Azure Key Vault component

The azure-key-vault component manages secrets, keys and certificates in Azure Key Vault and signs, verifies, encrypts and decrypts with vault keys; the {{azure:...}} placeholder puts secrets into routes.

Scheme: azure-key-vault: · Crate: cameleer-cloud · Cargo feature: cloud · Consumer: no · Producer: yes · Apache Camel: Azure Key Vault

When to use it

• Keep passwords and API keys out of route files: reference them as {{azure:name}}.
• Store credentials generated by a route as secrets.
• Sign or encrypt data with keys that never leave the vault (HSM-backed keys included).
• Restart routes automatically when a secret gets a new version (secret refresh).

URI format

azure-key-vault://vaultName[?options]

Example

Store a partner token as a secret, authenticated with a service principal:

- route:
    id: store-partner-token
    from:
      uri: "timer:store-token?repeatCount=1"
      steps:
        - setHeader:
            name: CamelAzureKeyVaultSecretName
            constant: partner-api-token
        - setBody:
            constant: "{{env:PARTNER_TOKEN:}}"
        - to: "azure-key-vault://{{env:AZURE_KEY_VAULT_NAME:my-vault}}?operation=createSecret&tenantId={{env:AZURE_TENANT_ID:}}&clientId={{env:AZURE_CLIENT_ID:}}&clientSecret=RAW({{env:AZURE_CLIENT_SECRET:}})"
        - log: "stored ${body} (version ${header.CamelAzureKeyVaultSecretVersion})"

Use a secret with the {{azure:...}} placeholder; it is resolved when the route starts:

- route:
    id: call-partner-api
    from:
      uri: "timer:partner-sync?repeatCount=1"
      steps:
        - setHeader:
            name: Authorization
            constant: "Bearer {{azure:partner-api-token}}"
        - to: "log:partner-api"

The placeholder is configured with properties, for example in application.properties:

camel.vault.azure.vaultName=my-vault
camel.vault.azure.tenantId=00000000-0000-0000-0000-000000000000
camel.vault.azure.clientId=11111111-1111-1111-1111-111111111111
camel.vault.azure.clientSecret=change-me
# or, for managed identities and AZURE_* environment variables:
# camel.vault.azure.azureIdentityEnabled=true

Rust DSL

ctx.add_routes(|b| {
    b.from("timer:store-token?repeatCount=1")
        .set_header("CamelAzureKeyVaultSecretName", constant("partner-api-token"))
        .set_body(constant("{{env:PARTNER_TOKEN:}}"))
        .to("azure-key-vault://{{env:AZURE_KEY_VAULT_NAME:my-vault}}?operation=createSecret&tenantId={{env:AZURE_TENANT_ID:}}&clientId={{env:AZURE_CLIENT_ID:}}&clientSecret=RAW({{env:AZURE_CLIENT_SECRET:}})")
        .log("stored ${body} (version ${header.CamelAzureKeyVaultSecretVersion})");
})?;

Options

The {{azure:...}} placeholder

Properties: camel.vault.azure.vaultName, clientId, clientSecret, tenantId, azureIdentityEnabled, and (Cameleer) authorityHost, uriEndpointOverride. Secret refresh: camel.vault.azure.refreshEnabled=true with camel.vault.azure.eventhubConnectionString (an Event Hub that Event Grid feeds with the vault's events), optional blob checkpoint properties (blobAccountName, blobContainerName, blobAccessKey), refreshPeriod (ms, default 30000) and secrets (names or * patterns).

Message headers

Run it with Docker

docker run --rm -e AZURE_KEY_VAULT_NAME -e AZURE_TENANT_ID -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e PARTNER_TOKEN \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/vault.camel.yaml

Common questions

How do I use a managed identity?

Use credentialType=AZURE_IDENTITY on the endpoint (and camel.vault.azure.azureIdentityEnabled=true for the placeholder); the token comes from the managed identity endpoint, workload identity or the AZURE_* variables.

How do I sign data without exporting the key?

Create a key (createKey), then call signData with the data as the body: it is hashed locally and the digest is signed by the vault; the body becomes the signature bytes.

Related

• AWS Secrets Manager ({{aws:...}}), AWS KMS
• Cloud credentials
• Apache Camel Azure Key Vault

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.