Accessing Gov clouds

[edwardsp]

In what area(s)?

/area lemur

Expected Behavior

The addition suffix for lemur 2.1.0 is not working. The HSM or changlelog reader are not able to access keyvault.

Actual Behavior

Error message:

2022/01/07 14:11:10 keyvault.BaseClient#GetSecret: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="Unauthorized" Message="AKV10022: Invalid audience. Expected https://vault.usgovcloudapi.net, found: https://vault.azure.net."

[edwardsp]

The AZURE_ENVIRONMENT env var needs to be set for the go REST API. Here are the options:

• AZURECHINACLOUD
• AZUREGERMANCLOUD
• AZUREPUBLICCLOUD
• AZUREUSGOVERNMENTCLOUD

Ref: https://github.com/Azure/go-autorest/blob/master/autorest/azure/environments.go#L34

[edwardsp]

Alternatively, to access keyvault in usgovcloud, you can set:

export AZURE_KEYVAULT_RESOURCE=https://vault.usgovcloudapi.net