Azure Key Vault volume

Learn about Radius persistent Azure Key Vault volumes

Radius supports mounting an Azure Key Vault as a persistent volume to the container using the Azure KeyVault CSI Driver.

Prerequisites

Resource format

resource volume 'Applications.Core/volumes@2023-10-01-preview' = {
  name: 'myvolume'
  properties: {
    application: app.id
    kind: 'azure.com.keyvault'
    resource: keyvault.id
    secrets: {
      mysecret: {
        name: 'secret1'      // required
        version: '1'         // optional, defaults to latest version
        alias: 'secretalias' // optional, defaults to secret name (mysecret)
        encoding: 'utf-8'    // optional, defaults to utf-8
      }
    }
    certificates: {
      mycertificate: {
        name: 'cert1'              // required
        version: '1'               // optional, defaults to latest version
        alias: 'certificatealias'  // optional, defaults to certificate name (mycertificate)
        encoding: 'base64'         // optional, defaults to utf-8, only available when value is privatekey
        certType: 'privatekey'     // required
        format: 'pem'              // optional, defaults to pfx
      }
    }
    keys: {
      mykey: {
        name: 'key1'       // required
        version: '1'       // optional, defaults to latest version
        alias: 'keyalias'  // optional, defaults to key name (mycertificate)
      }
    }
  }
}

Properties

The following properties are available on the Volume resource to which the container attaches:

KeyRequiredDescriptionExample
kindyThe kind of persistent volume. Should be ‘azure.com.keyvault’ for Azure Key Vault persistent volumes'azure.com.keyvault'
resourcenResource ID for the Azure KeyVault resource.'kv.id', '/subscriptions/<subscription>/resourceGroups/<rg/providers/Microsoft.KeyVault/vaults/<keyvaultname>'
secretsnMap specify secret object name and secret properties. See secret propertiesmysecret: {
name: ‘mysecret’{
encoding: ‘utf-8{
}
keysnMap specify key object name and key properties. See key propertiesmykey: {
name: ‘mykey’
}
certificatesnMap specify certificate object name and [certificate properties]. See certificate propertiesmycert: {
name: ‘mycert’
value: ‘certificate’
}

Secrets

KeyDescriptionRequiredExample
namesecret name in Azure Key Vaulttrue'mysecret'
versionspecific secret version. Default is latestfalse'1234'
encodingencoding format ‘utf-8’, ‘hex’, ‘base64’. Default is ‘utf-8’false'bas64'
aliasfile name created on the disk. Same as objectname if not specifiedfalse'my-secret'

Keys

KeyDescriptionRequiredExample
namekey name in Azure Key Vaulttrue'mykey'
versionspecific key version. Default is latestfalse'1234'
aliasfile name created on the disk. Same as objectname if not specifiedfalse'my-key'

Certificates

KeyDescriptionRequiredExample
namecertificate name in Azure Key Vaulttrue'mycert'
valuevalue to download from Azure Key Vault ‘privatekey’, ‘publickey’ or ‘certificate’true'certificate'
versionspecific certificate version. Default is latestfalse'1234'
encodingencoding format ‘utf-8’, ‘hex’, ‘base64’. Default is ‘utf-8’ and this field can be specificed only when value is ‘privatekey’false'bas64'
aliasfile name created on the disk. Same as objectname if not specifiedfalse'my-cert'
formatcertificate format ‘pfx’, ‘pem’. Default is ‘pfx’false'my-cert'