XKeyVault¶
Experimental
This API is experimental and may change without notice.
An Azure Key Vault with RBAC enabled. The Crossplane provider receives Key Vault Secrets Officer and an optional XAppService identity receives Key Vault Secrets User.
API¶
| Property | Value |
|---|---|
| Group | azure.platform.example.org |
| Kind | XKeyVault |
| Plural | xkeyvaults |
| Scope | Namespaced |
| Versions | v1alpha1 (referenceable) |
| Source | compositions/apis/azure/keyvault/schema.yaml |
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
appServiceRef |
object |
no | — | Optional XAppService selected by Kubernetes metadata.name whose system-assigned identity receives the Key Vault Secrets User role. |
appServiceRef.name |
string |
yes | — | Kubernetes metadata.name of the XAppService. |
location |
string |
no | swedencentral |
Azure region for the Key Vault. |
name immutable |
string |
yes | — | Logical name of the Key Vault. |
resourceGroupRef |
object |
yes | — | Resource group hosting the Key Vault. |
resourceGroupRef.name |
string |
yes | — | Logical name of the XResourceGroup. |
vaultName immutable |
string |
yes | — | Globally unique Azure Key Vault name. Constraints: minLength: 3, maxLength: 24, pattern: ^[a-zA-Z][a-zA-Z0-9-]*[a-zA-Z0-9]$. |
Fields marked immutable are fixed once the resource is created; changing one is rejected by the API server. An immutable object pins the fields nested under it too. To change one, delete the resource and create it again.
Example¶
Set appServiceRef when App Service must resolve Key Vault references. The value is the referenced XAppService's Kubernetes metadata.name, which may differ from spec.name. The XAppService must enable its system-assigned identity.
kind: XKeyVault
metadata:
name: appadvisor
spec:
name: appadvisor
vaultName: kv-appadvisor-lsdev
resourceGroupRef:
name: app-hosting-advisor
appServiceRef:
name: appadvisor
location: swedencentral
---
apiVersion: azure.platform.example.org/v1alpha1
kind: XKeyVaultSecret
metadata:
Taken from teams/app-hosting-advisor/infrastructure.yaml,
which is applied to the cluster by Flux, so it cannot drift from a working
manifest.
Status¶
Populated by Crossplane once the underlying Azure resources exist. Every
composite in this repository exposes the provisioned Azure resource ID as
status.id.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
id |
string |
no | — | Azure resource ID of the Key Vault. |
tenantId |
string |
no | — | Microsoft Entra tenant ID of the Key Vault. |
vaultName |
string |
no | — | Azure Key Vault name. |
vaultUri |
string |
no | — | Versionless Azure Key Vault URI. |
Common problems¶
The App Service reports unresolved Key Vault references.
Cause. The XAppService identity is not enabled, or its Key Vault Secrets User role assignment has not reconciled.
Fix. Set systemAssignedIdentity to true and inspect the XKeyVault appServiceKeyVaultRoleAssignment composed resource.