Share via

Service Fabric + Key Vault

Buchczyk, Kornelia 65 Reputation points
2025-04-25T13:19:03.3366667+00:00

Hi everyone,

I have a Service Fabric cluster (created using Azure PowerShell script). Using CI/CD in Azure Pipeline ( https://dori-uw-1.kuma-moon.com/en-us/azure/service-fabric/service-fabric-tutorial-deploy-app-with-cicd-vsts) I deploy an application to the cluster. For now - all secrets (db connection strings) and so on are located in Settings.xml file as parameter. I would like to use Key Vault secrets instead of hardcoded settings parameters in the .xml file. What is the proper way to configure it? I've tried to

  • enabled "Managed Identity Token Service" in the cluster  
    Untitled picture
  • Create User Managed identity (using Azure PowerShell: New-AzUserAssignedIdentity -ResourceGroupName $clusterRgName -Name "AdminUser") and assigned "Key Vault Secrets User" role in the Key Vault
  • Created System Managed Identity in VMSS and assigned "Key Vault Secrets User" role

 

Then I tried to deploy an app with Managed Identity: Deploy a Service Fabric app with system-assigned MI - Azure Service Fabric | Microsoft Learn
For this I retrieve error*: "##[error]Application managed identity PrincipalId cannot be null or empty. "*
 

How to properly configure it and use Key Vault Secrets instead of ussing hardcoded values in Settings.xml parameter ?

I would be very grateful for any hints.
Thanks in advance,
Kornelia

Azure Service Fabric
Azure Service Fabric
An Azure service that is used to develop microservices and orchestrate containers on Windows and Linux.
Answer accepted by question author
  1. Mounika Reddy Anumandla 7,135 Reputation points Moderator
    2025-04-28T06:30:28.12+00:00

    Hi Buchczyk, Kornelia

    As the document says, when configuring a Service Fabric application to use a managed identity, you must specify the PrincipalId of the identity during deployment. If this PrincipalId is omitted, the deployment process cannot associate the application with the appropriate identity, resulting in the error message you've encountered.

    This happens because Service Fabric expects you to pass the PrincipalId of the Managed Identity at deployment time, but you are not passing it, so the deployment fails. As per my undestanding, you must pass the Managed Identity PrincipalId to the deployment task.

    This Github repo also demonstrates the correct way to use Managed Identity in Service Fabric applications including the Key Vault integration. https://github.com/Azure-Samples/service-fabric-managed-identity

    Hope it helps!

    Let me know if you have any further queries!

    If the information is helpful, please click "Accept Answer" and "Upvote it."

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.