Azure Container Apps (ACA) with Key vault

Jonathan 21 Reputation points
2022-09-30T14:18:20.903+00:00

Hello,

While I know it is possible to connect key vault to container apps via Dapr, I am looking for a direct integration for key vault directly to ACA. In an ideal scenario, I can add the key vault resource to a bicep file, and then call the secrets via the environment block under the container resource. I would like to avoid Dapr as at scale, the amount of resources being consumed and taken away from the container app itself just for key vault secrets seems pretty high and costly.

Does anyone have a document that shows how this can work?

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,175 questions
Azure Container Apps
Azure Container Apps
An Azure service that provides a general-purpose, serverless container platform.
325 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anthony Chu - MSFT 856 Reputation points Microsoft Employee
    2022-10-03T23:13:47.81+00:00

    Thanks for watching the video. As you pointed out, it's on the roadmap but there's no ETA to share at the moment.

    For now, if you have the ability to modify your app, you could enable managed identity in the container app and use the Key Vault SDK in your app to access secrets.

    3 people found this answer helpful.
  2. Akshay-MSFT 17,641 Reputation points Microsoft Employee
    2022-10-03T11:44:45.89+00:00

    Hello @Jonathan ,

    Thanks for your response. I was able to review this, understood the ask as follows and have updated the answer along with supported documentation steps:

    Objective: Granting Azure Container apps access to secrets in Azure Key Vault.

    Steps: This could be achieved via managed identities https://video2.skills-academy.com/en-us/azure/container-apps/managed-identity?tabs=portal%2Cdotnet

    Add a system-assigned identity: https://video2.skills-academy.com/en-us/azure/container-apps/managed-identity?tabs=portal%2Cdotnet#add-a-system-assigned-identity

    • Configure a target resource : For some resources, you'll need to configure role assignments for your app's managed identity to grant access. Otherwise, calls from your app to services, such as Azure Key Vault and Azure SQL Database, will be rejected even if you use a valid token for that identity.
    • Connect to Azure services in app code: With managed identities, an app can obtain tokens to access Azure resources that use Azure Active Directory, such as Azure SQL Database, Azure Key Vault, and Azure Storage. These tokens represent the application accessing the resource, and not any specific user of the application. https://video2.skills-academy.com/en-us/azure/container-apps/managed-identity?tabs=portal%2Cdotnet#connect-to-azure-services-in-app-code
    • View managed identities via Azure CLI :

    az containerapp identity show --name <APP_NAME> --resource-group <GROUP_NAME>

    Thanks,
    Akshay Kaushik

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
  3. Débora Martins de Jesús 0 Reputation points
    2023-05-30T09:39:03.6633333+00:00

    Hello,

    I'm having similar problems to find a proper solution. I want to publish an Azure Machine Learning solution in Azure Marketplace, i'm thinking of using Azure Cotainers. For the solution I'm using:

    • Application insights
    • Azure key vault
    • azure machine learning with Container registry
    • Storage Account
      How can I do an Image of this ones? I just know how to do with the ML.
      Thanks
    0 comments