How do we Handle Secrets from Environment to Another Environment about apiops

[rishabhsaha]

Hi - the secret in the namedvalue pair is encrypted by APIM. So it can’t be published as is. That’s also why it was not part of the initial name value type we had designed. We are still thinking through if keyvault secrets could be supported since it’s a reference.

[rishabhsaha]

@sujithre - do you plan to publish the same secret value which exists in the lower environment in the higher environment? Would key vault be an option? We could even think about having secrets in config.yaml but since it’s checked we wouldn’t recommend doing that.

[sujithre]

Hi Rishabh,
Got your Point
Problem i faced is I have an EventHub Logger. So when i have extracted Logger looks like below
{
"name": "APIMEVentLogger",
"properties": {
"description": "adding a new logger",
"isBuffered": true,
"loggerType": "azureEventHub",
"credentials": {
"name": "apimevents",
"connectionString": "{{Logger-Credentials--CCC}}"
}
}
}

Logger-Credentials--CCC is generated like a secret. I was having trouble in Deploying it
As you said when i converted it into Keyvault i got no Problems at least in Deploying it.

i got a few questions

1. when i actually put into a key vault and refer it from a named value, when we extract it it looks like below

{
"name": "Secret",
"properties": {
"displayName": "Secret",
"keyVault": {
"secretIdentifier": "https://xxx.vault.azure.net/secrets/FunctionKey"
},
"secret": true,
"tags": []
}
}
Now when i Publish it to a different APIM instance it points to the same Keyvault Is there a way we could Parameterise KEyvault name and Secret Keys?

2. Can i Create (Publish) EventHub Loggers as well since it is extracting the info?

[rishabhsaha]

Thanks for the additional context and feedback. We are actively working on having the keyvault name-value parameterized. The EventHub logger we’ll add to the backlog.

[guythetechie]

Added support here.

Sample configuration value would be:

namedValues
  - name: mynamedvalue
    displayName: mynamedvalue
    keyVault:
      identityClientId: Set if Key Vault authentication happens through a user-assigned managed identity
      secretIdentifier: Url for key vault secret (can be versioned if needed).