Skip to content

Commit 5fd2b10

Browse files
davidfowldavidfowl
authored
Introduce IAzureKeyVaultSecretReference (#8171)
* Introduce IAzureKeyVaultSecretReference and IKeyVaultResource - This is a replacement for the magic secret outputs implementation. Resources that support keys push those keys into an explicitly defined per resource key vault and now into any key vault that is provided. The `IKeyVaultSecretReference` is a new primitive reference type that can is understood natively by compute environments like ACA and the azure preparer.
1 parent 4642f54 commit 5fd2b10

File tree

58 files changed

+1026
-738
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1026
-738
lines changed

‎playground/AzureContainerApps/AzureContainerApps.AppHost/account-kv.module.bicep‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
resource account_kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
5+
name: take('accountkv-${uniqueString(resourceGroup().id)}', 24)
6+
location: location
7+
properties: {
8+
tenantId: tenant().tenantId
9+
sku: {
10+
family: 'A'
11+
name: 'standard'
12+
}
13+
enableRbacAuthorization: true
14+
}
15+
tags: {
16+
'aspire-resource-name': 'account-kv'
17+
}
18+
}
19+
20+
output vaultUri string = account_kv.properties.vaultUri
21+
22+
output name string = account_kv.name
23+
24+
output id string = account_kv.id

‎playground/AzureContainerApps/AzureContainerApps.AppHost/account.module.bicep‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
4141
}
4242

4343
resource connectionString 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
44-
name: 'connectionString'
44+
name: 'connectionstrings--account'
4545
properties: {
4646
value: 'AccountEndpoint=${account.properties.documentEndpoint};AccountKey=${account.listKeys().primaryMasterKey}'
4747
}

‎playground/AzureContainerApps/AzureContainerApps.AppHost/api-roles-account-kv.module.bicep‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
param account_kv_outputs_name string
5+
6+
param principalId string
7+
8+
resource account_kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
9+
name: account_kv_outputs_name
10+
}
11+
12+
resource account_kv_KeyVaultAdministrator 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
13+
name: guid(account_kv.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483'))
14+
properties: {
15+
principalId: principalId
16+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')
17+
principalType: 'ServicePrincipal'
18+
}
19+
scope: account_kv
20+
}

‎playground/AzureContainerApps/AzureContainerApps.AppHost/api.module.bicep‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,7 @@ param storage_outputs_blobendpoint string
1212
@secure()
1313
param cache_password_value string
1414

15-
param infra_outputs_secret_output_account string
16-
17-
param infra_outputs_azure_container_registry_managed_identity_id string
15+
param account_kv_outputs_name string
1816

1917
@secure()
2018
param secretparam_value string
@@ -23,19 +21,21 @@ param infra_outputs_azure_container_apps_environment_id string
2321

2422
param infra_outputs_azure_container_registry_endpoint string
2523

24+
param infra_outputs_azure_container_registry_managed_identity_id string
25+
2626
param api_containerimage string
2727

2828
param certificateName string
2929

3030
param customDomain string
3131

32-
resource infra_outputs_secret_output_account_kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
33-
name: infra_outputs_secret_output_account
32+
resource account_kv_outputs_name_kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
33+
name: account_kv_outputs_name
3434
}
3535

36-
resource infra_outputs_secret_output_account_kv_connectionString 'Microsoft.KeyVault/vaults/secrets@2023-07-01' existing = {
37-
name: 'connectionString'
38-
parent: infra_outputs_secret_output_account_kv
36+
resource account_kv_outputs_name_kv_connectionstrings__account 'Microsoft.KeyVault/vaults/secrets@2023-07-01' existing = {
37+
name: 'connectionstrings--account'
38+
parent: account_kv_outputs_name_kv
3939
}
4040

4141
resource api 'Microsoft.App/containerApps@2024-03-01' = {
@@ -50,8 +50,8 @@ resource api 'Microsoft.App/containerApps@2024-03-01' = {
5050
}
5151
{
5252
name: 'connectionstrings--account'
53-
identity: infra_outputs_azure_container_registry_managed_identity_id
54-
keyVaultUrl: infra_outputs_secret_output_account_kv_connectionString.properties.secretUri
53+
identity: api_identity_outputs_id
54+
keyVaultUrl: account_kv_outputs_name_kv_connectionstrings__account.properties.secretUri
5555
}
5656
{
5757
name: 'value'

‎playground/AzureContainerApps/AzureContainerApps.AppHost/aspire-manifest.json‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@
4646
"params": {
4747
"infra_outputs_volumes_cache_0": "{infra.outputs.volumes_cache_0}",
4848
"cache_password_value": "{cache-password.value}",
49-
"infra_outputs_azure_container_registry_managed_identity_id": "{infra.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
5049
"infra_outputs_azure_container_apps_environment_id": "{infra.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}"
5150
}
5251
},
@@ -76,15 +75,20 @@
7675
},
7776
"account": {
7877
"type": "azure.bicep.v0",
79-
"connectionString": "{account.secretOutputs.connectionString}",
78+
"connectionString": "{account-kv.secrets.connectionstrings--account}",
8079
"path": "account.module.bicep",
8180
"params": {
82-
"keyVaultName": "{infra.outputs.secret_output_account}"
81+
"keyVaultName": "{account-kv.outputs.name}"
8382
}
8483
},
84+
"account-kv": {
85+
"type": "azure.bicep.v0",
86+
"connectionString": "{account-kv.outputs.vaultUri}",
87+
"path": "account-kv.module.bicep"
88+
},
8589
"db": {
8690
"type": "value.v0",
87-
"connectionString": "{account.secretOutputs.connectionString}"
91+
"connectionString": "{account-kv.secrets.connectionstrings--account};Database=db"
8892
},
8993
"storage": {
9094
"type": "azure.bicep.v0",
@@ -104,9 +108,9 @@
104108
"type": "azure.bicep.v0",
105109
"path": "pythonapp.module.bicep",
106110
"params": {
107-
"infra_outputs_azure_container_registry_managed_identity_id": "{infra.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
108111
"infra_outputs_azure_container_apps_environment_id": "{infra.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}",
109112
"infra_outputs_azure_container_registry_endpoint": "{infra.outputs.AZURE_CONTAINER_REGISTRY_ENDPOINT}",
113+
"infra_outputs_azure_container_registry_managed_identity_id": "{infra.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
110114
"pythonapp_containerimage": "{pythonapp.containerImage}"
111115
}
112116
}
@@ -123,11 +127,11 @@
123127
"api_containerport": "{api.containerPort}",
124128
"storage_outputs_blobendpoint": "{storage.outputs.blobEndpoint}",
125129
"cache_password_value": "{cache-password.value}",
126-
"infra_outputs_secret_output_account": "{infra.outputs.secret_output_account}",
127-
"infra_outputs_azure_container_registry_managed_identity_id": "{infra.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
130+
"account_kv_outputs_name": "{account-kv.outputs.name}",
128131
"secretparam_value": "{secretparam.value}",
129132
"infra_outputs_azure_container_apps_environment_id": "{infra.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}",
130133
"infra_outputs_azure_container_registry_endpoint": "{infra.outputs.AZURE_CONTAINER_REGISTRY_ENDPOINT}",
134+
"infra_outputs_azure_container_registry_managed_identity_id": "{infra.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
131135
"api_containerimage": "{api.containerImage}",
132136
"certificateName": "{certificateName.value}",
133137
"customDomain": "{customDomain.value}"
@@ -171,6 +175,14 @@
171175
"principalId": "{api-identity.outputs.principalId}"
172176
}
173177
},
178+
"api-roles-account-kv": {
179+
"type": "azure.bicep.v0",
180+
"path": "api-roles-account-kv.module.bicep",
181+
"params": {
182+
"account_kv_outputs_name": "{account-kv.outputs.name}",
183+
"principalId": "{api-identity.outputs.principalId}"
184+
}
185+
},
174186
"cache-password": {
175187
"type": "parameter.v0",
176188
"value": "{cache-password.inputs.value}",

‎playground/AzureContainerApps/AzureContainerApps.AppHost/cache.module.bicep‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ param infra_outputs_volumes_cache_0 string
66
@secure()
77
param cache_password_value string
88

9-
param infra_outputs_azure_container_registry_managed_identity_id string
10-
119
param infra_outputs_azure_container_apps_environment_id string
1210

1311
resource cache 'Microsoft.App/containerApps@2024-03-01' = {
@@ -67,10 +65,4 @@ resource cache 'Microsoft.App/containerApps@2024-03-01' = {
6765
]
6866
}
6967
}
70-
identity: {
71-
type: 'UserAssigned'
72-
userAssignedIdentities: {
73-
'${infra_outputs_azure_container_registry_managed_identity_id}': { }
74-
}
75-
}
7668
}

‎playground/AzureContainerApps/AzureContainerApps.AppHost/infra.module.bicep‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -119,34 +119,8 @@ resource managedStorage_volumes_cache_0 'Microsoft.App/managedEnvironments/stora
119119
parent: cae
120120
}
121121

122-
resource kv_secret_output_account 'Microsoft.KeyVault/vaults@2023-07-01' = {
123-
name: take('kvsecretoutputaccount-${uniqueString(resourceGroup().id)}', 24)
124-
location: location
125-
properties: {
126-
tenantId: tenant().tenantId
127-
sku: {
128-
family: 'A'
129-
name: 'standard'
130-
}
131-
enableRbacAuthorization: true
132-
}
133-
tags: tags
134-
}
135-
136-
resource kv_secret_output_account_mi_KeyVaultAdministrator 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
137-
name: guid(kv_secret_output_account.id, mi.id, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483'))
138-
properties: {
139-
principalId: mi.properties.principalId
140-
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')
141-
principalType: 'ServicePrincipal'
142-
}
143-
scope: kv_secret_output_account
144-
}
145-
146122
output volumes_cache_0 string = managedStorage_volumes_cache_0.name
147123

148-
output secret_output_account string = kv_secret_output_account.name
149-
150124
output MANAGED_IDENTITY_NAME string = mi.name
151125

152126
output MANAGED_IDENTITY_PRINCIPAL_ID string = mi.properties.principalId

‎playground/AzureContainerApps/AzureContainerApps.AppHost/pythonapp.module.bicep‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
@description('The location for the resource(s) to be deployed.')
22
param location string = resourceGroup().location
33

4-
param infra_outputs_azure_container_registry_managed_identity_id string
5-
64
param infra_outputs_azure_container_apps_environment_id string
75

86
param infra_outputs_azure_container_registry_endpoint string
97

8+
param infra_outputs_azure_container_registry_managed_identity_id string
9+
1010
param pythonapp_containerimage string
1111

1212
resource pythonapp 'Microsoft.App/containerApps@2024-03-01' = {

‎playground/DatabaseMigration/DatabaseMigration.AppHost/aspire-manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
},
2121
"db1": {
2222
"type": "value.v0",
23-
"connectionString": "{sql1.connectionString};Database=db1"
23+
"connectionString": "{sql1.connectionString};Initial Catalog=db1"
2424
},
2525
"api": {
2626
"type": "project.v0",

‎playground/Elasticsearch/Elasticsearch.AppHost/aspire-manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"elasticsearch": {
55
"type": "container.v0",
66
"connectionString": "http://elastic:{elasticsearch-password.value}@{elasticsearch.bindings.http.host}:{elasticsearch.bindings.http.port}",
7-
"image": "docker.io/library/elasticsearch:8.17.0",
7+
"image": "docker.io/library/elasticsearch:8.17.3",
88
"volumes": [
99
{
1010
"name": "elasticsearch.apphost-7490553fdf-elasticsearch-data",

0 commit comments

Comments
 (0)