2

I'm trying to deploy an Azure Service Fabric Cluster in an automated process from Octopus Deploy. Part of the process of deploying a new Cluster involves creating an Azure Key Vault and populating it with certificates and other secrets specific to that cluster.

I have an ARM template to deploy the Key Vault and another to deploy the Cluster. I've found that secrets (in general) can be deployed to Azure Key Vault as part of the ARM template, but haven't found any information on how to do that when the secret is a certificate. Ideally, I would like to create and deploy Cluster-specific certificates to the Key Vault as part of that deployment, so they can be accessed during Cluster deployment, but just being able to deploy the certificates when provisioning the Key Vault would be more than good enough.

2 Answers 2

1

The certs used in SF deployment are actually base64 encoded certs stuffed in a secret in KeyVault. So you would actually create a secret resource, not a cert resource if you want to consume them for SF deployment.

So it sounds like you have everything you need - just put that base64 encoded blob into the secret value when you setup the keyvault.

That help?

1
  • Thanks @bmoore-msft, that gets me a step further I think. Will give that a go.
    – alastairs
    Oct 26, 2016 at 13:25
0

The deployment of certificates from the Key store onto a VM need to be stored as a specific json document, I haven't done it from within an ARM template but in Powershell I use the following:

 $cert = Get-Content $certLocation -Encoding Byte;
    $cert = [System.Convert]::ToBase64String($cert);

    $json = @"
    {
        "data" : "$cert",
        "dataType": "pfx",
        "password": "$password"
    } 
"@

    $package = [System.Text.Encoding]::UTF8.GetBytes($json);
    $package = [System.Convert]::ToBase64String($package);
    $secret = ConvertTo-SecureString -String $package -AsPlainText -Force;

In theory if you could take this and then inject the $secret value into your ARM template you should be able to achieve what you are looking to do.

Keep in mind that the $password at this point is plan text and not as a secure string so Azure Compute can use it to install the certificates.

Then in your cluster ARM template you can reference the certificates and key vault in the VMSS OS Profile:

 "osProfile": {
            "adminUsername": "[parameters('adminUsername')]",
            "adminPassword": "[parameters('adminPassword')]",
            "computernamePrefix": "[parameters('vmNodeType0Name')]",
            "secrets": [
                            {
                                "sourceVault": {
                                    "id": "[parameters('sourceVault')]"
                                },
                                "vaultCertificates": [
                                    {
                                        "certificateStore": "My",
                                        "certificateUrl": "[parameters('clusterCertificateUrl')]"
                                    },
                                    {
                                        "certificateStore": "My",
                                        "certificateUrl": "[parameters('adminCertificateUrl')]"
                                    }
                                ]
                            }
                        ]
          }

And then within the same ARM template under the properties of the Service Fabric Resource reference the specific certificates you want to use.

"certificate": {
    "thumbprint": "[parameters('clusterCertificateThumbPrint')]",
    "x509StoreName": "My"
},
"clientCertificateCommonNames": [],
"clientCertificateThumbprints": [{
    "CertificateThumbprint": "[parameters('adminCertificateThumbPrint')]",
    "IsAdmin": true
}],

If it helps here is a link to my attempt on github

1
  • Thanks @jimpaine, this looks useful. Will feed back more when I've had a chance to try it out again.
    – alastairs
    Oct 26, 2016 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.