Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Support managed-identity authentication to Azure Artifacts during AML environment builds

未关闭
  • 哪里不对？
#49,213 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
活跃
技术栈
azure, python
领域
authentication, cloud, security

调研方向

No repository files, tests, or entry points are identified. Start by locating the AML-managed environment-build service and the existing python_feed credential flow, then determine whether this repository owns the required change. Done means Azure Artifacts Python feeds can use a configured user-assigned managed identity during AML-managed Conda/pip builds, with actionable permission errors and existing credential authentication preserved.

由索引模型根据 Issue 内容生成。

描述

Is your feature request related to a problem? Please describe.

We use private Python packages hosted in Azure Artifacts. Developers update dependencies locally and submit Azure Machine Learning jobs directly from their machines, relying on AML to build and cache the required environments.
The documented AML python_feed connection supports PAT or username/password authentication, but not managed identity. This requires recurring renewal of a user-owned PAT and updates to the corresponding AML feed connections.
This creates operational overhead, a dependency on an employee’s credentials, and a risk of environment-build failures when credentials expire or are revoked.

Describe the solution you'd like

Support a configured user-assigned managed identity for Azure Artifacts authentication during AML-managed Conda/pip environment builds.
After one-time identity and feed-permission configuration, the developer workflow should remain:

Edit dependencies locally → submit an AML job → AML builds/caches the environment → run.

AML should acquire and renew short-lived Microsoft Entra tokens as needed, without exposing credentials in build logs or persisting them in the resulting image. Missing permissions should produce actionable errors.
This does not assume that the submitting user’s credentials or the job’s compute identity are available during environment builds. An explicitly configured environment-build identity would be appropriate.
The initial scope could be limited to Azure Artifacts Python feeds and AML-managed builds using a Conda specification with pip dependencies. Arbitrary Dockerfile builds and other package repositories can remain separate requests. Existing credential-based connections should continue to work.

Describe alternatives you've considered

  • CI-built images: Useful for production releases, but requiring a separate image-build pipeline for every dependency change adds friction to interactive development. We want to preserve AML’s existing remote environment-build workflow.
  • Bundling wheels at submission: Requires additional tooling, dependency resolution, and platform compatibility handling, particularly when submitting from Windows to Linux compute.
  • Installing dependencies at job startup: Moves installation outside AML’s normal environment-build/cache mechanism and requires custom authentication and bootstrap logic.
  • Automating PAT rotation: Reduces manual work but retains user-owned credentials and credential-renewal/distribution infrastructure.
  • Longer-lived PATs: Reduces renewal frequency, where policy permits, but does not eliminate the credential-management problem or dependency on an employee’s account.

Additional context

Authorization is an important part of this request. Users who can submit arbitrary builds using an identity could potentially retrieve packages accessible to it. The feature should explicitly control who may configure and use the build identity, require narrowly scoped feed permissions, and document that trust boundary. It should not implicitly grant every workspace user access to a privileged identity.

Related discussions:

  • #29942 — Private-package support in SDK v2 and the added complexity of separate Docker builds.
  • #35036 — Private-feed authentication in Docker build contexts. Related, but arbitrary Dockerfile support is outside this request’s initial scope.

This request specifically concerns replacing manually maintained feed credentials with managed-identity authentication, while preserving local job submission and AML-managed environment builds.

Is this supported through an existing mechanism, or already tracked on the roadmap? If this requires changes to the AML environment-build service rather than the SDK, please route the request to the appropriate service owners.

主要语言
Python
星标
5.6k
派生
3.4k
平均合并
2 天 1 分钟
30 天内合并 PR
218

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Azure/azure-sdk-for-python 的其他 Issue

查看 Azure/azure-sdk-for-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。