Azure Key Vault 参考 Java 代码/Yaml 管道

Question

I need help figuring out how to properly setup Key Vault Secrets in my pipeline.

I am building a Java Web App using maven and deploying it on app service linux web container.

My entire pipeline is run on ADO Yaml File with my first task being the Azure Key Vault Task to pull secrets, followed by Maven build task and artifact publish task.

Overall the web container deploys successfully but what I need to do now is to secure my secrets in Key Vault and remove it from the hard code in my web app. That is where I am confused on how to make it all work together.

In my Azure Key Vault Task in Yaml file,I have the following code:

steps:
   -task: AzureKeyVault@2
    inputs:
      azureSubscription: 'my_subscription'
      KeyVaultName: 'my_KV'
      SecretsFilter: '*'
      RunAsPreJob: false
      script: Write-Host $env:MY_MAPPED_ENV_VAR
    env:
      MY_MAPPED_ENV_VAR:$(my_secret)

Followed by Maven Build Task and Artifact Publish tasks

In Azure Portal, I already created a secret(my_secret) containing the value of my connection string that was in my java code.

In my Java code,

I have a file called Provider.java that contains the following code:

package com.***.***.***;

public interface Provider {
    String DRIVER="com.microsoft.sqlserver.jdbc.SQLServerDriver";
    String Connection_URL="jdbc:sqlserver://11.2.4.11:8433;databaseName=TPNTFDB;user=tpntf_potsfinder;password=Potsfinder2!";

}

No I am not even sure I have mapped my env var properly for my secrets.

In addition I am unsure how I can remove my hardcode connection url from my java code and replace with with a key vault reference or env var that will allow my code to resolve my secrets from Key vault.

In other words, after I store my connection url as a secrets in Key vault, and pull it using a Key Vault task in Yaml File, how can I remove my hard coded connection url and replace it with Key Vault Secrets?

Answer 1

Use the below Key vault task in the pipeline to fetch the secrets in your key vault:

- task: AzureKeyVault@2
    displayName: 'Configure Key Vault'
    inputs:
      azureSubscription: 'my_subscription'
      KeyVaultName: 'my_KV'
      SecretsFilter: '*'
      RunAsPreJob: false

Now in your maven build task, define an environment variable as below:

env:
    MySecret: $(key-vault-secret-name)

In your java code, you can use the key vault secrets as below:

String Connection_URL = System.getenv("MySecret")