Switch deploy workflows to use Key Vault references for connection strings and JWT key

Author: workcontrolgit

.github/workflows/deploy-api.yml

@@ -62,20 +62,19 @@ jobs:
 
       - name: Configure App Service settings
         env:
-          API_CONN: ${{ secrets.API_DB_CONNECTION_STRING }}
           IDS_URL: ${{ secrets.IDENTITY_SERVER_URL }}
-          JWT_KEY: ${{ secrets.JWT_KEY }}
           ANGULAR_URL: ${{ secrets.ANGULAR_APP_URL }}
+          KV_URI: ${{ secrets.KEY_VAULT_URI }}
         run: |
           az webapp config appsettings set \
             --resource-group ${{ env.RESOURCE_GROUP }} \
             --name ${{ env.APP_SERVICE_NAME }} \
             --settings \
-              "ConnectionStrings__DefaultConnection=$API_CONN" \
+              "ConnectionStrings__DefaultConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--DefaultConnection)" \
+              "JWTSettings__Key=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/JWTSettings--Key)" \
               "Sts__ServerUrl=$IDS_URL" \
               "Sts__ValidIssuer=$IDS_URL" \
               "Sts__Audience=app.api.talentmanagement" \
-              "JWTSettings__Key=$JWT_KEY" \
               "JWTSettings__Issuer=CoreIdentity" \
               "JWTSettings__Audience=CoreIdentityUser" \
               "JWTSettings__DurationInMinutes=60" \

.github/workflows/deploy-identityserver.yml

@@ -72,18 +72,18 @@ jobs:
 
       - name: Configure STS App Service settings
         env:
-          IDS_CONN: ${{ secrets.IDS_DB_CONNECTION_STRING }}
           IDS_URL: ${{ secrets.IDENTITY_SERVER_URL }}
           ADMIN_URL: ${{ secrets.IDENTITY_ADMIN_URL }}
+          KV_URI: ${{ secrets.KEY_VAULT_URI }}
         run: |
           az webapp config appsettings set \
             --resource-group ${{ env.RESOURCE_GROUP }} \
             --name ${{ env.APP_SERVICE_NAME }} \
             --settings \
-              "ConnectionStrings__ConfigurationDbConnection=$IDS_CONN" \
-              "ConnectionStrings__PersistedGrantDbConnection=$IDS_CONN" \
-              "ConnectionStrings__IdentityDbConnection=$IDS_CONN" \
-              "ConnectionStrings__DataProtectionDbConnection=$IDS_CONN" \
+              "ConnectionStrings__ConfigurationDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__PersistedGrantDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__IdentityDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__DataProtectionDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
               "AdminConfiguration__IdentityServerBaseUrl=$IDS_URL" \
               "AdminConfiguration__IdentityAdminBaseUrl=$ADMIN_URL" \
               "CspTrustedDomains__0=www.gravatar.com" \
@@ -95,20 +95,20 @@ jobs:
 
       - name: Configure Admin App Service settings
         env:
-          IDS_CONN: ${{ secrets.IDS_DB_CONNECTION_STRING }}
           IDS_URL: ${{ secrets.IDENTITY_SERVER_URL }}
           ADMIN_URL: ${{ secrets.IDENTITY_ADMIN_URL }}
+          KV_URI: ${{ secrets.KEY_VAULT_URI }}
         run: |
           az webapp config appsettings set \
             --resource-group ${{ env.RESOURCE_GROUP }} \
             --name ${{ env.ADMIN_APP_SERVICE_NAME }} \
             --settings \
-              "ConnectionStrings__ConfigurationDbConnection=$IDS_CONN" \
-              "ConnectionStrings__PersistedGrantDbConnection=$IDS_CONN" \
-              "ConnectionStrings__IdentityDbConnection=$IDS_CONN" \
-              "ConnectionStrings__AdminLogDbConnection=$IDS_CONN" \
-              "ConnectionStrings__AdminAuditLogDbConnection=$IDS_CONN" \
-              "ConnectionStrings__DataProtectionDbConnection=$IDS_CONN" \
+              "ConnectionStrings__ConfigurationDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__PersistedGrantDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__IdentityDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__AdminLogDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__AdminAuditLogDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
+              "ConnectionStrings__DataProtectionDbConnection=@Microsoft.KeyVault(SecretUri=${KV_URI}secrets/ConnectionStrings--IdsDbConnection)" \
               "AdminConfiguration__IdentityServerBaseUrl=$IDS_URL" \
               "AdminConfiguration__IdentityAdminRedirectUri=$ADMIN_URL/signin-oidc" \
               "SeedConfiguration__ApplySeed=false" \