Skip to content

Commit 55ed3e9

Browse files
ShawnJacksonShawnJackson
authored
Merge pull request #99899 from megvanhuygen/service-fabric-application-secret-store
Edit pass: Service Fabric Secrets Store
2 parents 678e376 + 1b1b6bd commit 55ed3e9

File tree

1 file changed

+77
-72
lines changed

1 file changed

+77
-72
lines changed

‎articles/service-fabric/service-fabric-application-secret-store.md

Lines changed: 77 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
---
2-
title: Service Fabric Secrets Store
3-
description: This article describes how to use Service Fabric Secrets Store.
2+
title: Azure Service Fabric Central Secrets Store
3+
description: This article describes how to use Central Secrets Store in Azure Service Fabric.
44

55
ms.topic: conceptual
66
ms.date: 07/25/2019
77
---
88

9-
# Service Fabric Secrets Store
10-
This article describes how to create and use secrets in Service Fabric applications using Service Fabric Secrets Store(CSS). CSS is a local secret store cache, used to keep sensitive data such as a password, tokens, and keys encrypted in memory.
9+
# Central Secrets Store in Azure Service Fabric
10+
This article describes how to use Central Secrets Store (CSS) in Azure Service Fabric to create secrets in Service Fabric applications. CSS is a local secret store cache that keeps sensitive data, such as a password, tokens, and keys, encrypted in memory.
1111

12-
## Enabling Secrets Store
13-
Add the below to your cluster configuration under `fabricSettings` to enable CSS. It's recommended to use a certificate different from cluster certificate for CSS. Make sure the encryption certificate is installed on all nodes and `NetworkService` has read permission to certificate's private key.
12+
## Enable Central Secrets Store
13+
Add the following script to your cluster configuration under `fabricSettings` to enable CSS. We recommend that you use a certificate other than a cluster certificate for CSS. Make sure the encryption certificate is installed on all nodes and that `NetworkService` has read permission to the certificate's private key.
1414
```json
1515
"fabricSettings":
1616
[
@@ -42,10 +42,14 @@ This article describes how to create and use secrets in Service Fabric applicati
4242
...
4343
]
4444
```
45-
## Declare secret resource
46-
You can create a secret resource either using the Resource Manager template or using the REST API.
45+
## Declare a secret resource
46+
You can create a secret resource by using either the Azure Resource Manager template or the REST API.
47+
48+
### Use Resource Manager
49+
50+
Use the following template to use Resource Manager to create the secret resource. The template creates a `supersecret` secret resource, but no value is set for the secret resource yet.
51+
4752

48-
* Using Resource Manager template
4953
```json
5054
"resources": [
5155
{
@@ -62,20 +66,20 @@ You can create a secret resource either using the Resource Manager template or u
6266
}
6367
]
6468
```
65-
The above template creates `supersecret` secret resource, but no value is set for the secret resource yet.
6669

67-
* Using the REST API
70+
### Use the REST API
6871

69-
To create secret resource, `supersecret` make a PUT request to `https://<clusterfqdn>:19080/Resources/Secrets/supersecret?api-version=6.4-preview`. You need the cluster certificate or admin client certificate to create a secret.
72+
To create a `supersecret` secret resource by using the REST API, make a PUT request to `https://<clusterfqdn>:19080/Resources/Secrets/supersecret?api-version=6.4-preview`. You need the cluster certificate or admin client certificate to create a secret resource.
7073

7174
```powershell
7275
Invoke-WebRequest -Uri https://<clusterfqdn>:19080/Resources/Secrets/supersecret?api-version=6.4-preview -Method PUT -CertificateThumbprint <CertThumbprint>
7376
```
7477

75-
## Set secret value
76-
* Using Resource Manager template
78+
## Set the secret value
79+
80+
### Use the Resource Manager template
7781

78-
The below Resource Manager template creates and set value for secret `supersecret` with version `ver1`.
82+
Use the following Resource Manager template to create and set the secret value. This template sets the secret value for the `supersecret` secret resource as version `ver1`.
7983
```json
8084
{
8185
"parameters": {
@@ -113,67 +117,68 @@ The below Resource Manager template creates and set value for secret `supersecre
113117
}
114118
],
115119
```
116-
* Using the REST API
120+
### Use the REST API
117121

122+
Use the following script to use the REST API to set the secret value.
118123
```powershell
119124
$Params = @{"properties": {"value": "mysecretpassword"}}
120125
Invoke-WebRequest -Uri https://<clusterfqdn>:19080/Resources/Secrets/supersecret/values/ver1?api-version=6.4-preview -Method PUT -Body $Params -CertificateThumbprint <ClusterCertThumbprint>
121126
```
122-
## Using the secret in your application
123-
124-
1. Add a section in settings.xml file with the below content. Note here the Value is of the format {`secretname:version`}
125-
126-
```xml
127-
<Section Name="testsecrets">
128-
<Parameter Name="TopSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/
129-
</Section>
130-
```
131-
2. Now import the section in ApplicationManifest.xml
132-
```xml
133-
<ServiceManifestImport>
134-
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
135-
<ConfigOverrides />
136-
<Policies>
137-
<ConfigPackagePolicies CodePackageRef="Code">
138-
<ConfigPackage Name="Config" SectionName="testsecrets" EnvironmentVariableName="SecretPath" />
139-
</ConfigPackagePolicies>
140-
</Policies>
141-
</ServiceManifestImport>
142-
```
143-
144-
Environment Variable 'SecretPath' will point to the directory where all secrets are stored. Each parameter listed under section `testsecrets` will be stored in a separate file. Application can now use the secret as shown below
145-
```C#
146-
secretValue = IO.ReadFile(Path.Join(Environment.GetEnvironmentVariable("SecretPath"), "TopSecret"))
147-
```
148-
3. Mounting secrets to a container
149-
150-
Only change required to make the secrets available inside the container is to specify a MountPoint in `<ConfigPackage>`.
151-
Here is the modified ApplicationManifest.xml
152-
153-
```xml
154-
<ServiceManifestImport>
155-
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
156-
<ConfigOverrides />
157-
<Policies>
158-
<ConfigPackagePolicies CodePackageRef="Code">
159-
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="C:\secrets" EnvironmentVariableName="SecretPath" />
160-
<!-- Linux Container
161-
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="/mnt/secrets" EnvironmentVariableName="SecretPath" />
162-
-->
163-
</ConfigPackagePolicies>
164-
</Policies>
165-
</ServiceManifestImport>
166-
```
167-
Secrets will be available under the mount point inside your container.
127+
## Use the secret in your application
128+
129+
Follow these steps to use the secret in your Service Fabric application.
130+
131+
1. Add a section in the **settings.xml** file with the following snippet. Note here that the value is in the format {`secretname:version`}.
132+
133+
```xml
134+
<Section Name="testsecrets">
135+
<Parameter Name="TopSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/
136+
</Section>
137+
```
138+
139+
1. Import the section in **ApplicationManifest.xml**.
140+
```xml
141+
<ServiceManifestImport>
142+
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
143+
<ConfigOverrides />
144+
<Policies>
145+
<ConfigPackagePolicies CodePackageRef="Code">
146+
<ConfigPackage Name="Config" SectionName="testsecrets" EnvironmentVariableName="SecretPath" />
147+
</ConfigPackagePolicies>
148+
</Policies>
149+
</ServiceManifestImport>
150+
```
151+
152+
The environment variable `SecretPath` will point to the directory where all secrets are stored. Each parameter listed under the `testsecrets` section is stored in a separate file. The application can now use the secret as follows:
153+
```C#
154+
secretValue = IO.ReadFile(Path.Join(Environment.GetEnvironmentVariable("SecretPath"), "TopSecret"))
155+
```
156+
1. Mount the secrets to a container. The only change required to make the secrets available inside the container is to `specify` a mount point in `<ConfigPackage>`.
157+
The following snippet is the modified **ApplicationManifest.xml**.
158+
159+
```xml
160+
<ServiceManifestImport>
161+
<ServiceManifestRef ServiceManifestName="testservicePkg" ServiceManifestVersion="1.0.0" />
162+
<ConfigOverrides />
163+
<Policies>
164+
<ConfigPackagePolicies CodePackageRef="Code">
165+
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="C:\secrets" EnvironmentVariableName="SecretPath" />
166+
<!-- Linux Container
167+
<ConfigPackage Name="Config" SectionName="testsecrets" MountPoint="/mnt/secrets" EnvironmentVariableName="SecretPath" />
168+
-->
169+
</ConfigPackagePolicies>
170+
</Policies>
171+
</ServiceManifestImport>
172+
```
173+
Secrets are available under the mount point inside your container.
174+
175+
1. You can bind a secret to a process environment variable by specifying `Type='SecretsStoreRef`. The following snippet is an example of how to bind the `supersecret` version `ver1` to the environment variable `MySuperSecret` in **ServiceManifest.xml**.
176+
177+
```xml
178+
<EnvironmentVariables>
179+
<EnvironmentVariable Name="MySuperSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/>
180+
</EnvironmentVariables>
181+
```
168182

169-
4. Binding secret to an environment variable
170-
171-
You can bind secret to a process environment variable by specifying Type='SecretsStoreRef'. Here is an example of how to bind `supersecret` version `ver1` to environment variable `MySuperSecret` in ServiceManifest.xml.
172-
173-
```xml
174-
<EnvironmentVariables>
175-
<EnvironmentVariable Name="MySuperSecret" Type="SecretsStoreRef" Value="supersecret:ver1"/>
176-
</EnvironmentVariables>
177-
```
178183
## Next steps
179-
Learn more about [application and service security](service-fabric-application-and-service-security.md)
184+
Learn more about [application and service security](service-fabric-application-and-service-security.md).

0 commit comments

Comments
 (0)