Whether you are starting to use Azure DevOps or you have been using it for a while, integrating DevOps with Azure Key Vault is a fundamental skill to have. Today I’ll show you a couple of ways to integrate Azure DevOps and Azure Key Vault.
This blog post will explain how to use Azure Key Vault secrets in Azure DevOps. For the examples, I’ll use release pipelines. You can follow similar steps for using build pipelines.
Table of Contents
Why two methods?
- If you are planning to use Azure Key Vault only for a specific Job within DevOps and this information is not valuable to be shared across multiple pipelines, use the built-in Azure Key Vault task to get secrets.
- If you are planning on using Azure Key Vault secrets across multiple pipelines and jobs, I recommend having a look at the Variable Groups described in the last tutorial.
Why should I use Azure Key Vault in Azure DevOps?
To begin, Azure Key Vault allows you to securely store and maintain credentials. You don’t want to hardcode any sensitive information in your pipelines in Azure DevOps.
I highly suggest checking it out, especially when working with Azure Data Services and doing CI/CD.
Create Azure DevOps Service connection for Azure
First, you need to grant Azure DevOps access to your Azure subscription. The following method allows you to do this without writing a single line of code.
In Azure DevOps, navigate to Service Connections and create a new one.
![Create new service connection in Azure DevOps Create new service connection in Azure DevOps](https://davidalzamendi.com/wp-content/uploads/2021/01/image-4.png)
Select “Azure Resource Manager.”
![Azure resource manager Azure resource manager](https://davidalzamendi.com/wp-content/uploads/2021/01/image.png)
Now, select Service Principal as the authentication method between Azure DevOps and Azure. This option creates a service principal for you.
![service principal Service principal](https://davidalzamendi.com/wp-content/uploads/2021/01/image-48.png)
Next, fill out the configuration of the connection as shown below. If you are concerned about security, you can define a most granular level (by selecting a specific resource group).
![connection configuration](https://davidalzamendi.com/wp-content/uploads/2021/01/image-3.png)
Your new connection is ready and Azure DevOps has direct access to managing your Azure subscription.
![](https://davidalzamendi.com/wp-content/uploads/2021/01/image-1.png)
Give Azure DevOps access to Azure Key Vault
Second, click on service connection and then Manage Service Principal.
![manage service princiapl](https://davidalzamendi.com/wp-content/uploads/2021/01/image-2.png)
This takes you to the Azure Portal. Copy the Application (Client) ID. You will come back to Azure DevOps for the final integration, so stay in the Azure portal.
![Azure portal - copy application ID Azure portal - copy application ID](https://davidalzamendi.com/wp-content/uploads/2021/01/image-8.png)
In your Azure Key Vault, select Access Policies and Add Access Policy.
![access policies - add access policy](https://davidalzamendi.com/wp-content/uploads/2021/01/image-14.png)
To work with secrets, “Get” and “List” are the correct permissions. If you are going to work with Keys or Certificates, you need to customize them based on your needs.
![Secrets get and list](https://davidalzamendi.com/wp-content/uploads/2021/01/image-5.png)
Click to add a Service Principal and paste the Application (Client) ID that you previously copied. Find the service principal and click Select.
![Find the service principal and click select](https://davidalzamendi.com/wp-content/uploads/2021/01/image-15.png)
Click Add.
![Add access policy add access policy](https://davidalzamendi.com/wp-content/uploads/2021/01/image-6.png)
Finally, click Save. Your Azure DevOps has access to work with information created in Azure Key Vault.
![Save](https://davidalzamendi.com/wp-content/uploads/2021/01/image-13.png)
For the next tutorials, you are going to be working with a few demo secrets.
![Demo secrets](https://davidalzamendi.com/wp-content/uploads/2021/01/image-11.png)
Azure DevOps and Key Vault with built-in task
Back in Azure DevOps, it’s time to start using Azure Key Vault. For this example, I’ll use a release pipeline, but you can follow the same steps for a build pipeline and YAML.
![New release pipeline New release pipeline](https://davidalzamendi.com/wp-content/uploads/2021/01/image-16.png)
Click Empty Job.
![Emoty job](https://davidalzamendi.com/wp-content/uploads/2021/01/image-30.png)
Then, click jobs and tasks.
![Jobs and tasks](https://davidalzamendi.com/wp-content/uploads/2021/01/image-24.png)
At the Agent Job level, click to add a new task.
![Add a task to Agent job Add a task to Agent job](https://davidalzamendi.com/wp-content/uploads/2021/01/image-9.png)
There is a pre-built Azure Key Vault task that you can use.
This task will get information from Azure Key Vault (in this case, secrets) so you can use them in the following steps.
Note:
The secrets extracted from Azure Key Vault will become variables in our pipeline. For example: rgName can be referenced as a variable by using $(rgName).
![Azure Key Vault](https://davidalzamendi.com/wp-content/uploads/2021/01/image-7.png)
Configure Azure Key Vault task:
- Previously created service connection
- Key Vault name
- Secrets can be filtered by name (* will list and get all the secrets)
![Configure Azure Key Vault task Configure Azure Key Vault task](https://davidalzamendi.com/wp-content/uploads/2021/01/image-10.png)
For testing purposes, add a new task and search for PowerShell.
![Add PowerShell](https://davidalzamendi.com/wp-content/uploads/2021/01/image-29.png)
Change the configuration to Inline and add the following code before clicking Save.
Write-Host "Resource Group name variable $(rgName)"
Write-Host "Connection String variable $(azSqlConnectionString)"
![Code](https://davidalzamendi.com/wp-content/uploads/2021/01/image-12.png)
If you have created a Release Pipeline, click Create to trigger it.
![Create release](https://davidalzamendi.com/wp-content/uploads/2021/01/image-17.png)
Let’s check the progress. Click the Release link.
![Click the release link](https://davidalzamendi.com/wp-content/uploads/2021/01/image-19.png)
Scroll over your stage and click Logs.
![Logs](https://davidalzamendi.com/wp-content/uploads/2021/01/image-21.png)
You can see that one of the steps is accessing Azure Key Vault, listing and getting the secrets.
![Azure Key Vault](https://davidalzamendi.com/wp-content/uploads/2021/01/image-34.png)
Click that step to see more information.
![More information](https://davidalzamendi.com/wp-content/uploads/2021/01/image-35.png)
You can also click the test PowerShell script to see the code.
![PowerShell script PowerShell script](https://davidalzamendi.com/wp-content/uploads/2021/01/image-39.png)
By design (and this is a good thing), the values of the secrets are hidden with *. The variables are now available so you can use them in any steps.
![Secrets are hidden](https://davidalzamendi.com/wp-content/uploads/2021/01/image-18.png)
Azure DevOps and Key Vault with a group of variables
As you saw before, if you have to create multiple pipelines and stages, this means that you need to include the Azure Key Vault task multiple times. To avoid this, Azure allows you to create a Variable Group and connect it to Azure Key Vault.
First, click to add a new Variable Group in the library.
![Add a new variable](https://davidalzamendi.com/wp-content/uploads/2021/01/image-33.png)
Then, enable the option to connect Azure Key Vault and select your service connection and Azure Key Vault. Click Add variables.
![Add variables](https://davidalzamendi.com/wp-content/uploads/2021/01/image-26.png)
This option allows you to select variables (secrets) that will be relevant to your environment.
![Choose secrets Choose secrets](https://davidalzamendi.com/wp-content/uploads/2021/01/image-25.png)
Save the Variable Group.
![Save the variable group](https://davidalzamendi.com/wp-content/uploads/2021/01/image-20.png)
Now, you will see that the variable group becomes available and it has a different icon.
![](https://davidalzamendi.com/wp-content/uploads/2021/01/image-31.png)
Create Release Pipeline
Let’s finish the integration and try to use that Variable Group. Create a New Release pipeline.
![Create a new release pipeline Create a new release pipeline](https://davidalzamendi.com/wp-content/uploads/2021/01/image-22.png)
Click Empty Job.
![Empty job](https://davidalzamendi.com/wp-content/uploads/2021/01/image-42.png)
Click Variables.
![Variables](https://davidalzamendi.com/wp-content/uploads/2021/01/image-27.png)
In Variables groups, you can Link an existing variable group.
![Link an existing variable group Link an existing variable group](https://davidalzamendi.com/wp-content/uploads/2021/01/image-28.png)
Select the Variable Group. It’s possible to use different groups for different stages (context). For this demo, you will select Release as the context.
![Select variable group](https://davidalzamendi.com/wp-content/uploads/2021/01/image-23.png)
You can see the variables available so they can be used in your pipeline.
![Available variables](https://davidalzamendi.com/wp-content/uploads/2021/01/image-36.png)
Click Jobs and Tasks to create a task to test them.
![Click jobs and task](https://davidalzamendi.com/wp-content/uploads/2021/01/image-32.png)
Add a PowerShell task to the Agent Job.
![Add a PowerShell](https://davidalzamendi.com/wp-content/uploads/2021/01/image-40.png)
Include the following code inline to your PowerShell task and click Save.
Write-Host "Resource Group name variable $(rgName)"
Write-Host "Connection String variable $(azSqlConnectionString)"
![Code example](https://davidalzamendi.com/wp-content/uploads/2021/01/image-37.png)
Create a release so you can test it.
![Create a release to test Create a release to test](https://davidalzamendi.com/wp-content/uploads/2021/01/image-41.png)
Just like the previous tutorial, click the release link.
![Click the release link](https://davidalzamendi.com/wp-content/uploads/2021/01/image-38.png)
Select logs.
![Select logs](https://davidalzamendi.com/wp-content/uploads/2021/01/image-43.png)
You will see an additional step to get Secrets from Azure Key Vault.
![Get secrets from Azure Key Vault Get secrets from Azure Key Vault](https://davidalzamendi.com/wp-content/uploads/2021/01/image-44.png)
Click the step to see more information.
![More information](https://davidalzamendi.com/wp-content/uploads/2021/01/image-46.png)
Click the PowerShell step to see the output.
![PowerShell to see output](https://davidalzamendi.com/wp-content/uploads/2021/01/image-41.png)
As discussed previously, by design, you cannot see the values of the variables, but you can use them in any steps.
![Values are masked](https://davidalzamendi.com/wp-content/uploads/2021/01/image-45.png)
Summary
In this blog post, you learned two different ways to take advantage of Azure Key Vault in Azure DevOps. Both methods require 0 coding skills and they work at different context levels.
What’s Next?
In upcoming blog posts, we’ll continue to explore some of the features within Azure Services.
Please follow Tech Talk Corner on Twitter for blog updates, virtual presentations, and more!
As always, please leave any comments or questions below.