Skip to content

feat(azdext): Add KeyVaultResolver for extension Key Vault secret resolution #7043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jongio wants to merge 10 commits into
base: main
Choose a base branch
from
+1,439 −1
Open

feat(azdext): Add KeyVaultResolver for extension Key Vault secret resolution #7043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
db976c7
Test aks
jongio May 3, 2024
4fa1bc7
feat(azdext): Add KeyVaultResolver for extension Key Vault secret res…
jongio Mar 8, 2026
692a0a6
fix: remove duplicate stubCredential (already in token_provider_test.go)
jongio Mar 9, 2026
fecb2ec
fix: remove stale files from KV resolver branch
jongio Mar 9, 2026
4715eda
fix: suppress gosec G101 false positives in test fixtures
jongio Mar 9, 2026
31d6077
Fix security and code quality audit findings
jongio Mar 11, 2026
a9b132c
Remove stray coverage artifact
jongio Mar 11, 2026
b682e24
fix: resolve cspell and gosec CI failures
jongio Mar 11, 2026
b00c336
fix: apply go fix modernization (strings.Cut)
jongio Mar 11, 2026
5265a79
fix: address Copilot review feedback on KeyVaultResolver
jongio Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cli/azd/.vscode/cspell.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,8 @@ words:
- yarnpkg
- azconfig
- hostnames
- managedhsm
- microsoftazure
- seekable
- seekability
languageSettings:
Expand Down
17 changes: 16 additions & 1 deletion cli/azd/cmd/extensions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import (
"github.com/azure/azure-dev/cli/azd/pkg/exec"
"github.com/azure/azure-dev/cli/azd/pkg/extensions"
"github.com/azure/azure-dev/cli/azd/pkg/input"
kv "github.com/azure/azure-dev/cli/azd/pkg/keyvault"
"github.com/azure/azure-dev/cli/azd/pkg/lazy"
"github.com/azure/azure-dev/cli/azd/pkg/output/ux"
pkgux "github.com/azure/azure-dev/cli/azd/pkg/ux"
Expand Down Expand Up @@ -119,6 +120,7 @@ type extensionAction struct {
extensionManager *extensions.Manager
azdServer *grpcserver.Server
globalOptions *internal.GlobalCommandOptions
kvService kv.KeyVaultService
cmd *cobra.Command
args []string
}
Expand All @@ -132,6 +134,7 @@ func newExtensionAction(
cmd *cobra.Command,
azdServer *grpcserver.Server,
globalOptions *internal.GlobalCommandOptions,
kvService kv.KeyVaultService,
args []string,
) actions.Action {
return &extensionAction{
Expand All @@ -141,6 +144,7 @@ func newExtensionAction(
extensionManager: extensionManager,
azdServer: azdServer,
globalOptions: globalOptions,
kvService: kvService,
cmd: cmd,
args: args,
}
Expand Down Expand Up @@ -216,7 +220,18 @@ func (a *extensionAction) Run(ctx context.Context) (*actions.ActionResult, error

env, err := a.lazyEnv.GetValue()
if err == nil && env != nil {
allEnv = append(allEnv, env.Environ()...)
// Resolve Key Vault secret references only in azd-managed environment
// variables (akvs:// and @Microsoft.KeyVault formats). System env vars
// from os.Environ() are NOT processed — only the azd environment's
// variables may contain KV references.
azdEnvVars := env.Environ()
subId := env.Getenv("AZURE_SUBSCRIPTION_ID")
azdEnvVars, kvErr := kv.ResolveSecretEnvironment(ctx, a.kvService, azdEnvVars, subId)
if kvErr != nil {
log.Printf("warning: %v", kvErr)
}

allEnv = append(allEnv, azdEnvVars...)
}

serverInfo, err := a.azdServer.Start()
Expand Down
Loading
Loading