CKAN Extentsion for Azure Key Vault integration. This plugin provides the ability to store CKAN config option values in an Azure Key Vault.
Compatibility with core CKAN versions:
| CKAN version | Compatible? |
|---|---|
| 2.6 and earlier | Not tested |
| 2.7 | Not tested |
| 2.8 | Not tested |
| 2.9 | Yes |
| 2.10 | Yes |
| Python version | Compatible? |
|---|---|
| 2.9 and earlier | No |
| 3.0 and later | Yes |
To install ckanext-az-keyvault:
-
Activate your CKAN virtual environment, for example:
. /usr/lib/ckan/default/bin/activate -
Clone the source and install it on the virtualenv
git clone --branch main --single-branch https://github.com/open-data/ckanext-az-keyvault.gitcd ckanext-az-keyvaultpip install -e .pip install -r requirements.txt
-
Add
az_keyvaultto theckan.pluginssetting in your CKAN config file. Make sure to add it to the top so that the config values are pulled from Azure Key Vault for the other plugins to use. -
Restart CKAN
-
The Azure Key Vault Name (the
KEY_VAULT_NAMEenvironment variable).Required:
TrueDefault:
Noneckanext.az_keyvault.vault_name = <Azure Key Vault Name> -
Azure Key Vault period character.
Required:
FalseDefault:
#ckanext.az_keyvault.period_char = ^
To have a CKAN config options stored in the Key Vault, create the key value pair in the Azure Key Vault with the name of the CKAN config option the same, with the following caveat: periods are not allowed in Azure Key Vault key names. Thus, replace any periods in the CKAN config option name with # (controllable with ckanext.az_keyvault.period_char, see above).
For example ckan.datastore.write_url would be saved as ckan#datastore#write_url in Azure Key Vault.
In the CKAN config file, set the value to the stored key to AZURE_KEY_VAULTED, this plugin will then attempt to go fetch the stored value from the Azure Key Vault. Example:
ckan.datastore.write_url = AZURE_KEY_VAULTED
ckan.datastore.read_url = AZURE_KEY_VAULTED
ckanext.cloudstorage.driver_options = AZURE_KEY_VAULTED
ckanext.gcnotify.secret_key = AZURE_KEY_VAULTED
This plugin uses ManagedIdentityCredential (MSI) on a system level to authenticate with Azure.
See: https://pypi.org/project/azure-identity/ (section: Authenticate with a system-assigned managed identity)