[DEVOPS-513] Update Azure Function Environment Variables on Deploy

.github/workflows/azfunction-deploy.yaml

@@ -162,6 +162,107 @@ jobs:
  package: "${{ inputs.AZURE_FUNCTIONAPP_PACKAGE_PATH }}/output"
  publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE }}
 
+ - name: Enable identity for Azure Function
+ uses: azure/cli@v2
+ with:
+ inlineScript: |
+ set -eu
+ if [[ "${{ inputs.environment }}" == "production" ]]; then
+ az functionapp identity assign \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" | tee
+ else
+ az functionapp identity assign \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" \
+ --slot "${{ inputs.environment }}" | tee
+ fi
+
+ - name: Get Azure Function Managed Identity
+ id: identity
+ uses: azure/cli@v2
+ with:
+ inlineScript: |
+ set -eu
+ if [[ "${{ inputs.environment }}" == "production" ]]; then
+ IDENTITY=$(az functionapp identity show \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" | tee)
+ else
+ IDENTITY=$(az functionapp identity show \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" \
+ --slot "${{ inputs.environment }}" | tee)
+ fi
+ echo "functionAppIdentity=$(echo $IDENTITY | jq -r '.principalId')" >> $GITHUB_ENV
+
+ - name: Retrieve key vault name
+ uses: azure/cli@v2
+ with:
+ inlineScript: |
+ set -eu
+ ENVIRONMENT="${{ inputs.environment }}"
+ REPOSITORY_NAME="${{ github.event.repository.name }}"
+
+ echo -e "Searching for key vault with tags: \"repository-name=${REPOSITORY_NAME};environment=${ENVIRONMENT}\""
+ KEYVAULT_NAME=$(az keyvault list --query "[?tags.\"repository-name\" == '${REPOSITORY_NAME}' && tags.environment == '${ENVIRONMENT}'].name" --output tsv)
+
+ # Check if key vault was found
+ if [[ -z "$KEYVAULT_NAME" ]]; then
+ echo "Key Vault not found with tags: repository-name=${REPOSITORY_NAME};environment=${ENVIRONMENT}"
+ exit 1
+ fi
+
+ # Get key vault object
+ KEYVAULT_NAME=${KEYVAULT_NAME// /}
+ echo "keyVaultName=${KEYVAULT_NAME}" >> $GITHUB_ENV
+
+ - name: Assign Azure Function System Managed Identity to Key Vault
+ uses: azure/cli@v2
+ with:
+ inlineScript: |
+ set -eu
+ # Retrieve the Key Vault ID
+ keyVaultId=$(az keyvault show --name ${{ env.keyVaultName }} --query id --output tsv)
+
+ # Assign the Key Vault Secrets User role to the managed identity using object ID and principal type
+ az role assignment create --role "Key Vault Secrets User" --assignee-object-id ${{ env.functionAppIdentity }} --assignee-principal-type ServicePrincipal --scope $keyVaultId
+
+ - name: Retrieve environment variables
+ if: ${{ env.AZURE_CREDENTIALS_SET != 'false' }}
+ id: get-envs
+ uses: Andrews-McMeel-Universal/get-envs@v1
+ with:
+ azurecredentials: ${{ secrets.AZURE_CREDENTIALS }}
+ environment: ${{ inputs.environment }}
+ contentTypes: Env
+
+ - name: Add environment variables to function app
+ uses: azure/cli@v2
+ with:
+ inlineScript: |
+ set -eu
+ # Iterate over each environment variable
+
+ ENV_VARS=($(echo '${{ steps.get-envs.outputs.environmentVariables }}'))
+
+ for part in ${ENV_VARS[@]}; do
+ IFS='=' read -r key value <<< "$part"
+ VARIABLE_LC=$(echo "$key" | tr '[:upper:]' '[:lower:]' | tr "_" "-")
+ if [[ "${{ inputs.environment }}" == "production" ]]; then
+ az functionapp config appsettings set \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" \
+ --slot-settings "$key=@Microsoft.KeyVault(VaultName=${{ env.keyVaultName }};SecretName=${VARIABLE_LC})" | tee
+ else
+ az functionapp config appsettings set \
+ -g "${{ inputs.AZURE_FUNCTIONAPP_RESOURCEGROUP }}" \
+ -n "${{ inputs.AZURE_FUNCTIONAPP_NAME }}" \
+ --slot "${{ inputs.environment }}" \
+ --slot-settings "$key=@Microsoft.KeyVault(VaultName=${{ env.keyVaultName }};SecretName=${VARIABLE_LC})" | tee
+ fi
+ done
+
  - name: Remove GitHub Runner IP from Whitelist
  if: always()
  uses: azure/cli@v2