Reading KeyVault from Devopos Pipeline - YAML

Question

Adding task in yaml to read KV.

I got this yaml code:

parameters:
  - name: DeployTo
    type: string
    default: SIT
    values:
      - SIT
pool:
    vmImage: vs2017-win2016
variables:
    environmentToDeploy: ${{ lower(parameters.DeployTo)}}
    subscription: np
  
stages:
- stage: SIT
  displayName: SIT - Infrastructure deploy 
  condition: eq('${{ parameters.DeployTo}}','SIT')

  jobs:
     - template: ymlTemplates\environment-deploy.yml  # Template reference
       parameters:
          DeployTo: '${{ parameters.DeployTo }}'
          environmentToDeploy: '${{ variables.environmentToDeploy }}'
          subscriptionId: 'xxxf7fc0-exx3-x000-9f55-04xxxxxx76f4'
          SqlPassword: $(sqlpassword)
          AdminPassword: $(adminpassword)

Currently values for sqlpassword and adminpassword are being passed as pipeline variables. I would like to read this from KeyVault. How can i put a task in this .yaml before jobs. :)

Answer 1

Use AzureKeyVault task. The secrets from KeyVault will become available as pipeline variables.

The pipeline would look like this:

  jobs:
     # assuming 'sqlpassword' and 'sqlpassword' secrets in keyvault
     - task: AzureKeyVault@1
       inputs:
         azureSubscription: 'my azure subscription'
         keyVaultName: 'my vault'
         secretsFilter: '*'

     - template: ymlTemplates\environment-deploy.yml  # Template reference
       parameters:
          DeployTo: '${{ parameters.DeployTo }}'
          environmentToDeploy: '${{ variables.environmentToDeploy }}'
          subscriptionId: 'xxxf7fc0-exx3-x000-9f55-04xxxxxx76f4'
          SqlPassword: $(sqlpassword)
          AdminPassword: $(adminpassword)