Skip to content

Update external secrets doc re: azure mfa #374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IanKWatts merged 1 commit into from
Oct 6, 2026
Merged

Update external secrets doc re: azure mfa #374

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 4 additions & 77 deletions src/docs/secrets-management/example_secretstore_azure_key_vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,99 +10,26 @@ To complete this setup, you need:

* Access to your Azure Key Vault
* Access to your OpenShift namespaces
* Docker or Podman, if you're using the Azure CLI

You can create the Service Principal using either the Azure CLI or the Azure Portal. This guide uses the CLI method. If you prefer the portal, see [Register a Microsoft Entra app and create a service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal).

## Official documentation

[External Secrets Operator - Azure Key Vault Provider](https://external-secrets.io/latest/provider/azure-key-vault/)

## Start the Azure CLI Container

We recommend running the Azure CLI in a Docker or Podman container. Installing the CLI directly on your machine requires many dependencies, which might conflict with other tools or take up unnecessary space if you only need it for this task.

Make sure you have a running Docker or Podman environment before starting.

Start the container:

```
podman run -it mcr.microsoft.com/azure-cli:cbl-mariner2.0
```

Once it's running and you have a command prompt, run `az` to see version and help information.

```
az
```

Log in to Azure by running `az login` in the container and following the instructions.

```
root [ / ]# az login
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code ... to authenticate.
```

Make a note of the subscription ID in the output of the login command.

## Create the Service Principal

To create the Service Principal, make sure you have the following information:
You can request a Service Principal from the Azure team (ADMS). See [Requesting a Microsoft Entra app registration](https://developer.gov.bc.ca/docs/default/component/public-cloud-techdocs/azure/design-build-deploy/app-registration/).

* Your Azure subscription ID
* The name of your Key Vault
* The resource group of your Key Vault
In your request, include a message stating that the Service Principal should be exempt from MFA so that it can be used by automated processes. Also include the key vault name and resource group, which are available via the portal. Permissions should include the Secret Permissions 'get' and 'list'.

You’ll use this information when you run the Azure CLI commands in the next steps:
```
export SUBSCRIPTION_ID="your-subscription-ID"
export KEY_VAULT_NAME="your-key-vault-name"
export RESOURCE_GROUP="your-key-vaults-resource-group"
export SP_NAME="name-of-service-principal-to-create"
```

Run the command to create the service principal:
```
az ad sp create-for-rbac --name "${SP_NAME}" --role "Key Vault Secrets User" --scopes /subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.KeyVault/vaults/${KEY_VAULT_NAME} --sdk-auth
```

Save a copy of the output from this command - you'll need `clientId`, `clientSecret`, and `tenantId`. Set the client credentials as environment variables if you'd like to copy the command below to create the Secret.
```
export CLIENT_ID=clientId_from_output
export CLIENT_SECRET=clientSecret_from_output
export TENANT_ID=tenantId_from_output
```
Once the Service Principal is created, you will need its Client ID, Client Secret, and Tenant ID.

## Create the OpenShift Secret

First, create a Secret in your OpenShift namespace to store your Azure Service Principal credentials. You can use the UI if you like, or use the following command:
Create a Secret in your OpenShift namespace to store your Azure Service Principal credentials. You can use the UI if you like, or use the following command:
```
oc create secret generic azure-key-vault-creds --from-literal=clientId=${CLIENT_ID} --from-literal=clientSecret=${CLIENT_SECRET} --from-literal=tenantId=${TENANT_ID}
```

## Assign permissions to the Service Principal

Using the Azure CLI, get a list of Service Principals:

```
az ad sp list --show-mine
```

If you see more than one, look for the one with the `displayName` that is equal to your new Service Principal. Find its `id` for that entry and assign it to an environment variable.
```
export OBJECT_ID="the-service-principals-id"
```

Or, use `jq` to extract it automatically:
```
export OBJECT_ID=`az ad sp list --show-mine | jq -r ".[] | select(.displayName == \"${SP_NAME}\") | .id"`
```

Now assign the right permissions to your Service Principal so it can access Secrets in Azure Key Vault:
```
az keyvault set-policy --name ${KEY_VAULT_NAME} --object-id ${OBJECT_ID} --secret-permissions get list
```

## Create a SecretStore
Next, create a YAML manifest for the `SecretStore`. Be sure to enter the correct value for the name of the Secret that you created above.
```
Expand Down
Loading