Azure App Service JSON Transform using KeyVault

Question

I am looking at deploying a .Net Core WebApi service to an Azure App Service and as part of the deployment I am keen to update the connection string in the appsettings.json with the CosmosDb connection string. I have a Azure KeyVault which has the connection string stored in there as a secret.

Using the YAML build pipeline for CI/CD I have the following (snippet) from my pipeline

          - task: AzureKeyVault@1
            inputs:
              azureSubscription: '<service-principal>'
              KeyVaultName: '<keyvault-name>'
              SecretsFilter: '*'
              RunAsPreJob: true
          
          - task: AzureRmWebAppDeployment@4
            inputs:
              ConnectionType: 'AzureRM'
              azureSubscription: '<service-principal>'
              appType: 'webApp'
              WebAppName: '<ci-resource-group>'
              VirtualApplication: '/'
              packageForLinux: '$(System.DefaultWorkingDirectory)/**/*.zip'
              JSONFiles: '**/appsettings.json'

These two tasks are in a stage which starts with downloading the published artifact from a previous stage.

So the Azure App Service Deploy task can do JSON transformation but I need to define a variable in the format ConnectionStrings:CosmosDb with the value from the secret stored in the keyvault and that I am not certain of how to do!

Firstly, is this the correct way? I have seen articles about using a reference to the secret in the keyvault, is that the correct way?
The keyvault secrets are available to the pipeline using $(secret), how can I create a variable for the AzureRmWebAppDeployment@4 task as above?

Everything I have found so far points to the Classic release pipelines, and using variable groups but this needs to be part of the YAML pipeline.

Krzysztof Madej Krzysztof Madej · Accepted Answer · 2020-08-28T09:47:13

Following the docs

To substitute values in nested levels of the file, concatenate the names with a period (.) in hierarchical order.

But your secrets cannot have dots in name so you must do a small rewrite between those two steps:

- powershell: |
     echo "##vso[task.setvariable variable=ConnectionStrings.CosmosDb;]$(ConnectionStrings-CosmosDb)"

where your secret is ConnectionStrings-CosmosDb

Azure App Service JSON Transform using KeyVault

1 Answers