Skip to content

Commit 056d0ef

Browse files
ShawnJacksonShawnJackson
authored
Update service-fabric-application-secret-store.md
1 parent a7a0914 commit 056d0ef

File tree

1 file changed

+49
-48
lines changed

1 file changed

+49
-48
lines changed

‎articles/service-fabric/service-fabric-application-secret-store.md

Lines changed: 49 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.date: 07/25/2019
1010
This article describes how to use Central Secrets Store (CSS) in Azure Service Fabric to create secrets in Service Fabric applications. CSS is a local secret store cache that keeps sensitive data, such as a password, tokens, and keys, encrypted in memory.
1111

1212
## Enable Central Secrets Store
13-
Add the following script to your cluster configuration under `fabricSettings` to enable CSS. It's recommended that you use a certificate other than a cluster certificate for CSS. Make sure the encryption certificate is installed on all nodes and that `NetworkService` has read permission to the certificate's private key.
13+
Add the following script to your cluster configuration under `fabricSettings` to enable CSS. We recommend that you use a certificate other than a cluster certificate for CSS. Make sure the encryption certificate is installed on all nodes and that `NetworkService` has read permission to the certificate's private key.
1414
```json
1515
"fabricSettings":
1616
[
@@ -43,9 +43,9 @@ This article describes how to use Central Secrets Store (CSS) in Azure Service F
4343
]
4444
```
4545
## Declare a secret resource
46-
You can create a secret resource by using either the Resource Manager template or the REST API.
46+
You can create a secret resource by using either the Azure Resource Manager template or the REST API.
4747

48-
### Use the Resource Manager
48+
### Use Resource Manager
4949

5050
Use the following template to use Resource Manager to create the secret resource. The template creates a `supersecret` secret resource, but no value is set for the secret resource yet.
5151

@@ -130,54 +130,55 @@ Follow these steps to use the secret in your Service Fabric application.
130130

131131
1. Add a section in the **settings.xml** file with the following snippet. Note here that the value is in the format {`secretname:version`}.
132132

133-
```xml
134-
<Section Name="testsecrets">
135-
<Parameter Name="TopSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/
136-
</Section>
137-
```
138-
139-
2. Import the section in **ApplicationManifest.xml**.
140-
```xml
141-
<ServiceManifestImport>
142-
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
143-
<ConfigOverrides />
144-
<Policies>
145-
<ConfigPackagePolicies CodePackageRef="Code">
146-
<ConfigPackage Name="Config" SectionName="testsecrets" EnvironmentVariableName="SecretPath" />
147-
</ConfigPackagePolicies>
148-
</Policies>
149-
</ServiceManifestImport>
150-
```
151-
152-
The environment variable `SecretPath` will point to the directory where all secrets are stored. Each parameter listed under the `testsecrets` section is stored in a separate file. The application can now use the secret as follows:
153-
```C#
154-
secretValue = IO.ReadFile(Path.Join(Environment.GetEnvironmentVariable("SecretPath"), "TopSecret"))
155-
```
133+
```xml
134+
<Section Name="testsecrets">
135+
<Parameter Name="TopSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/
136+
</Section>
137+
```
138+
139+
1. Import the section in **ApplicationManifest.xml**.
140+
```xml
141+
<ServiceManifestImport>
142+
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
143+
<ConfigOverrides />
144+
<Policies>
145+
<ConfigPackagePolicies CodePackageRef="Code">
146+
<ConfigPackage Name="Config" SectionName="testsecrets" EnvironmentVariableName="SecretPath" />
147+
</ConfigPackagePolicies>
148+
</Policies>
149+
</ServiceManifestImport>
150+
```
151+
152+
The environment variable `SecretPath` will point to the directory where all secrets are stored. Each parameter listed under the `testsecrets` section is stored in a separate file. The application can now use the secret as follows:
153+
```C#
154+
secretValue = IO.ReadFile(Path.Join(Environment.GetEnvironmentVariable("SecretPath"), "TopSecret"))
155+
```
156156
1. Mount the secrets to a container. The only change required to make the secrets available inside the container is to `specify` a mount point in `<ConfigPackage>`.
157157
The following snippet is the modified **ApplicationManifest.xml**.
158158

159-
```xml
160-
<ServiceManifestImport>
161-
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
162-
<ConfigOverrides />
163-
<Policies>
164-
<ConfigPackagePolicies CodePackageRef="Code">
165-
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="C:\secrets" EnvironmentVariableName="SecretPath" />
166-
<!-- Linux Container
167-
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="/mnt/secrets" EnvironmentVariableName="SecretPath" />
168-
-->
169-
</ConfigPackagePolicies>
170-
</Policies>
171-
</ServiceManifestImport>
172-
```
173-
Secrets are available under the mount point inside your container.
174-
175-
4. You can bind a secret to a process environment variable by specifying `Type='SecretsStoreRef`. The following snippet is an example of how to bind the `supersecret` version `ver1` to the environment variable `MySuperSecret` in **ServiceManifest.xml**.
159+
```xml
160+
<ServiceManifestImport>
161+
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
162+
<ConfigOverrides />
163+
<Policies>
164+
<ConfigPackagePolicies CodePackageRef="Code">
165+
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="C:\secrets" EnvironmentVariableName="SecretPath" />
166+
<!-- Linux Container
167+
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="/mnt/secrets" EnvironmentVariableName="SecretPath" />
168+
-->
169+
</ConfigPackagePolicies>
170+
</Policies>
171+
</ServiceManifestImport>
172+
```
173+
Secrets are available under the mount point inside your container.
174+
175+
1. You can bind a secret to a process environment variable by specifying `Type='SecretsStoreRef`. The following snippet is an example of how to bind the `supersecret` version `ver1` to the environment variable `MySuperSecret` in **ServiceManifest.xml**.
176+
177+
```xml
178+
<EnvironmentVariables>
179+
<EnvironmentVariable Name="MySuperSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/>
180+
</EnvironmentVariables>
181+
```
176182

177-
```xml
178-
<EnvironmentVariables>
179-
<EnvironmentVariable Name="MySuperSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/>
180-
</EnvironmentVariables>
181-
```
182183
## Next steps
183184
Learn more about [application and service security](service-fabric-application-and-service-security.md)

0 commit comments

Comments
 (0)