Altien teaches Mike to keep its secrets in Azure's vault

A new configuration layer lets Mike pull its sensitive settings from Microsoft's managed secrets store instead of leaving them in plain config.

infrastructuresecurity

Maintained by

Allen Morgan · verified on MikeWatch

Altien added a small but consequential piece of plumbing: Mike now looks for its settings in the deployment's environment first, and if it doesn't find them there, fetches them from Azure Key Vault - Microsoft's managed store for passwords, keys, and connection strings. Values are cached for a few minutes so the system isn't hammering the vault on every request.

The move pairs with an operator-facing install screen. During setup, whoever is deploying Mike can enter the deployment's settings once, and they're written straight into the vault to be read back securely from then on. The environment-first lookup also keeps local development simple - you can override anything without touching the vault at all.

So what Worth a look for anyone weighing whether Mike can be deployed inside a regulated Azure environment without secrets sitting in plain sight.

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from Altien/mikeOssAzure, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`7d5e48d6`	feat(config): Key Vault-backed config reader with env override + TTL	Allen Morgan	2026-05-08	↗ GitHub
commit body Adds lib/config.ts with getConfig/setConfig/flushConfigCache. Lookup order: env override → in-process TTL cache → live KV read via DefaultAzureCredential. The env override keeps local dev unchanged and covers the transition period while existing Container App env vars secret-ref into KV. Cache TTL defaults to 5 minutes; setConfig invalidates on write so /install doesn't have to wait for expiry. Adds @azure/identity and @azure/keyvault-secrets as runtime deps. The module is unused at this commit; subsequent commits wire it into the install configurator and downstream features.

SHA

Subject

Author

Date

7d5e48d6

feat(config): Key Vault-backed config reader with env override + TTL

Allen Morgan

2026-05-08

↗ GitHub

commit body

Adds lib/config.ts with getConfig/setConfig/flushConfigCache. Lookup
order: env override → in-process TTL cache → live KV read via
DefaultAzureCredential. The env override keeps local dev unchanged and
covers the transition period while existing Container App env vars
secret-ref into KV. Cache TTL defaults to 5 minutes; setConfig
invalidates on write so /install doesn't have to wait for expiry.

Adds @azure/identity and @azure/keyvault-secrets as runtime deps. The
module is unused at this commit; subsequent commits wire it into the
install configurator and downstream features.

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-190.md from inside the repo you want the changes in.