existing credential-based connections should continue to work.

Describe alternatives you've considered

  • CI-built images: Useful for production releases, but requiring a separate image-build pipeline for every dependency change adds friction to interactive development. We want to preserve AML’s existing remote environment-build workflow.
  • Bundling wheels at submission: Requires additional tooling, dependency resolution, and platform compatibility handling, particularly when submitting from Windows to Linux compute.
  • Installing dependencies at job startup: Moves installation outside AML’s normal environment-build/cache mechanism and requires custom authentication and bootstrap logic.
  • Automating PAT rotation: Reduces manual work but retains user-owned credentials and credential-renewal/distribution infrastructure.
  • Longer-lived PATs: Reduces renewal frequency, where policy permits, but does not eliminate the credential-management problem or dependency on an employee’s account.

Additional context

Authorization is an important part of this request. Users who can submit arbitrary builds using an identity could potentially retrieve packages accessible to it. The feature should explicitly control who may configure and use the build identity, require narrowly scoped feed permissions, and document that trust boundary. It should not implicitly grant every workspace user access to a privileged identity.

Related discussions:

  • #29942 — Private-package support in SDK v2 and the added complexity of separate Docker builds.
  • #35036 — Private-feed authentication in Docker build contexts. Related, but arbitrary Dockerfile support is outside this request’s initial scope.

This request specifically concerns replacing manually maintained feed credentials with managed-identity authentication, while preserving local job submission and AML-managed environment builds.

Is this supported through an existing mechanism, or already tracked on the roadmap? If this requires changes to the AML environment-build service rather than the SDK, please route the request to the appropriate service owners.

主要言語
Python
スター
5.6k
フォーク
3.4k
平均マージ
2日 7時間
マージ済み PR（30日）
206

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Azure/azure-sdk-for-python のほかの issue

Azure/azure-sdk-for-python の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。