CODEWITHSUNDEEP
azureazure-devopsazure-resource-manager
Jasper
Jasper

Reputation: 547

How to pass azure-pipelines.yml variables to ARM templates with AzureResourceManagerTemplateDeployment

I'm starting to work with Azure and tried these steps:

Upvotes: 7

Views: 7817

Answers (2)

Daniel Mann
Daniel Mann

Reputation: 59035

There are some limited scenarios where using variable groups in conjunction with YAML pipelines make sense, namely if you have a secret that isn't in keyvault that you need to store securely.

However, there are much better ways to manage this scenario. Remember, pipeline variables (including variable groups) should be for pipeline values, not application configuration. Tightly coupling your continuous delivery platform to your application's configuration just makes it harder to replicate your deployment process locally or migrate to a different continuous delivery provider in the future.

That said, here are a few recommended alternatives:

  1. Add a AzureKeyVault step to your pipeline in order to retrieve secrets from the keyvault.

  2. Link your ARM template directly to the keyvault; ARM templates have native support for keyvault parameters:

    "adminPassword": { "reference": { "keyVault": { "id": "/subscriptions//resourceGroups//providers/Microsoft.KeyVault/vaults/" }, "secretName": "ExamplePassword" } }

  3. Write your application to retrieve secrets directly from the keyvault at runtime.

Upvotes: -4

Levi Lu-MSFT
Levi Lu-MSFT

Reputation: 30343

You can have a try using overrideParameters parameter for the task to override your ARM template's parameters with the variables defined in your variable groups. Check here for more parameters about this task.

- task: AzureResourceManagerTemplateDeployment@3
      inputs:
        azureResourceManagerConnection: <connection>

        overrideParameters: -storageAcctName azurerg -Username $(vmusername) -azureKeyVaultName $(fabrikamFibre)

For accessing AzureKeyVault, you can also use Azure Key Vault task to get your secrets in your build pipeline, or integrate KeyVault to your ARM template as @Daniel Mann pointed out. Check here for Microsoft official tutorial.

Upvotes: 15

Related Questions