You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/reference-kubernetes-provider.md
+41-43Lines changed: 41 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,107 +20,107 @@ An `AzureAppConfigurationProvider` resource has the following top-level child pr
20
20
21
21
|Name|Description|Required|Type|
22
22
|---|---|---|---|
23
-
|endpoint|The endpoint of Azure App Configuration, which you would like to retrieve the key-values from|alternative|string|
24
-
|connectionStringReference|The name of the Kubernetes Secret that contains Azure App Configuration connection string|alternative|string|
25
-
|target|The destination of the retrieved key-values in Kubernetes|true|object|
26
-
|auth|The authentication method to access Azure App Configuration|false|object|
27
-
|keyValues|The settings for querying and processing key-values|false|object|
23
+
|endpoint|The endpoint of Azure App Configuration, which you would like to retrieve the key-values from.|alternative|string|
24
+
|connectionStringReference|The name of the Kubernetes Secret that contains Azure App Configuration connection string.|alternative|string|
25
+
|target|The destination of the retrieved key-values in Kubernetes.|true|object|
26
+
|auth|The authentication method to access Azure App Configuration.|false|object|
27
+
|keyValues|The settings for querying and processing key-values.|false|object|
28
28
29
29
The `spec.target` property has the following child property.
30
30
31
31
|Name|Description|Required|Type|
32
32
|---|---|---|---|
33
-
|configMapName|The name of the ConfigMap to be created|true|string|
34
-
|configMapData|The setting that specifies how the retrieved data should be populated in the generated ConfigMap|false|object|
33
+
|configMapName|The name of the ConfigMap to be created.|true|string|
34
+
|configMapData|The setting that specifies how the retrieved data should be populated in the generated ConfigMap.|false|object|
35
35
36
36
If the `spec.target.configMapData` property is not set, the generated ConfigMap will be populated with the list of key-values retrieved from Azure App Configuration, which allows the ConfigMap to be consumed as environment variables. Update this property if you wish to consume the ConfigMap as a mounted file. This property has the following child properties.
37
37
38
38
|Name|Description|Required|Type|
39
39
|---|---|---|---|
40
-
|type|The setting that indicates how the retrieved data is constructed in the generated ConfigMap. The allowed values include `default`, `json`, `yaml` and `properties`|optional|string|
41
-
|key|The key name of the retrieved data when the `type` is set to `json`, `yaml` or `properties`. Set it to the file name if the ConfigMap is set up to be consumed as a mounted file|conditional|string|
40
+
|type|The setting that indicates how the retrieved data is constructed in the generated ConfigMap. The allowed values include `default`, `json`, `yaml` and `properties`.|optional|string|
41
+
|key|The key name of the retrieved data when the `type` is set to `json`, `yaml` or `properties`. Set it to the file name if the ConfigMap is set up to be consumed as a mounted file.|conditional|string|
42
42
43
43
The `spec.auth` property isn't required if the connection string of your App Configuration store is provided by setting the `spec.connectionStringReference` property. Otherwise, one of the identities, service principal, workload identity, or managed identity, will be used for authentication. The `spec.auth` has the following child properties. Only one of them should be specified. If none of them are set, the system-assigned managed identity of the virtual machine scale set will be used.
44
44
45
45
|Name|Description|Required|Type|
46
46
|---|---|---|---|
47
-
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal|false|string|
48
-
|workloadIdentity|The settings for using workload identity|false|object|
49
-
|managedIdentityClientId|The Client ID of user-assigned managed identity of virtual machine scale set|false|string|
47
+
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal.|false|string|
48
+
|workloadIdentity|The settings for using workload identity.|false|object|
49
+
|managedIdentityClientId|The Client ID of user-assigned managed identity of virtual machine scale set.|false|string|
50
50
51
51
The `spec.auth.workloadIdentity` property has the following child property.
52
52
53
53
|Name|Description|Required|Type|
54
54
|---|---|---|---|
55
-
|managedIdentityClientId|The Client ID of the user-assigned managed identity associated with the workload identity|true|string|
55
+
|managedIdentityClientId|The Client ID of the user-assigned managed identity associated with the workload identity.|true|string|
56
56
57
57
The `spec.keyValues` has the following child properties. The `spec.keyValues.keyVaults` property is required if any Key Vault references are expected to be downloaded.
58
58
59
59
|Name|Description|Required|Type|
60
60
|---|---|---|---|
61
-
|selectors|The list of selectors for key-value filtering|false|object array|
62
-
|trimKeyPrefixes|The list of key prefixes to be trimmed|false|string array|
63
-
|refresh|The settings for refreshing data from Azure App Configuration. If the property is absent, data from Azure App Configuration will not be refreshed|false|object|
64
-
|keyVaults|The settings for Key Vault references|conditional|object|
61
+
|selectors|The list of selectors for key-value filtering.|false|object array|
62
+
|trimKeyPrefixes|The list of key prefixes to be trimmed.|false|string array|
63
+
|refresh|The settings for refreshing data from Azure App Configuration. If the property is absent, data from Azure App Configuration will not be refreshed.|false|object|
64
+
|keyVaults|The settings for Key Vault references.|conditional|object|
65
65
66
66
If the `spec.keyValues.selectors` property isn't set, all key-values with no label will be downloaded. It contains an array of *selector* objects, which have the following child properties.
67
67
68
68
|Name|Description|Required|Type|
69
69
|---|---|---|---|
70
-
|keyFilter|The key filter for querying key-values|true|string|
71
-
|labelFilter|The label filter for querying key-values|false|string|
70
+
|keyFilter|The key filter for querying key-values.|true|string|
71
+
|labelFilter|The label filter for querying key-values.|false|string|
72
72
73
73
The `spec.keyValues.refresh` property has the following child properties.
74
74
75
75
|Name|Description|Required|Type|
76
76
|---|---|---|---|
77
-
|monitoring|The key-values monitored for change detection, aka sentinel keys. The data from Azure App Configuration will be refreshed only if at least one of the monitored key-values is changed|true|object|
78
-
|interval|The interval at which the data will be refreshed from Azure App Configuration. It must be greater than or equal to 1 second. If the property is absent, a default value of 30 seconds will be used|false|duration string|
77
+
|monitoring|The key-values monitored for change detection, aka sentinel keys. The data from Azure App Configuration will be refreshed only if at least one of the monitored key-values is changed.|true|object|
78
+
|interval|The interval at which the data will be refreshed from Azure App Configuration. It must be greater than or equal to 1 second. If the property is absent, a default value of 30 seconds will be used.|false|duration string|
79
79
80
80
The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which have the following child properties.
81
81
82
82
|Name|Description|Required|Type|
83
83
|---|---|---|---|
84
-
|key|The key of a key-value|true|string|
85
-
|label|The label of a key-value|false|string|
84
+
|key|The key of a key-value.|true|string|
85
+
|label|The label of a key-value.|false|string|
86
86
87
87
The `spec.keyValues.keyVaults` property has the following child properties.
88
88
89
89
|Name|Description|Required|Type|
90
90
|---|---|---|---|
91
-
|target|The destination of the retrieved secrets in Kubernetes|true|object|
92
-
|auth|The authentication method to access Key Vaults|false|object|
93
-
|refresh|The settings for refreshing data from Key Vaults. If the property is absent, data from Key Vaults will not be refreshed unless the corresponding Key Vault references are reloaded|false|object|
91
+
|target|The destination of the retrieved secrets in Kubernetes.|true|object|
92
+
|auth|The authentication method to access Key Vaults.|false|object|
93
+
|refresh|The settings for refreshing data from Key Vaults. If the property is absent, data from Key Vaults will not be refreshed unless the corresponding Key Vault references are reloaded.|false|object|
94
94
95
95
The `spec.keyValues.keyVaults.target` property has the following child property.
96
96
97
97
|Name|Description|Required|Type|
98
98
|---|---|---|---|
99
-
|secretName|The name of the Kubernetes Secret to be created|true|string|
99
+
|secretName|The name of the Kubernetes Secret to be created.|true|string|
100
100
101
101
If the `spec.keyValues.keyVaults.auth` property isn't set, the system-assigned managed identity is used. It has the following child properties.
102
102
103
103
|Name|Description|Required|Type|
104
104
|---|---|---|---|
105
-
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with vaults that don't have individual authentication methods specified|false|string|
106
-
|workloadIdentity|The settings of the workload identity used for authentication with vaults that don't have individual authentication methods specified. It has the same child properties as `spec.auth.workloadIdentity`|false|object|
107
-
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with vaults that don't have individual authentication methods specified|false|string|
108
-
|vaults|The authentication methods for individual vaults|false|object array|
105
+
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with vaults that don't have individual authentication methods specified.|false|string|
106
+
|workloadIdentity|The settings of the workload identity used for authentication with vaults that don't have individual authentication methods specified. It has the same child properties as `spec.auth.workloadIdentity`.|false|object|
107
+
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with vaults that don't have individual authentication methods specified.|false|string|
108
+
|vaults|The authentication methods for individual vaults.|false|object array|
109
109
110
110
The authentication method of each *vault* can be specified with the following properties. One of `managedIdentityClientId`, `servicePrincipalReference` or `workloadIdentity` must be provided.
111
111
112
112
|Name|Description|Required|Type|
113
113
|---|---|---|---|
114
-
|uri|The URI of a vault|true|string|
115
-
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with a vault|false|string|
116
-
|workloadIdentity|The settings of the workload identity used for authentication with a vault. It has the same child properties as `spec.auth.workloadIdentity`|false|object|
117
-
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with a vault|false|string|
114
+
|uri|The URI of a vault.|true|string|
115
+
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with a vault.|false|string|
116
+
|workloadIdentity|The settings of the workload identity used for authentication with a vault. It has the same child properties as `spec.auth.workloadIdentity`.|false|object|
117
+
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with a vault.|false|string|
118
118
119
119
The `spec.keyValues.keyVaults.refresh` property has the following child property.
120
120
121
121
|Name|Description|Required|Type|
122
122
|---|---|---|---|
123
-
|interval|The interval at which the data will be refreshed from Key Vault. It must be greater than or equal to 1 minute. The Key Vault refresh is independent of the App Configuration refresh configured via `spec.keyValues.refresh`|true|duration string|
123
+
|interval|The interval at which the data will be refreshed from Key Vault. It must be greater than or equal to 1 minute. The Key Vault refresh is independent of the App Configuration refresh configured via `spec.keyValues.refresh`.|true|duration string|
124
124
125
125
## Examples
126
126
@@ -293,11 +293,11 @@ spec:
293
293
trimKeyPrefixes: [prefix1, prefix2]
294
294
```
295
295
296
-
### Dynamic configuration refresh
296
+
### Configuration refresh
297
297
298
-
Setting the `spec.keyValues.refresh` property enables dynamic configuration data refresh in ConfigMap and Secret by monitoring designated key-values. The provider periodically polls the key-values, if there is any value change, provider triggers ConfigMap and Secret refresh in accordance with the present data in Azure App Configuration.
298
+
When you make changes to your data in Azure App Configuration, you might want those changes to be refreshed automatically in your Kubernetes cluster. It's common to update multiple key-values, but you don't want the cluster to pick up a change midway through the update. To maintain configuration consistency, you can use a key-value to signal the completion of your update. This key-value is known as the sentinel key. The Kubernetes provider can monitor this key-value, and the ConfigMap and Secret will only be regenerated with updated data once a change is detected in the sentinel key.
299
299
300
-
The following sample instructs monitoring two key-values with 1 minute polling interval.
300
+
In the following sample, a key-value named `sentinelkey` is polled every minute, and the configuration is refreshed whenever changes are detected in the sentinel key.
Refreshing secrets from Key Vaults usually requires reloading the corresponding Key Vault references from Azure App Configuration. However, with the `spec.keyValues.keyVaults.refresh` property, you can refresh the secrets from Key Vault independently. This is especially useful for ensuring that your workload automatically picks up any updated secrets from Key Vault during secret rotation. Note that to load the latest version of a secret, the Key Vault reference must not be a versioned secret.
356
354
@@ -378,7 +376,7 @@ spec:
378
376
interval: 1h
379
377
```
380
378
381
-
### Consume ConfigMap
379
+
### ConfigMap Consumption
382
380
383
381
Applications running in Kubernetes typically consume the ConfigMap either as environment variables or as configuration files. If the `configMapData.type` property is absent or is set to default, the ConfigMap is populated with the itemized list of data retrieved from Azure App Configuration, which can be easily consumed as environment variables. If the `configMapData.type` property is set to json, yaml or properties, data retrieved from Azure App Configuration is grouped into one item with key name specified by the `configMapData.key` property in the generated ConfigMap, which can be consumed as a mounted file.
0 commit comments