Skip to content

Conversation

@aaronburtle
Copy link
Contributor

Why make this change?

Adds AKV variable replacement and expands our design for doing variable replacements to be more extensible when new variable replacement logic is added.

Closes #2708
Closes #2748
Related to #2863

What is this change?

Change the way that variable replacement is handled to instead of simply using a bool to indicate that we want env variable replacement, we add a class which holds all of the replacement settings. This will hold whether or not we will do replacement for each kind of variable that we will handle replacement for during deserialization. We also include the replacement failure mode, and put the logic for handling the replacements into a strategy dictionary which pairs the replacement variable type with the strategy for doing that replacement.

Because Azure Key Vault secret replacement requires having the retry and connection settings in order to do the AKV replacement, we must do a first pass where we only do non-AKV replacement and get the required settings so that if AKV replacement is used we have the required settings to do that replacement.

We also have to keep in mind that the legacy of the Configuration Controller will ignore all variable replacement, so we construct the replacement settings for this code path to not use any variable replacement at all.

How was this tested?

We have updated the logic for the tests to use the new system, however manual testing using an actual AKV is still required.

Sample Request(s)

  • Example REST and/or GraphQL request to demonstrate modifications
  • Example of CLI usage to demonstrate modifications

Copy link
Contributor

@RubenCerna2079 RubenCerna2079 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still need to get rid of envVar in some places and resolve missing logic inside of an if statement.

Copy link
Contributor

@souvikghosh04 souvikghosh04 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added comments

Copy link
Collaborator

@Aniruddh25 Aniruddh25 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes look good to me. This is a good refactor. However, unit testing still remains and so does the test in AKV environment.

@aaronburtle aaronburtle marked this pull request as ready for review October 31, 2025 16:48
@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

@aaronburtle
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

@aaronburtle
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

aaronburtle and others added 3 commits November 18, 2025 13:07
Added validation for Azure Key Vault secret names to ensure they meet specified criteria.
@aaronburtle
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

@aaronburtle
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

Copy link
Collaborator

@Aniruddh25 Aniruddh25 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Copy link
Contributor

@souvikghosh04 souvikghosh04 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@aaronburtle
Copy link
Contributor Author

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 6 pipeline(s).

Copy link
Contributor

@RubenCerna2079 RubenCerna2079 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@aaronburtle aaronburtle merged commit 3554118 into main Nov 20, 2025
11 checks passed
@aaronburtle aaronburtle deleted the dev/aaronburtle/AKVReplacement branch November 20, 2025 00:06
anushakolan pushed a commit that referenced this pull request Nov 21, 2025
… settings class and add AKV replacement logic. (#2882)

## Why make this change?

Adds AKV variable replacement and expands our design for doing variable
replacements to be more extensible when new variable replacement logic
is added.

Closes #2708
Closes #2748
Related to #2863


## What is this change?

Change the way that variable replacement is handled to instead of simply
using a `bool` to indicate that we want env variable replacement, we add
a class which holds all of the replacement settings. This will hold
whether or not we will do replacement for each kind of variable that we
will handle replacement for during deserialization. We also include the
replacement failure mode, and put the logic for handling the
replacements into a strategy dictionary which pairs the replacement
variable type with the strategy for doing that replacement.

Because Azure Key Vault secret replacement requires having the retry and
connection settings in order to do the AKV replacement, we must do a
first pass where we only do non-AKV replacement and get the required
settings so that if AKV replacement is used we have the required
settings to do that replacement.

We also have to keep in mind that the legacy of the `Configuration
Controller` will ignore all variable replacement, so we construct the
replacement settings for this code path to not use any variable
replacement at all.


## How was this tested?

We have updated the logic for the tests to use the new system, however
manual testing using an actual AKV is still required.

## Sample Request(s)

- Example REST and/or GraphQL request to demonstrate modifications
- Example of CLI usage to demonstrate modifications

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Aniruddh Munde <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support .akv files just like .env files. [Enhancement]: Support AKV

5 participants