To integrate Azure Key Vault for secret management during the GitLab CI/CD process, follow these steps:
------
1. Prerequisites
Azure Key Vault Created
Azure CLI installed
Service Principal or Managed Identity with Key Vault access
Secrets stored in Azure Key Vault
------
2. Grant Access to Key Vault
Grant your GitLab Service Principal access to Key Vault secrets:
az keyvault set-policy --name <KEYVAULT_NAME> \
--spn "$AZURE_APP_ID" \
--secret-permissions get list
This allows the Service Principal to read secrets from Key Vault.
------
3. Store Secrets in Key Vault
Store sensitive values in Azure Key Vault:
az keyvault secret set --vault-name <KEYVAULT_NAME> --name "MY_SECRET" --value "my-sensitive-value"
-------
4. Modify .gitlab-ci.yml to Fetch Secrets from Key Vault
Update your GitLab CI/CD pipeline to retrieve secrets securely from Azure Key Vault.
stages:
- deploy
variables:
AZURE_RESOURCE_GROUP: "my-resource-group"
FUNCTION_APP_NAME: "$AZURE_FUNCTIONAPP_NAME"
KEYVAULT_NAME: "<Your-KeyVault-Name>"
deploy_to_azure:
image: mcr.microsoft.com/azure-cli
stage: deploy
script:
- echo "Logging into Azure..."
- az login --service-principal -u "$AZURE_APP_ID" -p "$AZURE_PASSWORD" --tenant "$AZURE_TENANT_ID"
- az account set --subscription "$AZURE_SUBSCRIPTION_ID"
- echo "Fetching secrets from Key Vault..."
- MY_SECRET=$(az keyvault secret show --name "MY_SECRET" --vault-name "$KEYVAULT_NAME" --query "value" -o tsv)
- echo "Setting environment variables for deployment..."
- echo "MY_SECRET=$MY_SECRET" >> .env # If using environment variables
- echo "Deploying Function App..."
- func azure functionapp publish $FUNCTION_APP_NAME
only:
- main
--------
5. Secure Secrets in the Function App
Instead of exposing secrets in GitLab, you can store them in Azure App Configuration dynamically:
az functionapp config appsettings set --name $FUNCTION_APP_NAME --resource-group $AZURE_RESOURCE_GROUP \
--settings "MY_SECRET=@Microsoft.KeyVault(SecretUri=https://$KEYVAULT_NAME.vault.azure.net/secrets/MY_SECRET/)"
This allows Azure Functions to fetch secrets securely at runtime.
-------
6. Verify the Secret in the Function App
After deployment, verify if the secret is correctly injected:
az functionapp config appsettings list --name $FUNCTION_APP_NAME --resource-group $AZURE_RESOURCE_GROUP
