How to enable User Assigned Managed Identity to existing Azure Service Fabric Cluster & Connect to Azure Key Vault to read secrets?

Question

Have an existing Azure service fabric instance, which host multiple applications apart from our application. At present application hosted on Azure service fabric is connecting to Keyvault using Azure AD application using certificates.

Would like to upgrade by connecting to Azure Key Vault using Managed Identity. But enabling System Assigned Managed Identity is not the option as the target Azure service fabric instance is not dedicated to our application alone but it is a shared environment which hosts multiple application of other projects too.

So other option, is to enable User Assigned Managed Identity.

But, how to enable User Assigned Managed Identity on existing Azure service fabric instance via Power-shell or other easiest way?

How application on existing Azure service fabric instance authenticate itself to Azure Key Vault instance programmatically (c#) to access its secrets?

Answer 1

how to enable User Assigned Managed Identity on existing Azure service fabric instance via Power-shell or other easiest way?

If you want to use user-assigned MSI in service fabric, there are two ways:

1. Azure Service Fabric clusters are hosted on Virtual Machine Scale Sets, so you can leverage the MSI of VMSS, reference here , via powershell or portal .

2. Enable the Managed Identity Token Service on the cluster firstly, then deploy Service Fabric application with a User-Assigned Managed Identity , they can just be available via ARM template currently.

How application on existing Azure service fabric instance authenticate itself to Azure Key Vault instance programmatically (c#) to access its secrets?

To access azure keyvault secret, you could use ManagedIdentityCredential of Azure.Identity to auth, make sure you have already added the MSI to the access policy of the keyvault .

var client = new SecretClient(vaultUri: new Uri(keyVaultUrl), credential: new ManagedIdentityCredential());
KeyVaultSecret secret = client.SetSecret("secret-name", "secret-value");
secret = client.GetSecret("secret-name");

See samples here and here .