Skip to content

Commit cbf5a6b

Browse files
author
Jill Grant
authored
Merge pull request #286674 from v-jaswel/aca/v-jaswel_20240912_work_item_310311
[ACA] Show how to use KeyVault to store/retrieve container registry password
2 parents 1930328 + 6a74a5b commit cbf5a6b

File tree

2 files changed

+202
-90
lines changed

2 files changed

+202
-90
lines changed

‎articles/container-apps/get-started-existing-container-image.md

Lines changed: 201 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -37,126 +37,238 @@ This article demonstrates how to deploy an existing container to Azure Container
3737

3838
## Create a container app
3939

40-
Now that you have an environment created, you can deploy your first container app. With the `containerapp create` command, deploy a container image to Azure Container Apps.
40+
Now that you have an environment created, you can deploy your first container app.
4141

42-
The example shown in this article demonstrates how to use a custom container image with common commands. Your container image might need more parameters for the following items:
42+
::: zone pivot="container-apps-private-registry"
4343

44-
- Set the revision mode
45-
- Define secrets
46-
- Define environment variables
47-
- Set container CPU or memory requirements
48-
- Enable and configure Dapr
49-
- Enable external or internal ingress
50-
- Provide minimum and maximum replica values or scale rules
44+
1. Set the environment variables.
5145

52-
::: zone pivot="container-apps-private-registry"
46+
Replace the `<PLACEHOLDERS>` with your values. Your user principal name will typically be in the format of an email address (for example, `[email protected]`).
5347

54-
# [Bash](#tab/bash)
48+
# [Bash](#tab/bash)
5549

56-
For details on how to provide values for any of these parameters to the `create` command, run `az containerapp create --help` or [visit the online reference](/cli/azure/containerapp#az-containerapp-create). To generate credentials for an Azure Container Registry, use [az acr credential show](/cli/azure/acr/credential#az-acr-credential-show).
50+
```bash
51+
CONTAINER_APP_NAME=my-container-app
52+
KEY_VAULT_NAME=my-key-vault
53+
USER_PRINCIPAL_NAME=<USER_PRINCIPAL_NAME>
54+
SECRET_NAME=my-secret-name
55+
CONTAINER_IMAGE_NAME=<CONTAINER_IMAGE_NAME>
56+
REGISTRY_SERVER=<REGISTRY_SERVER>
57+
REGISTRY_USERNAME=<REGISTRY_USERNAME>
58+
```
5759

58-
```bash
59-
CONTAINER_IMAGE_NAME=<CONTAINER_IMAGE_NAME>
60-
REGISTRY_SERVER=<REGISTRY_SERVER>
61-
REGISTRY_USERNAME=<REGISTRY_USERNAME>
62-
REGISTRY_PASSWORD=<REGISTRY_PASSWORD>
63-
```
60+
# [Azure PowerShell](#tab/azure-powershell)
6461

65-
(Replace the \<placeholders\> with your values.)
62+
```azurepowershell-interactive
63+
$ContainerAppName = "my-container-app"
64+
$KeyVaultName = "my-key-vault"
65+
$UserPrincipalName = "<USER_PRINCIPAL_NAME>"
66+
$SecretName = "my-secret-name"
67+
$ContainerImageName = "<CONTAINER_IMAGE_NAME>"
68+
$RegistryServer = "<REGISTRY_SERVER>"
69+
$RegistryUsername = "<REGISTRY_USERNAME>"
70+
```
6671

67-
```azurecli-interactive
68-
az containerapp create \
69-
--name my-container-app \
70-
--resource-group $RESOURCE_GROUP \
71-
--image $CONTAINER_IMAGE_NAME \
72-
--environment $CONTAINERAPPS_ENVIRONMENT \
73-
--registry-server $REGISTRY_SERVER \
74-
--registry-username $REGISTRY_USERNAME \
75-
--registry-password $REGISTRY_PASSWORD
76-
```
72+
---
7773

78-
# [Azure PowerShell](#tab/azure-powershell)
74+
1. Create the key vault.
7975

80-
```azurepowershell-interactive
81-
$ContainerImageName = "<CONTAINER_IMAGE_NAME>"
82-
$RegistryServer = "<REGISTRY_SERVER>"
83-
$RegistryUsername = "<REGISTRY_USERNAME>"
84-
$RegistryPassword = "<REGISTRY_PASSWORD>"
85-
```
76+
Storing your container registry password using a service such as [Azure Key Vault](/azure/key-vault/general/basic-concepts) keeps the values secure at all times. The steps in this section show how to create a key vault, store your container registry password the Key Vault, and then retrieve the password for use in your code.
8677

87-
(Replace the \<placeholders\> with your values.)
78+
# [Bash](#tab/bash)
8879

89-
```azurepowershell-interactive
90-
$EnvId = (Get-AzContainerAppManagedEnv -ResourceGroupName $ResourceGroupName -EnvName $ContainerAppsEnvironment).Id
80+
```bash
81+
az keyvault create --name $KEY_VAULT_NAME --resource-group $RESOURCE_GROUP
82+
```
9183

92-
$TemplateObj = New-AzContainerAppTemplateObject -Name my-container-app -Image $ContainerImageName
84+
# [Azure PowerShell](#tab/azure-powershell)
9385

94-
$RegistrySecretObj = New-AzContainerAppSecretObject -Name registry-secret -Value $RegistryPassword
86+
Install the [Key Vault](https://www.powershellgallery.com/packages/Az.KeyVault) module.
9587

96-
$RegistryArgs = @{
97-
PasswordSecretRef = 'registry-secret'
98-
Server = $RegistryServer
99-
Username = $RegistryUsername
100-
}
88+
```azurepowershell-interactive
89+
Install-Module Az.KeyVault -Repository PSGallery -Force
90+
```
10191

102-
$RegistryObj = New-AzContainerAppRegistryCredentialObject @RegistryArgs
92+
```azurepowershell-interactive
93+
New-AzKeyVault -Name "$KeyVaultName" -ResourceGroupName "$ResourceGroupName" -Location "$Location"
94+
```
10395

104-
$ContainerAppArgs = @{
105-
Name = 'my-container-app'
106-
Location = $Location
107-
ResourceGroupName = $ResourceGroupName
108-
ManagedEnvironmentId = $EnvId
109-
TemplateContainer = $TemplateObj
110-
ConfigurationRegistry = $RegistryObj
111-
ConfigurationSecret = $RegistrySecretObj
112-
}
96+
---
11397

114-
New-AzContainerApp @ContainerAppArgs
115-
```
98+
1. Give your user account permissions to manage secrets in the key vault.
11699

117-
---
100+
# [Bash](#tab/bash)
101+
102+
```bash
103+
KEY_VAULT_ID=$(az keyvault show --name $KEY_VAULT_NAME --query id --output tsv)
104+
az role assignment create --role "Key Vault Secrets Officer" --assignee "$USER_PRINCIPAL_NAME" --scope "$KEY_VAULT_ID"
105+
```
106+
107+
# [Azure PowerShell](#tab/azure-powershell)
108+
109+
```azurepowershell-interactive
110+
$KeyVault=Get-AzKeyVault -VaultName $KeyVaultName
111+
New-AzRoleAssignment -SignInName "$UserPrincipalName" -RoleDefinitionName "Key Vault Secrets Officer" -Scope $KeyVault.ResourceID
112+
```
113+
114+
---
115+
116+
1. Store your container registry password in the key vault.
117+
118+
Replace `<REGISTRY_PASSWORD>` with your value.
119+
120+
# [Bash](#tab/bash)
121+
122+
```bash
123+
az keyvault secret set --vault-name $KEY_VAULT_NAME --name $SECRET_NAME --value "<REGISTRY_PASSWORD>"
124+
```
125+
126+
# [Azure PowerShell](#tab/azure-powershell)
127+
128+
```azurepowershell-interactive
129+
$Secret = ConvertTo-SecureString -String "<REGISTRY_PASSWORD>" -AsPlainText -Force
130+
Set-AzKeyVaultSecret -VaultName "$KeyVaultName" -Name "$SecretName" -SecretValue "$Secret"
131+
```
132+
133+
---
134+
135+
1. Retrieve your container registry password from the key vault.
136+
137+
# [Bash](#tab/bash)
138+
139+
```bash
140+
REGISTRY_PASSWORD=$(az keyvault secret show --name $SECRET_NAME --vault-name $KEY_VAULT_NAME --query value --output tsv)
141+
```
142+
143+
# [Azure PowerShell](#tab/azure-powershell)
144+
145+
```azurepowershell-interactive
146+
$RegistryPassword = Get-AzKeyVaultSecret -VaultName "$KeyVaultName" -Name "$SecretName" -AsPlainText
147+
```
148+
149+
---
150+
151+
1. Deploy a container image to Azure Container Apps.
152+
153+
# [Bash](#tab/bash)
154+
155+
```azurecli-interactive
156+
az containerapp create \
157+
--name $CONTAINER_APP_NAME \
158+
--location $LOCATION \
159+
--resource-group $RESOURCE_GROUP \
160+
--image $CONTAINER_IMAGE_NAME \
161+
--environment $CONTAINERAPPS_ENVIRONMENT \
162+
--registry-server $REGISTRY_SERVER \
163+
--registry-username $REGISTRY_USERNAME \
164+
--registry-password $REGISTRY_PASSWORD
165+
```
166+
167+
If you have enabled ingress on your container app, you can add `--query properties.configuration.ingress.fqdn` to the `create` command to return the public URL for the application.
168+
169+
# [Azure PowerShell](#tab/azure-powershell)
170+
171+
```azurepowershell-interactive
172+
$EnvId = (Get-AzContainerAppManagedEnv -ResourceGroupName $ResourceGroupName -EnvName $ContainerAppsEnvironment).Id
173+
```
174+
175+
```azurepowershell-interactive
176+
$TemplateObj = New-AzContainerAppTemplateObject -Name $ContainerAppName -Image $ContainerImageName
177+
```
178+
179+
```azurepowershell-interactive
180+
$RegistrySecretObj = New-AzContainerAppSecretObject -Name $SecretName -Value $RegistryPassword
181+
```
182+
183+
```azurepowershell-interactive
184+
$RegistryArgs = @{
185+
PasswordSecretRef = $SecretName
186+
Server = $RegistryServer
187+
Username = $RegistryUsername
188+
}
189+
```
190+
191+
```azurepowershell-interactive
192+
$RegistryObj = New-AzContainerAppRegistryCredentialObject @RegistryArgs
193+
```
194+
195+
```azurepowershell-interactive
196+
$ContainerAppArgs = @{
197+
Name = $ContainerAppName
198+
Location = $Location
199+
ResourceGroupName = $ResourceGroupName
200+
ManagedEnvironmentId = $EnvId
201+
TemplateContainer = $TemplateObj
202+
ConfigurationRegistry = $RegistryObj
203+
ConfigurationSecret = $RegistrySecretObj
204+
}
205+
```
206+
207+
```azurepowershell-interactive
208+
New-AzContainerApp @ContainerAppArgs
209+
```
210+
211+
---
118212

119213
::: zone-end
120214

121215
::: zone pivot="container-apps-public-registry"
122216

123-
# [Bash](#tab/bash)
217+
1. Set the environment variables.
124218

125-
```azurecli-interactive
126-
az containerapp create \
127-
--image <REGISTRY_CONTAINER_NAME> \
128-
--name my-container-app \
129-
--resource-group $RESOURCE_GROUP \
130-
--environment $CONTAINERAPPS_ENVIRONMENT
219+
# [Bash](#tab/bash)
131220

132-
If you have enabled ingress on your container app, you can add `--query properties.configuration.ingress.fqdn` to the `create` command to return the public URL for the application.
221+
```bash
222+
CONTAINER_APP_NAME=my-container-app
223+
CONTAINER_IMAGE_NAME=mcr.microsoft.com/k8se/quickstart:latest
224+
```
133225

134-
```
226+
# [Azure PowerShell](#tab/azure-powershell)
135227

136-
# [Azure PowerShell](#tab/azure-powershell)
228+
```azurepowershell-interactive
229+
$ContainerAppName = "my-container-app"
230+
$ContainerImageName = "mcr.microsoft.com/k8se/quickstart:latest"
231+
```
137232

138-
```azurepowershell-interactive
139-
$TemplateObj = New-AzContainerAppTemplateObject -Name my-container-app -Image "<REGISTRY_CONTAINER_NAME>"
140-
```
233+
1. Deploy a container image to Azure Container Apps.
141234

142-
(Replace the \<REGISTRY_CONTAINER_NAME\> with your value.)
235+
# [Bash](#tab/bash)
143236

144-
```azurepowershell-interactive
145-
$EnvId = (Get-AzContainerAppManagedEnv -ResourceGroupName $ResourceGroupName -EnvName $ContainerAppsEnvironment).Id
146-
147-
$ContainerAppArgs = @{
148-
Name = "my-container-app"
149-
Location = $Location
150-
ResourceGroupName = $ResourceGroupName
151-
ManagedEnvironmentId = $EnvId
152-
TemplateContainer = $TemplateObj
153-
}
154-
New-AzContainerApp @ContainerAppArgs
155-
```
237+
```azurecli-interactive
238+
az containerapp create \
239+
--image $CONTAINER_IMAGE_NAME \
240+
--name $CONTAINER_APP_NAME \
241+
--resource-group $RESOURCE_GROUP \
242+
--environment $CONTAINERAPPS_ENVIRONMENT
243+
```
156244

157-
---
245+
If you have enabled ingress on your container app, you can add `--query properties.configuration.ingress.fqdn` to the `create` command to return the public URL for the application.
246+
247+
# [Azure PowerShell](#tab/azure-powershell)
248+
249+
```azurepowershell-interactive
250+
$TemplateObj = New-AzContainerAppTemplateObject -Name $ContainerAppName -Image $ContainerImageName
251+
```
252+
253+
```azurepowershell-interactive
254+
$EnvId = (Get-AzContainerAppManagedEnv -ResourceGroupName $ResourceGroupName -EnvName $ContainerAppsEnvironment).Id
255+
```
158256

159-
Before you run this command, replace `<REGISTRY_CONTAINER_NAME>` with the full name the public container registry location, including the registry path and tag. For example, a valid container name is `mcr.microsoft.com/k8se/quickstart:latest`.
257+
```azurepowershell-interactive
258+
$ContainerAppArgs = @{
259+
Name = $ContainerAppName
260+
Location = $Location
261+
ResourceGroupName = $ResourceGroupName
262+
ManagedEnvironmentId = $EnvId
263+
TemplateContainer = $TemplateObj
264+
}
265+
```
266+
267+
```azurepowershell-interactive
268+
New-AzContainerApp @ContainerAppArgs
269+
```
270+
271+
---
160272

161273
::: zone-end
162274

@@ -173,14 +285,14 @@ LOG_ANALYTICS_WORKSPACE_CLIENT_ID=`az containerapp env show --name $CONTAINERAPP
173285
174286
az monitor log-analytics query \
175287
--workspace $LOG_ANALYTICS_WORKSPACE_CLIENT_ID \
176-
--analytics-query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == 'my-container-app' | project ContainerAppName_s, Log_s, TimeGenerated" \
288+
--analytics-query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == $CONTAINER_APP_NAME | project ContainerAppName_s, Log_s, TimeGenerated" \
177289
--out table
178290
```
179291

180292
# [Azure PowerShell](#tab/azure-powershell)
181293

182294
```azurepowershell-interactive
183-
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == 'my-container-app' | project ContainerAppName_s, Log_s, TimeGenerated"
295+
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query "ContainerAppConsoleLogs_CL | where ContainerAppName_s == $ContainerAppName | project ContainerAppName_s, Log_s, TimeGenerated"
184296
$queryResults.Results
185297
```
186298

‎includes/container-apps-set-environment-variables.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.author: cshoe
88

99
## Set environment variables
1010

11-
Set the following environment variables. Replace \<PLACEHOLDERS\> with your values:
11+
Set the following environment variables. Replace the `<PLACEHOLDERS>` with your values:
1212

1313
# [Bash](#tab/bash)
1414

0 commit comments

Comments
 (0)