Appconfiguration: Bulk editing key-values in App Configuration

[WarrenFerrell]

Currently if you export a Key vault reference you get a json file like this

{
"someKey": "{\"uri\":\"https://namespace.vault.azure.net/secrets/SomeConnectionString\"}",
}

If you then import that file your key vault reference will be broken because the Content type
application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8 |  -- | -- is wiped out. I assume the same would be true of any labels. Please fix as it makes it very difficult to import a large number of key vault references at once.
 

[zhenlan]

@WarrenFerrell a JSON file has nowhere to keep any metadata other than the keys and values. Therefore, as part of your importing a JSON file to App Configuration, you will want to provide any additional metadata, such as content-type. You can use Azure CLI to achieve this. Please check out the --content-type parameter in az appconfig kv import -h.

Different labels will have different values for the same key. When you import for one label, it will never overwrite the value of another label.

[WarrenFerrell]

What is wrong expanding support like this? and having a flag to export all properties

{
"someKey": {
    "value": "\"uri\":\"https://namespace.vault.azure.net/secrets/SomeConnectionString\"}",
    "content-type": "application/foo...",
    "labels" : [ ]
}
}

[zhenlan]

The import/export feature today is designed so an application's existing settings can be easily imported to App Configuration or the settings saved in App Configuration can be easily exported to files that can be consumed by existing applications.

What you described is a data schema that must be defined first by App Configuration and for others to follow. The files are not for applications to consume. This will be useful for the backup/restore scenario, which is different from the current design for import/export. Is backup/restore what you have in mind?

[WarrenFerrell]

My use case is easy bulk editing of config like in Azure App Service. I have a bunch of azure functions that have several shared secrets (ApiKeys, redis connection strings, etc.) I store in the form "{funcName}:{secret}" and use a "{funcName}*" keyFilter. When I make a new function in the pipeline I want to be able to easily copy the reused Key Vault keys. In my dev environment I also have some secrets placed directly in App Configuration for convenience but in production I will want to put all secrets into keyvault and have fewer shared secrets. Currently there is no easy way to do this through the ui and configuring a PS script for something you do once every 6 months feels like a big time waste.

[zhenlan]

What you described is a valid scenario (I will update the title of the issue to reflect this). We had some discussion on this topic in the past. This is definitely an area we'd like to provide a better experience.

For now, the best alternative I can think of is to use different namespaces for normal configuration and secrets and then you can import/export them in separate JSON files (so you can provide necessary content-type) using Azure CLI.