You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/spring-cloud/spring-cloud-github-actions-key-vault.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,14 +9,14 @@ ms.date: 01/20/2019
9
9
---
10
10
11
11
# Authenticate Azure Spring Cloud with Key Vault in Github Actions
12
-
Key vault is a secure place to store keys. Enterprise users need to store credentials for CI/CD environments in scope that they control. The key to get credentials in the key vault should be limited to resource scope. The key to get credentials has access to only the key vault scope, not the entire Azure scope. It's like a key that can only open a strongbox not a master key that can open all doors in a building. It is a way to get a key with another key, but useful in a CICD workflow.
12
+
Key vault is a secure place to store keys. Enterprise users need to store credentials for CI/CD environments in scope that they control. The key to get credentials in the key vault should be limited to resource scope. It has access to only the key vault scope, not the entire Azure scope. It's like a key that can only open a strong box not a master key that can open all doors in a building. It's a way to get a key with another key, but useful in a CICD workflow.
13
13
14
-
## Generate Credential to Access to Key Vault
15
-
To generate the key to open the strongbox, execute command below on you local machine:
14
+
## Generate Credential
15
+
To generate a key to access the key vault, execute command below on your local machine:
16
16
```
17
17
az ad sp create-for-rbac --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.KeyVault/vaults/<KEY_VAULT> --sdk-auth
18
18
```
19
-
Note the scope specified by the `--scopes` parameter, which limits the key access to the resource. It can only access the strongbox.
19
+
Note the scope specified by the `--scopes` parameter, which limits the key access to the resource. It can only access the strong box.
Then save the results to GitHub **secrets** as described in[Set up your GitHub repository and authenticate with Azure](./spring-cloud-howto-github-actions.md#set-up-your-github-repository-and-authenticate-with-azure).
36
+
Then save the results to GitHub **secrets** as described in[Set up your GitHub repository and authenticate with Azure](./spring-cloud-howto-github-actions.md#set-up-your-github-repository-and-authenticate-with-azure).
37
37
38
38
## Add Access Policies for the Credential
39
-
The credential created above can only get general information about the Key Vault, not the contents it stores. To get secrets stored in the Key Vault, you need set access policies for the credential.
39
+
The credential you created above can only get general information about the Key Vault, not the contents it stores. To get secrets stored in the Key Vault, you need set access policies for the credential.
40
40
41
-
Go to the **Key Vault** dashboard in Azure Portal, click the **Access control** menu, then open the **Role assignments** tab. Select **Apps** for **Type**, `This resource` for **scope**. You should see the credential you created in previous step:
41
+
Go to the **Key Vault** dashboard in Azure portal, click the **Access control** menu, then open the **Role assignments** tab. Select **Apps** for **Type**, `This resource` for **scope**. You should see the credential you created in previous step:
Copy the entire JSON string. Bo back to **Key Vault** dashboard. Open the **Secrets** menu, then click the **Generate/Import** button. Input the secret name, such as `AZURE-CRENDENTIALS-FOR-SPRING`. Paste the JSON credential string to the **Value** input box. You may notice the value input box is a one-line text feild, rather then a multi-line text area. You can paste the complete JSON string there.
73
+
Copy the entire JSON string. Bo back to **Key Vault** dashboard. Open the **Secrets** menu, then click the **Generate/Import** button. Input the secret name, such as `AZURE-CRENDENTIALS-FOR-SPRING`. Paste the JSON credential string to the **Value** input box. You may notice the value input box is a one-line text field, rather than a multi-line text area. You can paste the complete JSON string there.
Copy file name to clipboardExpand all lines: articles/spring-cloud/spring-cloud-howto-github-actions.md
+13-10Lines changed: 13 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,9 +12,9 @@ ms.date: 01/15/2019
12
12
GitHub Actions support an automated software development lifecycle workflow. With GitHub Actions for Azure Spring Cloud you can create workflows in your repository to build, test, package, release, and deploy to Azure.
13
13
14
14
## Prerequisites
15
-
This example requires the [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest)
15
+
This example requires the [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest).
16
16
17
-
## Set up your GitHub repository and authenticate with Azure
17
+
## Set up GitHub repository and authenticate
18
18
You need an Azure service principle credential to authorize Azure login action. To get an Azure credential, execute the following commands on your local machine:
19
19
```
20
20
az login
@@ -39,14 +39,14 @@ This example uses the [Piggy Metrics](https://github.com/Azure-Samples/piggymetr
39
39
40
40

41
41
42
-
Set the secret name to AZURE_CREDENTIALS, and its value to the JSON string that you found under the heading *Set up your GitHub repository and authenticate with Azure*.
42
+
Set the secret name to `AZURE_CREDENTIALS` and its value to the JSON string that you found under the heading *Set up your GitHub repository and authenticate with Azure*.
You can also get the Azure login credential from Key Vault in GitHub actions as explained in [Authenticate Azure Spring with Key Vault in Github Actions](./spring-cloud-github-actions-key-vault.md).
46
+
You can also get the Azure login credential from Key Vault in GitHub actions as explained in [Authenticate Azure Spring with Key Vault in GitHub Actions](./spring-cloud-github-actions-key-vault.md).
47
47
48
-
## Provision Azure Spring Cloud service instance
49
-
To provision your service instance, run the following commands using the Azure CLI.
48
+
## Provision service instance
49
+
To provision your Azure Spring Cloud service instance, run the following commands using the Azure CLI.
50
50
```
51
51
az extension add --name spring-cloud
52
52
az group create --location eastus --name <resource group name>
@@ -111,7 +111,10 @@ jobs:
111
111
az spring-cloud app deploy -n auth-service --jar-path ${{ github.workspace }}/auth-service/target/auth-service.jar
112
112
```
113
113
### Deploy with Azure CLI action
114
-
The az `run` command will use the latest version of Azure CLI. In case of breaking changes, you can also use a specific version of Azure CLI with azure/CLI `action`. This will run all the az command in a new container, therefore note that `env` will not work, and cross action file access may have extra restrictions.
114
+
The az `run` command will use the latest version of Azure CLI. If there are breaking changes, you can also use a specific version of Azure CLI with azure/CLI `action`.
115
+
116
+
> [!Note]
117
+
> This command will run all the az command in a new container, so `env` will not work, and cross action file access may have extra restrictions.
115
118
116
119
Create the .github/workflow/main.yml file in the repository:
117
120
```
@@ -188,13 +191,13 @@ jobs:
188
191
## Run the workflow
189
192
GitHub Actions should be enabled automatically after you push `.github/workflow/main.yml` to GitHub. The action will be triggered when you push a new commit. If you create this file in the browser, your action should have already run.
190
193
191
-
To verify your action has been enabled, click **Actions** tab on the GitHub repository page:
194
+
To verify that the action has been enabled, click **Actions** tab on the GitHub repository page:
If your action runs in error, for example, you haven't set Azure credential, you can re-run checks after fixing the error. On GitHub repository page, click **Actions**, select the specific workflow task, then click Re-run checks button to re-run checks:
198
+
If your action runs in error, for example, if you haven't set Azure credential, you can rerun checks after fixing the error. On the GitHub repository page, click **Actions**, select the specific workflow task, and then click Rerun checks button to rerun checks:
0 commit comments