Appconfiguration: Key Vault references not resolved in Azure Configuration DevOps release pipeline

[theo-blisdigital]

I moved app configuration from Azure Resource specific Configuration settings to Azure App Configuration for the obvious benefit: have configuration in one place for multiple environments (Development, Test, Acceptance). This is very nice, since you don't have to go into each and every Azure Resource and slot to update settings. I'm using Key Vault references for connection strings and other secrets. This works find from our ASP.NET Core WebApps, following this guidance:
https://docs.microsoft.com/en-us/azure/azure-app-configuration/use-key-vault-references-dotnet-core.

The next bottleneck in our environment is the duplicated variables and secrets in the Azure DevOps release pipeline. We have release steps that perform database upgrades. These steps also need access to protected connection string. According to the documentation this should work just find: all the variables are available as environment variables, https://docs.microsoft.com/en-us/azure/azure-app-configuration/integrate-ci-cd-pipeline. Secrets will be masked in the task output as "*".

This works fine, besides the fact that Key Vault references are not resolved. They are downloaded as KeyVault REST references, like: {"uri":"https://myvault.vault.azure.net/secrets/SOME--KEYVAULT--KEY"}.

Injecting these Azure App Configuration variables into your task means the task will obviously break, since the real Key Vault value won't be resolved. My motivation to use Azure App Configuration was a single point of definition and now I'm failing to meet that requirements for a key scenario: deployment. There is no mention in the documentation this shouldn't or wouldn't work, so I have been trying to get it to work, without luck. It's pretty cumbersome to diagnose this issue as well in a Azure DevOps Release pipeline, since you have to create a proof of concept pipeline with some lightweight powershell tasks to see what's going on.

Now I could switch to using Variable Groups in Azure DevOps, since they support linking passthrough KeyVault variables, see https://docs.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups. But that means I have to setup selective variables in my release pipeline and I really don't want to duplicate what I already have in Azure App Config. Also You can only reference 1 Key Vault in a variable group, so you would multiple groups to achieve the same solution as with Azure App Configuration.

Another challenge is the fact you can only provide one label in the Azure DevOps App Configuration Task, https://marketplace.visualstudio.com/items?itemName=AzureAppConfiguration.azure-app-configuration-task. This means you can's get all the keys for a specific environment as label plus another Azure Resource specific label. I have setup Azure App Config like this:

• entries without a label didn't work, so I didn't use that. It feels like this is another bug by the way.
• entries with an environment label, so "Development", "Test", "Acceptance"
• entries narrowed down to a specific resource name, so "Development.Registration", "Test.Authentication".

The tooltip hint says in the Azure DevOps Task: "Download key-values to task variables from Azure App Configuration". It doesn't mention Key Vault secrets are not resolved.

[DavidNorena]

Totally agree with you, for every single comment we are facing the same issues :).

[DavidNorena]

BTW did you see this

It seems for matching null and Development labels you should do something like this:

label=%00,Development

I haven't try that yet, but its worth looking into it

[theo-blisdigital]

It seems for matching null and Development labels you should do something like this:

label=%00

Ah, I overlooked that one, thanks for the pointer. Makes you wonder why a regular wildcard "*" is used for keys, but this strange syntax for labels. It's not intuitive, thus error prone.

[Kittoes0124]

Aye, this issue is an absolute bummer; also worth noting that it is a problem in classic .NET Framework applications in general. We followed this guide and learned the hard way...

[Yiming-Jia]

Hello,

We just release a AzureDevOps task at version 2.10 for Azure AppConfiguration to support the KeyVault references. Those secrets will be set into pipeline as pipeline secrets.

[theo-blisdigital]

Hello,

We just release a AzureDevOps task at version 2.10 for Azure AppConfiguration to support the KeyVault references. Those secrets will be set into pipeline as pipeline secrets.

@Yiming-Jia is there anything special we should do to get it to work? I just tried it and the secrets don't seem to flow into my bash script task. When I list the environment variables, I see the non key vault values, but not the key vault key entries. I do see that keys are being downloaded by the Azure App configuration task:

2020-03-20T11:26:45.4668156Z Downloading key-value pairs using: 'https://foo-configuration.azconfig.io'. 2020-03-20T11:26:46.1267890Z '1' key-values were retrieved from Azure App Configuration using the key filter: 'ConnectionStrings*' with label: 'Foo'.

[theo-blisdigital]

@Yiming-Jia is there anything special we should do to get it to work? I just tried it and the secrets don't seem to flow into my bash script task.

Just found out that I have to add an environment variable to my bash task to excpose the KV values. So if my Key Vault secret key is Foo:Bar, it won't be automagically converted to FOO__BAR like regular Azure App Config keys. You have to explicitly map if in the task like: FOO__BAR = $(Foo:Bar).

Sweet, it works!

[Yiming-Jia]

Hello @theo-blisdigital,

Yes, the task does a very straight forward logic, which fetches key-values and set into environment variable. And it does not convert key from : style to __ style to adapt to environment variable for both regular key-value and Key Vault ref.