Skip to content

[Do not merge] Allow expressions in getSecret function #19204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
levimatheri wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[Do not merge] Allow expressions in getSecret function #19204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c5db5d6
add progress
levimatheri Mar 14, 2026
fd7bc87
Support expressions e.g. externalInput in getSecret function call
levimatheri Mar 14, 2026
71dc1dd
variablize kv resource ns and name
levimatheri Mar 16, 2026
39201fc
Update baselines
levimatheri Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 42 additions & 27 deletions src/Bicep.Core.IntegrationTests/Emit/ParamsFileWriterTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,48 @@ param myParam string
""")]
[DataRow(@"
using 'main.bicep'
param myParam = getSecret(
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion'))", @"
{
""$schema"": ""https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#"",
""contentVersion"": ""1.0.0.0"",
""parameters"": {
""myParam"": {
""reference"": {
""keyVault"": {
""id"": ""[resourceId(externalInputs('subId_0'), externalInputs('rgName_1'), 'Microsoft.KeyVault', 'vaults', externalInputs('kvName_2'))]""
},
""secretName"": ""[externalInputs('secretName_3')]"",
""secretVersion"": ""[externalInputs('secretVersion_4')]""
}
}
},
""externalInputDefinitions"": {
""kvName_2"": {
""kind"": ""kvName""
},
""rgName_1"": {
""kind"": ""rgName""
},
""secretName_3"": {
""kind"": ""secretName""
},
""secretVersion_4"": {
""kind"": ""secretVersion""
},
""subId_0"": {
""kind"": ""subId""
}
}
}", @"
param myParam string
")]
[DataRow(@"
using 'main.bicep'
param myParam = 1", @"
{
""$schema"": ""https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#"",
Expand Down Expand Up @@ -256,33 +298,6 @@ param myParam object
}
}", @"
param myParam object
")]

[DataRow(@"
using 'main.bicep'

//multiple parameters
param myStr = 'foo'
param myBool = false
param myInt = 1", @"
{
""$schema"": ""https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#"",
""contentVersion"": ""1.0.0.0"",
""parameters"": {
""myStr"": {
""value"": ""foo""
},
""myBool"": {
""value"": false
},
""myInt"": {
""value"": 1
}
}
}", @"
param myStr string
param myBool bool
param myInt int
")]
public void Params_file_with_no_errors_should_compile_correctly(string paramsText, string paramsJsonText, string bicepText)
{
Expand Down
99 changes: 99 additions & 0 deletions src/Bicep.Core.IntegrationTests/ParameterFileTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,105 @@ invalid file
});
}

[TestMethod]
public void GetSecret_without_expressions_in_parameters_generates_expected_keyVault_reference()
{
var result = CompilationHelper.CompileParams(
("parameters.bicepparam", """
using none
param foo = getSecret('subId', 'rgName', 'kvName', 'secretName', 'secretVersion')
param bar = getSecret('subId', 'rgName', 'kvName', 'secretName')
"""));
result.Should().NotHaveAnyDiagnostics();
var parameters = TemplateHelper.ConvertAndAssertParameters(result.Parameters);
parameters["foo"].Reference.Should().NotBeNull();
parameters["foo"].Reference.Should().DeepEqual(new JObject
{
["keyVault"] = new JObject
{
["id"] = "/subscriptions/subId/resourceGroups/rgName/providers/Microsoft.KeyVault/vaults/kvName",
},
["secretName"] = "secretName",
["secretVersion"] = "secretVersion",
});

parameters["bar"].Reference.Should().NotBeNull();
parameters["bar"].Reference.Should().DeepEqual(new JObject
{
["keyVault"] = new JObject
{
["id"] = "/subscriptions/subId/resourceGroups/rgName/providers/Microsoft.KeyVault/vaults/kvName",
},
["secretName"] = "secretName"
});
}

[TestMethod]
public void GetSecret_expressions_in_parameters_generates_expected_keyVault_reference()
{
var result = CompilationHelper.CompileParams(
("parameters.bicepparam", """
using none

param foo = getSecret(
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion'))

var subId = externalInput('subId')
var rgName = externalInput('rgName')
var kvName = externalInput('kvName')
var secretName = externalInput('secretName')

param bar = getSecret(subId, rgName, kvName, secretName)
"""));
result.Should().NotHaveAnyDiagnostics();
var parameters = TemplateHelper.ConvertAndAssertParameters(result.Parameters);
parameters["foo"].Reference.Should().NotBeNull();
parameters["foo"].Reference.Should().DeepEqual(new JObject
{
["keyVault"] = new JObject
{
["id"] = "[resourceId(externalInputs('subId_0'), externalInputs('rgName_1'), 'Microsoft.KeyVault', 'vaults', externalInputs('kvName_2'))]"
},
["secretName"] = "[externalInputs('secretName_3')]",
["secretVersion"] = "[externalInputs('secretVersion_4')]"
});
parameters["bar"].Reference.Should().NotBeNull();
parameters["bar"].Reference.Should().DeepEqual(new JObject
{
["keyVault"] = new JObject
{
["id"] = "[resourceId(externalInputs('subId_0'), externalInputs('rgName_1'), 'Microsoft.KeyVault', 'vaults', externalInputs('kvName_2'))]"
},
["secretName"] = "[externalInputs('secretName_3')]"
});

var externalInputs = TemplateHelper.ConvertAndAssertExternalInputs(result.Parameters);
externalInputs["subId_0"].Should().DeepEqual(new JObject
{
["kind"] = "subId",
});
externalInputs["rgName_1"].Should().DeepEqual(new JObject
{
["kind"] = "rgName",
});
externalInputs["kvName_2"].Should().DeepEqual(new JObject
{
["kind"] = "kvName",
});
externalInputs["secretName_3"].Should().DeepEqual(new JObject
{
["kind"] = "secretName",
});
externalInputs["secretVersion_4"].Should().DeepEqual(new JObject
{
["kind"] = "secretVersion",
});
}

[TestMethod]
public void ExternalInput_without_config_compiles_successfully()
{
Expand Down
4 changes: 2 additions & 2 deletions src/Bicep.Core.IntegrationTests/TemplateHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ namespace Bicep.Core.IntegrationTests
{
public class TemplateHelper
{
public record ParameterProperties(JToken? Value, JToken? Expression);
public record ParameterProperties(JToken? Value, JToken? Expression, JToken? Reference);
public static ImmutableDictionary<string, ParameterProperties> ConvertAndAssertParameters(JToken? parametersJToken)
{
if (parametersJToken is null)
Expand All @@ -33,7 +33,7 @@ public static ImmutableDictionary<string, ParameterProperties> ConvertAndAssertP
var parametersObject = parametersJToken["parameters"] as JObject;
parametersObject.Should().NotBeNull();

return parametersObject!.Properties().ToImmutableDictionary(x => x.Name, x => new ParameterProperties(x.Value["value"], x.Value["expression"]));
return parametersObject!.Properties().ToImmutableDictionary(x => x.Name, x => new ParameterProperties(x.Value["value"], x.Value["expression"], x.Value["reference"]));
}

public static JObject ConvertAndAssertExternalInputs(JToken? parametersJToken)
Expand Down
4 changes: 4 additions & 0 deletions src/Bicep.Core.Samples/Files/baselines_bicepparam/Expressions/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,7 @@ param myInt int
param myBool bool
param myArray array
param myObject object
@secure()
param kvSecret string
@secure()
param kvSecretExpression string
7 changes: 7 additions & 0 deletions src/Bicep.Core.Samples/Files/baselines_bicepparam/Expressions/parameters.bicepparam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,3 +76,10 @@ THis
multiline
string!
'''
param kvSecret = az.getSecret('subId', 'rgName', 'kvName', 'secretName', 'secretVersion')
param kvSecretExpression = az.getSecret(
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion'))
7 changes: 7 additions & 0 deletions ...cep.Core.Samples/Files/baselines_bicepparam/Expressions/parameters.diagnostics.bicepparam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,4 +76,11 @@ THis
multiline
string!
'''
param kvSecret = az.getSecret('subId', 'rgName', 'kvName', 'secretName', 'secretVersion')
param kvSecretExpression = az.getSecret(
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion'))

8 changes: 8 additions & 0 deletions ...Bicep.Core.Samples/Files/baselines_bicepparam/Expressions/parameters.formatted.bicepparam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,3 +76,11 @@ THis
multiline
string!
'''
param kvSecret = az.getSecret('subId', 'rgName', 'kvName', 'secretName', 'secretVersion')
param kvSecretExpression = az.getSecret(
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion')
)
35 changes: 35 additions & 0 deletions src/Bicep.Core.Samples/Files/baselines_bicepparam/Expressions/parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,41 @@
},
"myString": {
"value": "THis\n is\n a\n multiline\n string!\n"
},
"kvSecret": {
"reference": {
"keyVault": {
"id": "/subscriptions/subId/resourceGroups/rgName/providers/Microsoft.KeyVault/vaults/kvName"
},
"secretName": "secretName",
"secretVersion": "secretVersion"
}
},
"kvSecretExpression": {
"reference": {
"keyVault": {
"id": "[resourceId(externalInputs('subId_0'), externalInputs('rgName_1'), 'Microsoft.KeyVault', 'vaults', externalInputs('kvName_2'))]"
},
"secretName": "[externalInputs('secretName_3')]",
"secretVersion": "[externalInputs('secretVersion_4')]"
}
}
},
"externalInputDefinitions": {
"kvName_2": {
"kind": "kvName"
},
"rgName_1": {
"kind": "rgName"
},
"secretName_3": {
"kind": "secretName"
},
"secretVersion_4": {
"kind": "secretVersion"
},
"subId_0": {
"kind": "subId"
}
}
}
9 changes: 9 additions & 0 deletions src/Bicep.Core.Samples/Files/baselines_bicepparam/Expressions/parameters.symbols.bicepparam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,4 +89,13 @@ THis
multiline
string!
'''
param kvSecret = az.getSecret('subId', 'rgName', 'kvName', 'secretName', 'secretVersion')
//@[06:14) ParameterAssignment kvSecret. Type: string. Declaration start char: 0, length: 89
param kvSecretExpression = az.getSecret(
//@[06:24) ParameterAssignment kvSecretExpression. Type: string. Declaration start char: 0, length: 189
externalInput('subId'),
externalInput('rgName'),
externalInput('kvName'),
externalInput('secretName'),
externalInput('secretVersion'))

Loading
Loading