Use Redis AVM's secretsExportConfiguration param to store secrets in Key Vault
#4719
+8
−45
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
JeffreyCA
requested review from
wbreza,
vhvb1989,
hemarina and
weikanglim
as code owners
wbreza
reviewed
Jan 22, 2025
| @@ -389,28 +389,23 @@ module {{bicepName .Name}} 'br/public:avm/res/app/container-app:0.8.0' = { | |||
| {{- end}} | |||
|
|
|||
| {{- if .DbRedis}} | |||
| module redis 'br/public:avm/res/cache/redis:0.3.2' = { | |||
| module redis 'br/public:avm/res/cache/redis:0.9.0' = { | |||
There was a problem hiding this comment.
Do we have a process yet for when/how we upgrade to new versions of AVM modules?
There was a problem hiding this comment.
That's a very good question. Do you have any suggestions? And if there's a need for something solid to be in-place today?
In general, it feels not too different to me than when we update api-version fħr any Azure resources, which boils down to when a version upgrade is required for a specific feature. Currently, this is mostly hidden away from the user so it wouldn't matter too much.
There was a problem hiding this comment.
I'm not sure about this, @weikanglim do you know?
Comment on lines
+403
to
+404
| primaryAccessKeyName: 'REDIS-PASSWORD' | ||
| primaryConnectionStringName: 'REDIS-URL' |
There was a problem hiding this comment.
Are these REDIS-PASSWORD AND REDIS-URL param expected to be environment variables? Or just placeholders for end users to update?
There was a problem hiding this comment.
My understanding is REDIS-PASSWORD and REDIS-URL are the Key Vault secret names.
And as part of the generated Bicep we create 2 container app secrets redis-pass and redis-url that refer to these Key Vault secrets:
Which are exposed through the environment variables REDIS_URL and REDIS_PASSWORD:
vhvb1989
approved these changes
Jan 23, 2025
weikanglim
approved these changes
Jan 23, 2025
There was a problem hiding this comment.
LGTM, thanks for the clean change.
FYI @JeffreyCA, I'm not sure if it's helpful but the tests in scaffold_test.go does validate the Bicep syntax of the resulting generation. I also logged #4720 for us to move this up a layer where we can have azure.yaml test cases as input, and add scenario tests that way.
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #4681
v0.9.0 of the Redis AVM adds support for
secretsExportConfiguration, a standardized input param used by several other AVMs to export access keys and other secrets to Azure Key Vault after the resource has been provisioned. (Reference)This PR updates compose's Bicep generation to use the new module version and
secretsExportConfigurationto write the Redis primary access key and connection string to Key Vault instead of our customset-redis-conn.bicepBicep module.Validation
Deployed a minimal Python Flask web app with Redis:
azure.yaml:
resources.bicep:
Python app code:
Key vault:
