Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 13 additions & 20 deletions managed-identity-keyvault/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,43 +6,36 @@ You need include [ManagedIdentityCredentialBuilder](https://docs.microsoft.com/j

## Prerequisite

* [JDK 8](https://docs.microsoft.com/azure/java/jdk/java-jdk-install)
* [JDK 21](https://docs.microsoft.com/azure/java/jdk/java-jdk-install)
* [Maven 3.0 and above](http://maven.apache.org/install.html)
* [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest) or [Azure Cloud Shell](https://docs.microsoft.com/azure/cloud-shell/overview)
* An existing Key Vault. If you need to create a Key Vault, you can use the [Azure Portal](https://docs.microsoft.com/azure/key-vault/secrets/quick-create-portal) or [Azure CLI](https://docs.microsoft.com/cli/azure/keyvault?view=azure-cli-latest#az-keyvault-create)

## How to run

1. Run `mvn clean package` after specifying the URI of your Key Vault in [application.properties](./src/main/resources/application.properties).
2. Install Azure CLI extension for Azure Spring Apps by running below command.
1. Create an instance of Azure Spring Apps.
```
az extension add -y --source https://azureclitemp.blob.core.windows.net/spring-cloud/spring_cloud-0.1.0-py2.py3-none-any.whl
az spring create -n <resource name> -g <resource group name>
```
3. Create an instance of Azure Spring Apps.
1. Create an app with public domain assigned.
```
az spring-cloud create -n <resource name> -g <resource group name>
az spring app create -n <app name> --service <resource name> -g <resource group name> --assign-endpoint true --runtime-version Java_21
```
4. Create an app with public domain assigned.
```
az spring-cloud app create -n <app name> -s <resource name> -g <resource group name> --is-public true
```
5. Enable system-assigned managed identity for your app and take note of the principal id from the command output.
1. Enable system-assigned managed identity for your app and take note of the principal id from the command output.
```
az spring-cloud app identity assign -n <app name> -s <resource name> -g <resource group name>
az spring app identity assign -n <app name> --service <resource name> -g <resource group name>
```
6. Grant permission of Key Vault to the system-assigned managed identity.
```
az keyvault set-policy -n keyvault_name -g resource_group_of_keyvault --secret-permissions get set --object-id <principal-id-you-got-in-step5>
```
7. Deploy app with jar.
1. Assign `Key Vault Secrets User` role to the system-assigned managed identity.
1. Deploy app with jar.
```
az spring-cloud app deploy -n <app name> -s <resource name> -g <resource group name> --jar-path ./target/asc-managed-identity-keyvault-sample-0.1.0.jar
az spring app deploy -n <app name> --service <resource name> -g <resource group name> --jar-path ./target/asc-managed-identity-keyvault-sample-0.1.0.jar
```
8. Verify app is running. Instances should have status `RUNNING` and discoveryStatus `UP`.
1. Verify app is running. Instances should have status `RUNNING` and discoveryStatus `UP`.
```
az spring-cloud app show -n <app name> -s <resource name> -g <resource group name>
az spring app show -n <app name> --service <resource name> -g <resource group name>
```
9. Verify sample is working. The url is fetched from previous step.
1. Verify sample is working. The url is fetched from previous step.
```
# Create a secret in Key Vault
curl -X PUT {url}/secrets/{secret-name}?value={value}
Expand Down
13 changes: 4 additions & 9 deletions managed-identity-keyvault/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<parent>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-parent</artifactId>
<version>Hoxton.SR8</version>
<version>2025.0.1</version>
</parent>

<dependencies>
Expand All @@ -21,17 +21,12 @@
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-identity</artifactId>
<version>1.0.0</version>
<version>1.18.1</version>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-security-keyvault-secrets</artifactId>
<version>4.0.0</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
<version>4.10.4</version>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
Expand All @@ -40,7 +35,7 @@
</dependencies>

<properties>
<java.version>1.8</java.version>
<java.version>21</java.version>
</properties>

<build>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@
import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;
import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
import jakarta.annotation.PostConstruct;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.*;

import javax.annotation.PostConstruct;
import java.time.Duration;

@RestController
Expand Down