Enabling Azure Key Vault

This documentation exists for customers who must use Azure Key Vault for organizational reasons. For everyone else, we strongly recommend using the Union.ai secrets manager to manage secrets rather than Azure Key Vault.

The Union.ai-managed userflyterole identity must be granted permission to access Azure Key Vault secrets.

Managing Azure Key Vault secrets

Refer to Azure official documentation for details on creating and managing secrets.

Providing permissions to Azure Key Vault

Union.ai data plane tasks employ Azure Workload Identity Federation to access Azure resources using an Azure user-assigned identity. Access to Azure Key Vault containers requires updating permissions to permit this Union.ai-managed user-assigned identity.

Create a role assignment assigning the Key Vault Secrets User role to the userflyterole user-assigned identity. Make sure it is scoped to the Azure Key Vault Secret.

Union.ai managed user-assigned identities

Refer to Azure portal’s user assigned managed identitites if assistance is required identifying the userflyterole user-assigned identity within the Union.ai data plane resource group.

Accessing the secret within Union.ai

Declare a flyte.Secret in the secrets of your TaskEnvironment, where
- group is the HTTP URI of the secret, in the format https://<KEY_VAULT_NAME>.vault.azure.net/secrets/<SECRET_NAME>
- key is the secret name, <SECRET_NAME>
- mount is "/etc/flyte/secrets". Azure Key Vault secrets can only be delivered as files.
Inside the task, read the secret from the file /etc/flyte/secrets/<SECRET_NAME>, with the name in lower case.

The latest version of the secret is always retrieved: flyte.Secret has no parameter for a secret version.

Here is an example:

        
    
import pathlib

import flyte

VAULT_NAME = "examplevault"
SECRET_NAME = "example-secret"
SECRET_GROUP = f"https://{VAULT_NAME}.vault.azure.net/secrets/{SECRET_NAME}"

env = flyte.TaskEnvironment(
    name="azure-key-vault",
    secrets=[flyte.Secret(key=SECRET_NAME, group=SECRET_GROUP, mount="/etc/flyte/secrets")],
)

@env.task
def task_with_secret():
    secret_val = (pathlib.Path("/etc/flyte/secrets") / SECRET_NAME.lower()).read_text()
    # do something with the secret. For example, communication with an external API.
    ...