5

我需要使用 ARM 模板在 Azure Databricks 中创建一个令牌。我能够使用 ARM 模板创建 Azure Databricks，但无法使用 ARM 模板在 Azure Databricks 中创建令牌

以下是我用来创建 Azure Databricks 的模板

{
"$schema": "https://schema.management.azure.com/schemas/2015-01- 
01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspaceName": {
"type": "string",
  "metadata": {
    "description": "The name of the Azure Databricks workspace to create."
  }
},
"pricingTier": {
  "type": "string",
  "defaultValue": "premium",
  "allowedValues": [
    "standard",
    "premium"
  ],
  "metadata": {
    "description": "The pricing tier of workspace."
  }
},
"location": {
  "type": "string",
  "defaultValue": "[resourceGroup().location]",
  "metadata": {
    "description": "Location for all resources."
  }
}
},
"variables": {
"managedResourceGroupName": "[concat('databricks-rg-', 
parameters('workspaceName'), '-', uniqueString(parameters('workspaceName'), 
resourceGroup().id))]"
},
"resources": [
{
  "type": "Microsoft.Databricks/workspaces",
  "name": "[parameters('workspaceName')]",
  "location": "[parameters('location')]",
  "apiVersion": "2018-04-01",
  "sku": {
    "name": "[parameters('pricingTier')]"
  },
  "properties": {
    "ManagedResourceGroupId": "[concat(subscription().id, '/resourceGroups/', variables('managedResourceGroupName'))]"
  }
}
],
"outputs": {
"workspace": {
  "type": "object",
  "value": "[reference(resourceId('Microsoft.Databricks/workspaces', parameters('workspaceName')))]"
}
}
}

请让我知道如何使用 ARM 模板在 Azure Databricks 中创建令牌

4

3 回答 3

5

我在评论中看到您询问是否可以使用脚本创建令牌。现在是可能的！

Databricks 有一个令牌 API：https ://docs.databricks.com/dev-tools/api/latest/tokens.html

查看此博客：https ://cloudarchitected.com/2020/01/using-azure-ad-with-the-azure-databricks-api/

它展示了使用 AAD 和其他一些方法创建数据块令牌是多么容易。

我有一些 Python 代码用于自动执行此任务。我会扩展它以自动将令牌添加到某种密钥库中。这是一个示例：

import requests
import adal
import json

# set variables 
clientId = "<Service Principal Id>"
tenantId = "<Tenant Id>"
clientSecret = "<Service Principal Secret>"
subscription_id = "<Subscription Id>"
resource_group = "<Resource Group Name>"
databricks_workspace = "<Databricks Workspace Name>"
dbricks_location = "<Databricks Azure Region i.e. westus>"



# Acquire a token to authenticate against Azure management API
authority_url = 'https://login.microsoftonline.com/'+tenantId
context = adal.AuthenticationContext(authority_url)
token = context.acquire_token_with_client_credentials(
    resource='https://management.core.windows.net/',
    client_id=clientId,
    client_secret=clientSecret
)
azToken = token.get('accessToken')



# Acquire a token to authenticate against the Azure Databricks Resource
token = context.acquire_token_with_client_credentials(
    resource="2ff814a6-3304-4ab8-85cb-cd0e6f879c1d",
    client_id=clientId,
    client_secret=clientSecret
)
adbToken = token.get('accessToken')


# Format Request API Url
dbricks_api = "https://{}.azuredatabricks.net/api/2.0".format(dbricks_location)


# Request Authentication
dbricks_auth = {
    "Authorization": "Bearer {}".format(adbToken),
    "X-Databricks-Azure-SP-Management-Token": azToken,
    "X-Databricks-Azure-Workspace-Resource-Id": ("/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Databricks/workspaces/{}".format(subscription_id, resource_group, databricks_workspace) )
    }


# Optional Paramters 
payload = {
    "comment": "This token is generated through AAD and Databricks APIs", # optional parameter
    # "lifetime_seconds": 3600 # optional parameter. If not passed then it is indefinte
}


# Request and Send Data to Create a Databricks Token
data = requests.post("{}/token/create".format(dbricks_api), headers= dbricks_auth, json=payload)

# display the response data
data.status_code
data.content

# Decode response, get token, and print token
dict_content = json.loads(data.content.decode('utf-8'))
token = dict_content.get('token_value')
print("This is the databricks token: {}".format(token))
于 2020-05-15T18:58:52.403 回答
2

这在今天是不可能的。这是用户语音https://feedback.azure.com/forums/909463-azure-databricks/suggestions/35257819-expose-api-key-during-arm-deployment上要求的功能

（请点赞）

目前，您必须手动登录 Web UI 并生成令牌。甚至 REST API 也不支持这一点。

于 2019-01-08T15:37:03.853 回答
1

您实际上可以在 CD 管道中使用azure.databricks.cicd.tools来创建新的不记名令牌。

您需要先使用Connect-Databricks连接到您的工作区。我通常使用 AADwithOrgId 方法对 Databricks 工作区进行身份验证：

Connect-Databricks -Region <String> -ApplicationId <String> -Secret <String> -DatabricksOrgId <String> -TenantId <String>

服务主体应在您的资源组中具有贡献者角色，并在您的 Databricks 工作区中添加一个管理员。

于 2021-09-11T18:26:54.443 回答