Backstage (https://backstage.io/) Application Deployment on AKS: Unable to expose Azure key vault secrets as environment variables

Question

Hi Team, I have a backstage application running on k8 cluster (AKS) and have config which mounts azure secrets at location /mnt/secrets which is working as intended able to verify the secret has been mounted properly. Now the goal is exposing these as env variable so that backstage app able to read and utilize them dynamically.

Having issues with achieving the above goal providing my config for SecretProviderClass and part of my deployment.yaml

SecretProviderClass.yml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: secretProviderClass
metadata:
  name: azure-kv-name
spec:
  provider: azure
  parameters:
    usePodIdentity: "true"
    clientID: <redacted>
    keyvaultName: <redacted>
    objects:  |
      array:
        - |
          objectName: AZURE-CLIENT-ID
          objectType: string
          objectAlias: AZURE_CLIENT_ID
        - |
          objectName: AZURE-CLIENT-SECRET
          objectType: string
          objectAlias: AZURE_CLIENT_SECRET
        - |
          objectName: EXAMPLESECRET
          objectType: secret
          objectAlias: EXAMPLESECRET
        - |
          objectName: POSTGRES-HOST
          objectType: secret
          objectAlias: POSTGRES_HOST
        - |
          objectName: POSTGRES-PORT
          objectType: secret
          objectAlias: POSTGRES_PORT
        - |
          objectName: POSTGRES-USER
          objectType: secret
          objectAlias: POSTGRES_USER
        - |
          objectName: POSTGRES-PASSWORD
          objectType: secret
          objectAlias: POSTGRES_PASSWORD
    tenantId: <redacted>

deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: backstage-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backstage
  template:
    metadata:
      labels:
        app: backstage
    spec:
      imagePullSecrets:
        - name: <redacted>
      containers:
        - name: backstage
          image: <redacted>
          env:
            - name: AZURE_TENANT_ID
              valueFrom:
                secretKeyRef:
                  name: azure-kv-name
                  key: AZURE_TENANT_ID
            - name: AZURE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: azure-kv-name
                  key: AZURE_CLIENT_ID
            - name: AZURE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: AZURE_CLIENT_SECRET
                  name: azure-kv-name
          imagePullPolicy: IfNotPresent
          volumeMounts:
             - name: azure-secrets
               mountPath: "/mnt/secrets"
               readOnly: true
          ports:
            - name: http
              containerPort: 7007
      volumes:
         - name: azure-secrets
           csi:
             driver: secrets-store.csi.k8s.io
             readOnly: true
             volumeAttributes:
               secretProviderClass: "azure-kv-name"

Answer 1

Hello Rajesh Jaladi,

Welcome to microsoft Q&A, Thankyou for posting your query here.

Your SecretProviderClass configuration looks generally correct, mapping Azure Key Vault secrets to file paths.

To use them as environment variables,you need to enable the syncing of secrets to Kubernetes secrets.

SecretProviderClass.yml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: secretProviderClass
metadata:
  name: azure-kv-name
spec:
  provider: azure
  parameters:
    usePodIdentity: "true"
    clientID: <redacted>
    keyvaultName: <redacted>
    objects:  |
      array:
        - |
          objectName: AZURE-CLIENT-ID
          objectType: string
          objectAlias: AZURE_CLIENT_ID
        - |
          objectName: AZURE-CLIENT-SECRET
          objectType: string
          objectAlias: AZURE_CLIENT_SECRET
        - |
          objectName: EXAMPLESECRET
          objectType: secret
          objectAlias: EXAMPLESECRET
        - |
          objectName: POSTGRES-HOST
          objectType: secret
          objectAlias: POSTGRES_HOST
        - |
          objectName: POSTGRES-PORT
          objectType: secret
          objectAlias: POSTGRES_PORT
        - |
          objectName: POSTGRES-USER
          objectType: secret
          objectAlias: POSTGRES_USER
        - |
          objectName: POSTGRES-PASSWORD
          objectType: secret
          objectAlias: POSTGRES_PASSWORD
    tenantId: <redacted>
secretObjects:
    - secretName: azure-secrets
    type: Opaque
    data:
    - key: AZURE_CLIENT_ID
      objectName: AZURE_CLIENT_ID
    - key: AZURE_CLIENT_SECRET
      objectName: AZURE_CLIENT_SECRET
    - key: EXAMPLESECRET
      objectName: EXAMPLESECRET
    - key: POSTGRES_HOST
      objectName: POSTGRES_HOST
    - key: POSTGRES_PORT
      objectName: POSTGRES_PORT
    - key: POSTGRES_USER
      objectName: POSTGRES_USER
    - key: POSTGRES_PASSWORD
      objectName: POSTGRES_PASSWORD

In your deployment YAML, the environment variable references should be adjusted to reference the Kubernetes secret created by the CSI driver

deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: backstage-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backstage
  template:
    metadata:
      labels:
        app: backstage
    spec:
      imagePullSecrets:
        - name: <redacted>
      containers:
        - name: backstage
          image: <redacted>
          env:
		  - name: AZURE_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: azure-secrets
                key: AZURE_CLIENT_ID
          - name: AZURE_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
               name: azure-secrets
               key: AZURE_CLIENT_SECRET
          - name: EXAMPLESECRET
            valueFrom:
              secretKeyRef:
               name: azure-secrets
               key: EXAMPLESECRET

Hope this helps you.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!