Skip to content

Recipe: Key Vault Reference in Java Apps on Azure Container Apps¶

Use Azure Key Vault with managed identity and Spring Boot to externalize secrets for Java workloads on Azure Container Apps.

flowchart TD
    APP[Spring Boot App] -.-> MI[Managed Identity]
    MI -.-> KV[Azure Key Vault]
    KV -.-> SEC[Container Apps Secret Reference]
    SEC -.-> APP
    style APP fill:#107c10,color:#fff

Prerequisites¶

Existing Container App ($APP_NAME) in resource group ($RG)
Existing Key Vault ($KEYVAULT_NAME) with secret db-password
Azure CLI with Container Apps extension

Configure identity and secret reference¶

az containerapp identity assign \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --system-assigned

export PRINCIPAL_ID=$(az containerapp show \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --query "identity.principalId" \
  --output tsv)

az role assignment create \
  --assignee-object-id "$PRINCIPAL_ID" \
  --assignee-principal-type ServicePrincipal \
  --role "Key Vault Secrets User" \
  --scope "$(az keyvault show --name "$KEYVAULT_NAME" --query id --output tsv)"

az containerapp secret set \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --secrets "db-password=keyvaultref:https://$KEYVAULT_NAME.vault.azure.net/secrets/db-password,identityref:system"

az containerapp update \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --set-env-vars "DB_PASSWORD=secretref:db-password"

Command	Why it is used
`az containerapp identity assign ...`	Assigns or inspects managed identity configuration for the Container App.

Spring Boot Key Vault integration¶

Add dependency:

<dependency>
  <groupId>com.azure.spring</groupId>
  <artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
</dependency>

application.properties:

spring.cloud.azure.keyvault.secret.endpoint=https://${KEYVAULT_NAME}.vault.azure.net/

SDK access example:

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;

SecretClient client = new SecretClientBuilder()
    .vaultUrl("https://" + System.getenv("KEYVAULT_NAME") + ".vault.azure.net/")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

String password = client.getSecret("db-password").getValue();

Advanced Topics¶

Separate vaults by environment and data sensitivity tier.
Use revision-based rollout after secret rotations for controlled changes.
Prefer managed identity plus RBAC over app-managed credentials.

See Also¶

Sources¶