Reading Azure container instance secret volumes from asp.netcore 2.2 web app

user_3581466 0
Viewed 609

I have read this documentation from Microsoft which describes how secret volumes can be added to a container instance:

https://docs.microsoft.com/bs-latn-ba/azure///container-instances/container-instances-volume-secret

I would now like to read these secure values from my asp.net core application. How can i do that? I can't find any documentation for this anywhere.

I would ideally like to carry out this configuration in my Startup class:

something here:

    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseStartup<Startup>()
            .UseSerilog()
            .UseSetting(WebHostDefaults.ApplicationKey, typeof(Program).GetTypeInfo().Assembly.FullName); // beware of this
          // shouldn't be removed otherwise site will start outputting 404.
          // see: https://github.com/aspnet/Hosting/issues/903#issuecomment-269103645
    }

Finally, I would like to be able to run the code locally so that i can check if it's working, before deploying the container to azure. is there a way I can mock/fake these secrets on my local installation (visual studio 2017, solution has docker support enabled, docker is running locally on my machine) do give me confidence that everything is working?

I've edited this question to make it clear that this is about secret volumes

azure-container-instances asp.net-core azure
1 Answers

Environment Variables

The original question was about environment variables, so this part is about using env vars.

The articles describe how to write those secrets to environment variables. To use them in your app, you'll have to read the environment variables. That is perfectly supported by asp.net core's configuration:

Given you have the following config (from https://docs.microsoft.com/en-us/azure/container-instances/container-instances-environment-variables#secure-values):

apiVersion: 2018-10-01
location: eastus
name: securetest
properties:
  containers:
  - name: mycontainer
    properties:
      environmentVariables:
        - name: 'NOTSECRET'
          value: 'my-exposed-value'
        - name: 'SECRET'
          secureValue: 'my-secret-value'

And a default setup as described here in the docs: https://docs.microsoft.com/en-us/azure/container-instances/container-instances-environment-variables#secure-values

The 2.x sample app takes advantage of the static convenience method CreateDefaultBuilder to build the host, which includes a call to AddEnvironmentVariables.

You can read your secret like so

var secret = config.GetValue<string>("SECRET", '');

As described here: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-2.2#getvalue

Secret Volumes

Secret volumes will contain one file per secret value.

Given the example from https://docs.microsoft.com/bs-latn-ba/azure///container-instances/container-instances-volume-secret#mount-secret-volume---yaml

  volumes:
  - name: secretvolume1
    secret:
      mysecret1: TXkgZmlyc3Qgc2VjcmV0IEZPTwo=
      mysecret2: TXkgc2Vjb25kIHNlY3JldCBCQVIK

You'll have a directory with the files "mysecret1" and "mysecret2".

You can add those values using the Key-per-file Configuration Provider

config.AddKeyPerFile(directoryPath: path, optional: true);

as described here: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-2.2#key-per-file-configuration-provider

After you've added your "configuration sources" you can access the values like so

 var secret = config.GetValue<string>("mysecret1", '');
user_20855020
Related