Skip to content

Commit 6d2a62c

Browse files
katarzyna-koltun-mxkatarzyna-koltun-mx
authored
PMP Key Vault updates (#12079)
* PMP Key Vault updates * sme review * Update pmp-key-vault-integration.md * Update ServiceAccount name in Key Vault integration docs * Update pmp-key-vault-integration.md * Improve formatting in prerequisites for Key Vault integration Updated formatting for clarity in prerequisites section. * Fix typo in Managed Identity alert message * Update prerequisites for AKS cluster type clarification Clarified that other cluster types are supported for different purposes but do not support Azure Key Vault integration. * Update pmp-key-vault-integration.md * Update pmp-key-vault-integration.md * Update secret management instructions for Key Vault Clarified options for secret store mode selection, detailing automatic and manual modes for Azure Key Vault integration. * Update pmp-key-vault-integration.md
1 parent 749bbdd commit 6d2a62c

4 files changed

Lines changed: 181 additions & 175 deletions

File tree

‎content/en/docs/private-platform/secret-management/pmp-configure-azure-key-vault.md‎

Lines changed: 40 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -58,99 +58,103 @@ When creating the JSON structure for your secret, you must use a flat key-value
5858

5959
* Bitbucket
6060

61-
* **VCS.BitbucketProjectAdminPAT** - Personal access token for the Bitbucket project admin
62-
* **VCS.BitbucketAdminPassword** - Password for the Bitbucket admin user
61+
* **VCS-BitbucketProjectAdminPAT** - Personal access token for the Bitbucket project admin
62+
* **VCS-BitbucketAdminPassword** - Password for the Bitbucket admin user
6363

6464
* GitLab
6565

66-
* **VCS.GitlabGroupOwnerPAT** - Personal access token for the GitLab group owner
67-
* **VCS.GitlabAdminPAT** - Personal access token for the GitLab admin
66+
* **VCS-GitlabGroupOwnerPAT** - Personal access token for the GitLab group owner
67+
* **VCS-GitlabAdminPAT** - Personal access token for the GitLab admin
6868

6969
* GitHub
7070

71-
* **VCS.GithubOrgOwnerPAT** - Personal access token for the GitHub organization owner
72-
* **VCS.GithubAdminPAT** - Personal access token for the GitHub admin
73-
* **VCS.GithubEnterpriseClientSecret** - Client secret for the GitHub Enterprise app
71+
* **VCS-GithubOrgOwnerPAT** - Personal access token for the GitHub organization owner
72+
* **VCS-GithubAdminPAT** - Personal access token for the GitHub admin
73+
* **VCS-GithubEnterpriseClientSecret** - Client secret for the GitHub Enterprise app
7474

7575
* Azure
7676

77-
* **VCS.AzureDevOpsOrgAdminPAT** - Personal access token for the Azure DevOps organization owner
78-
* **VCS.AzureAuthSecret** - Currently unused
77+
* **VCS-AzureDevOpsOrgAdminPAT** - Personal access token for the Azure DevOps organization owner
78+
* **VCS-AzureAuthSecret** - Currently unused
7979

8080
* Kubernetes Build Settings
8181

8282
* BuildPackage
8383

8484
* fileServerBasic
8585
86-
* **BuildPackage.FileBasicAuthPassword** - Password for the file server
86+
* **BuildPackage-FileBasicAuthPassword** - Password for the file server
8787

8888
* AwsAKSK
8989

90-
* **BuildPackage.AwsSecretAccessKey** - AWS secret access key for the file server
90+
* **BuildPackage-AwsSecretAccessKey** - AWS secret access key for the file server
9191

9292
* RuntimeBaseImage
9393

9494
* privateRegistry
9595

96-
* **RuntimeBaseImage.PrivateRegistryPassword** - Base image for the runtime
96+
* **RuntimeBaseImage-PrivateRegistryPassword** - Base image for the runtime
9797

9898
* S3compatibleAccessKey
9999

100-
* **RuntimeBaseImage.S3CompatibleAccessKey** - S3-compatible access key for the base image
100+
* **RuntimeBaseImage-S3CompatibleAccessKey** - S3-compatible access key for the base image
101101

102102
* MDAStorage
103103

104104
* fileServerBasic
105105

106-
* **MDAStorage.FileBasicAuthPassword** - Password for the file server
106+
* **MDAStorage-FileBasicAuthPassword** - Password for the file server
107107

108108
* awsAKSK
109109

110-
* **MDAStorage.AwsSecretAccessKey** - AWS secret access key for the MDA storage
110+
* **MDAStorage-AwsSecretAccessKey** - AWS secret access key for the MDA storage
111111

112112
* OCIRegistry
113113

114114
* privateRegistry
115115

116-
* **OCIRegistry.PrivateRegistryPassword** - Password for the private registry
116+
* **OCIRegistry-PrivateRegistryPassword** - Password for the private registry
117117

118118
* S3compatibleAccessKey
119119

120-
* **OCIRegistry.S3CompatibleAccessKey** - S3 compatible access key for the OCI registry
120+
* **OCIRegistry-S3CompatibleAccessKey** - S3 compatible access key for the OCI registry
121121

122122
* Build Cluster Settings
123123

124-
* **BuildCluster.KubernetesConfigureToken** - Token for the Kubernetes cluster configuration
125-
* **CIAdmin.JenkinsConfigureAPIToken** - Token for the Jenkins configuration
126-
* **CIAdmin.JenkinsTriggerAuthToken** - Token for the Jenkins trigger configuration
127-
* **CIAdmin.AzureOrgAdminPAT** - Personal access token for the Azure DevOps configuration
128-
* **CIAdmin.AzureBlobStorageToken** - SAS token for the Azure Blob Storage
129-
* **CIAdmin.AzureAwsS3SK** - Name of the Azure DevOps organization
124+
* **BuildCluster-KubernetesConfigureToken** - Token for the Kubernetes cluster configuration
125+
* **CIAdmin-JenkinsConfigureAPIToken** - Token for the Jenkins configuration
126+
* **CIAdmin-JenkinsTriggerAuthToken** - Token for the Jenkins trigger configuration
127+
* **CIAdmin-AzureOrgAdminPAT** - Personal access token for the Azure DevOps configuration
128+
* **CIAdmin-AzureBlobStorageToken** - SAS token for the Azure Blob Storage
129+
* **CIAdmin-AzureAwsS3SK** - Name of the Azure DevOps organization
130130

131131
* **Cluster Manager**
132132

133-
* **ClusterManager.OCIRegistryAWSSK** - OCI Registry: AWS secret access key for the OCI registry
134-
* **serverClusterManager.OCIBasicAuthPassword** - OCI Registry: Password for the OCI registry
135-
* **serverClusterManager.MDAAWSSK** - MDA Storage: AWS secret access key for the MDA file
136-
* **serverClusterManager.MDAFileBasicAuthPassword** - MDA Storage: Password for the MDA file
137-
* **serverClusterManager.KubernetesApiToken** - Kubernetes API: Token for accessing the Kubernetes API
138-
* **serverClusterManager.GrafanaAPIKey** - Grafana: API key for accessing the Grafana server
133+
* **ClusterManager-OCIRegistryAWSSK** - OCI Registry: AWS secret access key for the OCI registry
134+
* **serverClusterManager-OCIBasicAuthPassword** - OCI Registry: Password for the OCI registry
135+
* **serverClusterManager-MDAAWSSK** - MDA Storage: AWS secret access key for the MDA file
136+
* **serverClusterManager-MDAFileBasicAuthPassword** - MDA Storage: Password for the MDA file
137+
* **serverClusterManager-KubernetesApiToken** - Kubernetes API: Token for accessing the Kubernetes API
138+
* **serverClusterManager-GrafanaAPIKey** - Grafana: API key for accessing the Grafana server
139139

140140
* Marketplace
141141

142-
* **Marketplace.ImportCDNPassword** - Personal access token for the Marketplace admin
142+
* **Marketplace-ImportCDNPassword** - Personal access token for the Marketplace admin
143143

144144
* Email
145145

146-
* **Email.SMTPPassword** - Password for the SMTP server
146+
* **Email-SMTPPassword** - Password for the SMTP server
147147

148148
* Maia
149149

150-
* **Maia.AmazonBedrockApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom AWS Bedrock LLM
151-
* **Maia.AzureAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
152-
* **Maia.AnthropicApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
153-
* **Maia.OpenAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
150+
* **Maia-AmazonBedrockApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom AWS Bedrock LLM
151+
* **Maia-AzureAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
152+
* **Maia-AnthropicApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
153+
* **Maia-OpenAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
154+
155+
{{% alert color="info" %}}
156+
Azure Key Vault secret names cannot contain underscores (`_`), periods (`.`), spaces, and special symbols. Private Mendix Platform converts any periods in a constant or runtime setting name to hyphens for the Key Vault entry (`objectName`). The `objectAlias` - that is, the file name actually mounted into the pod and read by the Mendix Runtime - always keeps the periods, exactly matching the format in the official documentation, for example, `mx-const-MyFirstModule.WelcomePageTitle`. Private Mendix Platform performs this conversion consistently both when it writes the value to Key Vault and when it builds the SecretProviderClass entry, so the two always stay in sync. However, other special characters are not automatically converted, so constant names that contain them cannot be stored in Azure Key Vault. Because of that, we recommend that you do not create secret names with underscores (`_`), periods (`.`), spaces, and special symbols.
157+
{{% /alert %}}
154158

155159
### Configuring Azure AD Workload Identity
156160

@@ -211,7 +215,7 @@ Click **Add**.
211215
#### Modifying the Operation Configuration
212216

213217
{{% alert color="info" %}}
214-
The steps in this section are not necessary if .your Managed Identity was already created by Mendix Operator.
218+
The steps in this section are not necessary if your Managed Identity was already created by Mendix Operator.
215219
{{% /alert %}}
216220

217221
For more information about advanced configuration settings, see [Advanced Operator Configuration](/developerportal/deploy/private-cloud-cluster/#advanced-operator-configuration).

0 commit comments

Comments
 (0)