Azure-devops-cli-extension: [Feature Request] Variable group linked to Azure Key Vault keys

[atbagga]

Variable group linked to Azure Key Vault keys would be a great addition as well

_Originally posted by @LaurentLesle in https://github.com/Azure/azure-devops-cli-extension/issues/639#issuecomment-498039169_

[geverghe]

For clarification - there are no documented APIs to support this and we are working with the stakeholder to get an estimate on timeline. Will keep this thread posted.

[atbagga]

For those blocked on this can use the az devops invoke command to automate this if required using the undocumented API (API signature can change in future).

Here is the sample command with Json Request-
az devops invoke --http-method post --area distributedtask --resource variablegroups --debug --in-file .\vgroup_azure_rm.json --encoding ascii --route-parameters project=atbagga --api-version 5.0-preview

{
    "description": "vgroup description",
    "name": "vgroup1",
    "providerData": {
        "serviceEndpointId": "5763599f-0a8b-403a-a4ca-dsdsdsd4b6",
        "vault": "MyAzureKeyvaultName"
    },
    "type": "AzureKeyVault",
    "variables": {
        "VARIABLE_NAME": {
            "isSecret": true,
            "value": "",
            "enabled": true,
            "contentType": "",
            "expires": null
        }
    }
}

ServiceEndpoint Id is the AzureRm Service endpoint id which can be created using az devops service-endpoint command.

[CharlieStokes]

For those blocked on this can use the az devops invoke command to automate this if required using the undocumented API (API signature can change in future).

Here is the sample command with Json Request-
az devops invoke --http-method post --area distributedtask --resource variablegroups --debug --in-file .\vgroup_azure_rm.json --encoding ascii --route-parameters project=atbagga --api-version 5.0-preview

{
    "description": "vgroup description",
    "name": "vgroup1",
    "providerData": {
        "serviceEndpointId": "5763599f-0a8b-403a-a4ca-dsdsdsd4b6",
        "vault": "MyAzureKeyvaultName"
    },
    "type": "AzureKeyVault",
    "variables": {
        "VARIABLE_NAME": {
            "isSecret": true,
            "value": "",
            "enabled": true,
            "contentType": "",
            "expires": null
        }
    }
}

ServiceEndpoint Id is the AzureRm Service endpoint id which can be created using az devops service-endpoint command.

This worked for me, however it doesn't allow you to associate a service connection with the the variable group to access they key vault. Looks like there hasn't been an update to the cli yet, does anyone know if this is possible?

[yradsmikham]

Any updates on this feature?

[lpalerm]

@geverghe > For clarification - there are no documented APIs to support this and we are working with the stakeholder to get an estimate on timeline. Will keep this thread posted.

Any updates?