{"id":22403334,"url":"https://github.com/springload/akv-entrypoint","last_synced_at":"2025-07-14T09:37:38.370Z","repository":{"id":159569460,"uuid":"498954914","full_name":"springload/akv-entrypoint","owner":"springload","description":null,"archived":false,"fork":false,"pushed_at":"2023-08-18T22:48:40.000Z","size":41,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-01T06:25:26.129Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/springload.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-02T01:45:05.000Z","updated_at":"2023-05-01T00:43:09.000Z","dependencies_parsed_at":"2024-06-20T22:04:42.023Z","dependency_job_id":null,"html_url":"https://github.com/springload/akv-entrypoint","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/springload%2Fakv-entrypoint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/springload%2Fakv-entrypoint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/springload%2Fakv-entrypoint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/springload%2Fakv-entrypoint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/springload","download_url":"https://codeload.github.com/springload/akv-entrypoint/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245760930,"owners_count":20667893,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-05T09:16:49.388Z","updated_at":"2025-03-27T00:45:06.813Z","avatar_url":"https://github.com/springload.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Why would I use it?\n\nThere are multiple products on Azure Cloud that allow running containers. The problem is they're all configured differently.\n\n1. Web Apps for Containers have full support for referencing secrets from Azure Key Vault.\n2. Azure Container Apps will have full support for referencing secrets at some point (this functionality is in preview as of Aug 2023)\n   but at the moment it's only ACA-native secrets.\n3. Azure Container Instances don't support KeyVault at all and have their own secrets.\n\nFor your workload you might have to use several products, i.e. Web Apps only support applications with web endpoints.\nFor workloads without a web endpoint you might want to use ACA. One-off jobs in ACA are in preview (as of Aug 2023) so\nyou might have to use ACI.\n\nThis middleware solves that problem. It runs as an entrypoint to your container application. It fetches all (or specified) secrets from the\nspecified Azure KeyVault and presents them as environment variables to the program.\n\nAuthentication takes whatever `azidentity.NewDefaultAzureCredential` can, see the Go SDK docs, but generally it should just work.\n\nNote: for ACA when using UAI, you have to specify `AZURE_CLIENT_ID` as per https://github.com/microsoft/azure-container-apps/issues/325/\n\nIt works the following way:\n\n1. If `AKV_ENTRYPOINT_SECRET_NAMES` env var is not set list all secrets from the KeyVault\n1. Fetche the secrets in the Azure listing order.\n1. If a secret has `application/json` content-type, then treat it as structure and merge it with the resulting structure.\n1. Otherwise, take the secret name as the env var name and take the value.\n1. Merging overrides the previous values.\n\nWhen `AKV_ENTRYPOINT_SECRET_NAMES` is set `akv-entrypoint` only fetches the specified secret names, which are comma-separated.\nThis way it can't know in advance secrets content-type so it must be hinted if it should treat it as a json, for example:\n\n```bash\n\nAKV_ENTRYPOINT_SECRET_NAMES=json:secret1,secret2\n\n```\nIt'll treat secret1 as JSON and secret2 as plain text.\n\nNote: KeyVault secret names can't have underscores so it's normal to have dashes in them as separators.\nAt the same time environment variables in Linux can't have dashes. So the middleware will replace all dashes\nwith underscores for all secret names, i.e. if you have a KeyVault secret `mega-secret` the environment name you'll\nget will become `mega_secret` to conform to the spec.\n\n\n## Examples\n\n### CLI usage for testing\n\n```bash\n$akv-entrypoint -d print -n your-keyvault # to see env vars printed in JSON\n$akv-entrypoint -d run -n your-keyvault -- your-app # to run the app\n```\n\n### Docker entrypoint\n\n```\n# somewhere above\nFROM ghcr.io/springload/akv-entrypoint:latest as akv-entrypoint\n...\n# later on in your app stage\nCOPY --from=akv-entrypoint /usr/bin/akv-entrypoint /usr/bin/akv-entrypoint\n...\n# at the end of your production stage\nENTRYPOINT [\"/usr/bin/akv-entrypoint\", \"run\", \"-n\", \"your-keyvault\",  \"--\"]\nCMD [\"/usr/local/bin/gunicorn\", \"--config\", \"/app/docker/gunicorn.py\", \"app.wsgi\" ]\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspringload%2Fakv-entrypoint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspringload%2Fakv-entrypoint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspringload%2Fakv-entrypoint/lists"}