Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(azure): copy from keyvault to app config #593

Merged
merged 6 commits into from
Apr 9, 2024
Merged

feat(azure): copy from keyvault to app config #593

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
74677dd
feat(azure): copy from keyvault to app config
arealmaas Apr 4, 2024
543cfd8
fix weirdness
arealmaas Apr 5, 2024
17d6230
cleanup
arealmaas Apr 5, 2024
bea7b48
cleanup
arealmaas Apr 5, 2024
e8e7a5a
hello doctor
arealmaas Apr 5, 2024
4906d89
Merge branch 'main' into feat/copy-from-keyvault-to-appconfig
arealmaas Apr 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .azure/infrastructure/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ module copyEnvironmentSecrets '../modules/keyvault/copySecrets.bicep' = {
scope: resourceGroup
name: 'copyEnvironmentSecrets'
params: {
appConfigurationName: appConfiguration.outputs.name
srcKeyVaultKeys: keyVaultSourceKeys
srcKeyVaultName: secrets.sourceKeyVaultName
srcKeyVaultRGNName: secrets.sourceKeyVaultResourceGroup
Expand All @@ -145,7 +146,9 @@ module copyEnvironmentSecrets '../modules/keyvault/copySecrets.bicep' = {
module copyCrossEnvironmentSecrets '../modules/keyvault/copySecrets.bicep' = {
arealmaas marked this conversation as resolved.
Show resolved Hide resolved
scope: resourceGroup
name: 'copyCrossEnvironmentSecrets'
params: { srcKeyVaultKeys: keyVaultSourceKeys
params: {
appConfigurationName: appConfiguration.outputs.name
srcKeyVaultKeys: keyVaultSourceKeys
srcKeyVaultName: secrets.sourceKeyVaultName
srcKeyVaultRGNName: secrets.sourceKeyVaultResourceGroup
srcKeyVaultSubId: secrets.sourceKeyVaultSubscriptionId
Expand Down
29 changes: 23 additions & 6 deletions .azure/modules/keyvault/copySecrets.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,28 +9,45 @@ param destKeyVaultName string
param destKeyVaultRGName string = resourceGroup().name
param destKeyVaultSubId string = subscription().subscriptionId

// App configuration
param appConfigurationName string

// Secret
#disable-next-line secure-secrets-in-params
param secretPrefix string
param removeSecretPrefix bool = true

var environmentKeys = [for key in srcKeyVaultKeys: {
arealmaas marked this conversation as resolved.
Show resolved Hide resolved
isEnvironmentKey: startsWith(key, secretPrefix)
value: removeSecretPrefix ? replace(key, secretPrefix, '') : key
fullName: key
secretName: key
appConfigKey: replace(replace(key, secretPrefix, ''), '--', ':')
}]

resource srcKeyVaultResource 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
name: srcKeyVaultName
scope: resourceGroup(srcKeyVaultSubId, srcKeyVaultRGNName)
}

resource appConfigurationResource 'Microsoft.AppConfiguration/configurationStores@2023-03-01' existing = {
name: appConfigurationName
}

module secrets 'upsertSecret.bicep' = [for key in environmentKeys: if (key.isEnvironmentKey) {
name: '${take(key.value, 57)}-${take(uniqueString(key.value), 6)}'
name: '${take(key.secretName, 57)}-${take(uniqueString(key.secretName), 6)}'
scope: resourceGroup(destKeyVaultSubId, destKeyVaultRGName)
params: {
destKeyVaultName: destKeyVaultName
secretName: key.value
secretValue: srcKeyVaultResource.getSecret(key.fullName)
secretName: key.secretName
arealmaas marked this conversation as resolved.
Show resolved Hide resolved
secretValue: srcKeyVaultResource.getSecret(key.secretName)
}
}]

module appConfiguration '../appConfiguration/upsertKeyValue.bicep' = [for key in environmentKeys: if (!key.isEnvironmentKey) {
arealmaas marked this conversation as resolved.
Show resolved Hide resolved
name: '${take(key.secretName, 57)}-${take(uniqueString(key.secretName), 6)}'
scope: resourceGroup(destKeyVaultSubId, destKeyVaultRGName)
params: {
configStoreName: appConfigurationResource.name
key: key.appConfigKey
value: 'https://${destKeyVaultName}${az.environment().suffixes.keyvaultDns}/secrets/${key.secretName}'
keyValueType: 'keyVaultReference'
}
}]
Loading