Azure Container Apps
Secrets on a container app. A write replaces the whole set, so a concurrent portal edit is lost. A revision holds its old value until you restart or redeploy, and a referenced secret is never pruned.
Secrets on a container app. A write replaces the whole set, so a concurrent portal edit is lost. A revision holds its old value until you restart or redeploy, and a referenced secret is never pruned.
Connection
| What | This provider |
|---|---|
| Vendor | Microsoft Azure |
| Key | azure-container-apps-secrets |
| Availability | available. You can connect it today. |
| Credential we hold | azure-service-principal |
| Values read back | yes |
| Activation | on-next-deploy |
Directions
| Direction | What it does |
|---|---|
import | We read names and values out of the store into your environment. |
export | We write names and values from your environment into the store. |
Activation
on-next-deploy. A new value waits there and arrives with your next deploy.
Conflict policies
| Direction | Policies you can pick |
|---|---|
import | skip_existing, new_version, fail |
export | create_only, overwrite, overwrite_and_prune |
How syncs work says what each one does.
Connect
Paste a credential from the vendor. We seal it and never show it again.
| Field | Label | Kind | Required | What it is |
|---|---|---|---|---|
tenantId | Directory (tenant) ID | secret; we mask it here and seal it | yes | |
clientId | Application (client) ID | secret; we mask it here and seal it | yes | |
clientSecret | Client secret | secret; we mask it here and seal it | yes |
Connection fields
You set these when you connect. Every mapping on the connection shares them.
| Field | Label | Kind | Required | Advanced | What it is |
|---|---|---|---|---|---|
subscriptionId | Subscription ID | text | yes | no | The subscription the service principal has a role assignment on. |
resourceGroup | Resource group | text | yes | no | The group the target resource sits in. One connection covers one group. |
Mapping fields
You answer these once per environment you map.
| Field | Label | Kind | Required | Advanced | What it is |
|---|---|---|---|---|---|
containerAppName | Container app | text | yes | no | The container app whose secrets this environment maps onto. |
Required permissions
We probe for these when we verify the connection.
| Permission | Directions | Blocking | Without it |
|---|---|---|---|
Microsoft.App/containerApps/listSecrets/action | every direction | yes | Preview cannot read the app's secrets. |
Microsoft.App/containerApps/write | export | yes | Export cannot write anything. |
Microsoft.App/containerApps/read | every direction | no | Verify cannot confirm the credential reaches this resource group. |