Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use Redis AVM's secretsExportConfiguration param to store secrets in Key Vault #4719

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −45
Open

Use Redis AVM's secretsExportConfiguration param to store secrets in Key Vault #4719

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions cli/azd/internal/scaffold/scaffold.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,6 @@ func supportingFiles(spec InfraSpec) []string {
files := []string{"/abbreviations.json"}

if len(spec.Services) > 0 {
if spec.DbRedis != nil {
files = append(files, "/modules/set-redis-conn.bicep")
}
files = append(files, "/modules/fetch-container-image.bicep")
}

Expand Down
29 changes: 0 additions & 29 deletions cli/azd/resources/scaffold/base/modules/set-redis-conn.bicep
View file
Open in desktop

This file was deleted.

21 changes: 8 additions & 13 deletions cli/azd/resources/scaffold/templates/resources.bicept
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,28 +389,23 @@ module {{bicepName .Name}} 'br/public:avm/res/app/container-app:0.8.0' = {
{{- end}}

{{- if .DbRedis}}
module redis 'br/public:avm/res/cache/redis:0.3.2' = {
module redis 'br/public:avm/res/cache/redis:0.9.0' = {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have a process yet for when/how we upgrade to new versions of AVM modules?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a very good question. Do you have any suggestions? And if there's a need for something solid to be in-place today?

In general, it feels not too different to me than when we update api-version fħr any Azure resources, which boils down to when a version upgrade is required for a specific feature. Currently, this is mostly hidden away from the user so it wouldn't matter too much.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about this, @weikanglim do you know?

name: 'redisDeployment'
params: {
// Required parameters
name: '${abbrs.cacheRedis}${resourceToken}'
// Non-required parameters
location: location
skuName: 'Basic'
{{- if .Services}}
secretsExportConfiguration: {
keyVaultResourceId: keyVault.outputs.resourceId
primaryAccessKeyName: 'REDIS-PASSWORD'
primaryConnectionStringName: 'REDIS-URL'
Comment on lines +403 to +404
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these REDIS-PASSWORD AND REDIS-URL param expected to be environment variables? Or just placeholders for end users to update?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is REDIS-PASSWORD and REDIS-URL are the Key Vault secret names.

And as part of the generated Bicep we create 2 container app secrets redis-pass and redis-url that refer to these Key Vault secrets:

image

Which are exposed through the environment variables REDIS_URL and REDIS_PASSWORD:

image

}
{{- end}}
}
}

{{- if .Services}}
module redisConn './modules/set-redis-conn.bicep' = {
name: 'redisConn'
params: {
name: redis.outputs.name
passwordSecretName: 'REDIS-PASSWORD'
urlSecretName: 'REDIS-URL'
keyVaultName: keyVault.outputs.name
}
}
{{- end}}
{{- end}}

{{- if .Services}}
Expand Down
Loading