From e9f2982da2a12a1ea87814a970a1851f7a3063b7 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Wed, 29 Jul 2026 10:42:21 +0000 Subject: [PATCH 1/5] Update porter.yaml files to set sensitive parameters and increment version numbers --- CHANGELOG.md | 1 + templates/shared_services/admin-vm/porter.yaml | 3 ++- templates/shared_services/airlock_notifier/porter.yaml | 3 ++- templates/shared_services/certs/porter.yaml | 3 ++- templates/shared_services/cyclecloud/porter.yaml | 3 ++- templates/shared_services/databricks-auth/porter.yaml | 3 ++- templates/shared_services/firewall/porter.yaml | 3 ++- templates/shared_services/gitea/porter.yaml | 3 ++- templates/shared_services/sonatype-nexus-vm/porter.yaml | 3 ++- templates/workspace_services/azureml/porter.yaml | 3 ++- .../azureml/user_resources/aml_compute/porter.yaml | 3 ++- templates/workspace_services/azuresql/porter.yaml | 3 ++- templates/workspace_services/databricks/porter.yaml | 3 ++- templates/workspace_services/gitea/porter.yaml | 3 ++- templates/workspace_services/guacamole/porter.yaml | 3 ++- .../guacamole-azure-export-reviewvm/porter.yaml | 4 +++- .../guacamole-azure-import-reviewvm/porter.yaml | 4 +++- .../user_resources/guacamole-azure-linuxvm/porter.yaml | 4 +++- .../user_resources/guacamole-azure-windowsvm/porter.yaml | 4 +++- templates/workspace_services/health-services/porter.yaml | 3 ++- templates/workspace_services/mysql/porter.yaml | 3 ++- templates/workspace_services/ohdsi/porter.yaml | 3 ++- templates/workspace_services/openai/porter.yaml | 3 ++- templates/workspaces/airlock-import-review/porter.yaml | 5 ++++- templates/workspaces/base/porter.yaml | 5 ++++- templates/workspaces/unrestricted/porter.yaml | 5 ++++- 26 files changed, 61 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e673ccbe0e..76c17c4d66 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,7 @@ ENHANCEMENTS: * Update the version of `super-linter` used in the `build_validation_develop` workflow to 8.7.0 ([#4957](https://github.com/microsoft/AzureTRE/issues/4957)) BUG FIXES: +* Fix porter.yaml secret params to `sensitive: true` to prevent secrets appearing in debug logs. ([#5011](https://github.com/microsoft/AzureTRE/issues/5011)) * Fix Nexus shared service security: fetch admin password from Key Vault at runtime via managed identity (IMDS) instead of embedding it in the VM Run Command script content. Fix `deploy_nexus_container.sh` short-circuit path to fail loudly if the container does not start. (`sonatype-nexus` 3.10.0) ([#4983](https://github.com/microsoft/AzureTRE/pull/4983)) * Fix UI TypeScript deprecation warning by updating `moduleResolution` to `bundler` in `tsconfig.json`. ([#4968](https://github.com/microsoft/AzureTRE/issues/4968)) * Fix API timeout and name collision failures on workspace creation by checking storage account name availability and improved logging. ([#4946](https://github.com/microsoft/AzureTRE/pull/4946)) diff --git a/templates/shared_services/admin-vm/porter.yaml b/templates/shared_services/admin-vm/porter.yaml index 9cbdf3eaa0..9916f91b74 100644 --- a/templates/shared_services/admin-vm/porter.yaml +++ b/templates/shared_services/admin-vm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-admin-vm -version: 0.5.4 +version: 0.5.5 description: "An admin vm shared service" dockerfile: Dockerfile.tmpl registry: azuretre @@ -31,6 +31,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id type: string diff --git a/templates/shared_services/airlock_notifier/porter.yaml b/templates/shared_services/airlock_notifier/porter.yaml index 700821b6cd..dad786e56a 100644 --- a/templates/shared_services/airlock_notifier/porter.yaml +++ b/templates/shared_services/airlock_notifier/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-airlock-notifier -version: 1.0.10 +version: 1.0.11 description: "A shared service notifying on Airlock Operations" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id diff --git a/templates/shared_services/certs/porter.yaml b/templates/shared_services/certs/porter.yaml index 7d01fd7630..456caf8cdf 100755 --- a/templates/shared_services/certs/porter.yaml +++ b/templates/shared_services/certs/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-certs -version: 0.7.10 +version: 0.7.11 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id diff --git a/templates/shared_services/cyclecloud/porter.yaml b/templates/shared_services/cyclecloud/porter.yaml index df454e012a..e7f7e8e7e1 100644 --- a/templates/shared_services/cyclecloud/porter.yaml +++ b/templates/shared_services/cyclecloud/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-cyclecloud -version: 0.7.5 +version: 0.7.6 description: "An Azure TRE Shared Service Template for Azure Cyclecloud" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id diff --git a/templates/shared_services/databricks-auth/porter.yaml b/templates/shared_services/databricks-auth/porter.yaml index f7d34be8cc..eecdce71bd 100644 --- a/templates/shared_services/databricks-auth/porter.yaml +++ b/templates/shared_services/databricks-auth/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-databricks-private-auth -version: 0.1.14 +version: 0.1.15 description: "An Azure TRE shared service for Azure Databricks authentication." registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id diff --git a/templates/shared_services/firewall/porter.yaml b/templates/shared_services/firewall/porter.yaml index e8399e844b..699d0e6d8e 100644 --- a/templates/shared_services/firewall/porter.yaml +++ b/templates/shared_services/firewall/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-firewall -version: 1.6.1 +version: 1.6.2 description: "An Azure TRE Firewall shared service" dockerfile: Dockerfile.tmpl registry: azuretre @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id diff --git a/templates/shared_services/gitea/porter.yaml b/templates/shared_services/gitea/porter.yaml index f9a76a7565..cfe298f6ea 100644 --- a/templates/shared_services/gitea/porter.yaml +++ b/templates/shared_services/gitea/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-gitea -version: 1.2.2 +version: 1.2.3 description: "A Gitea shared service" dockerfile: Dockerfile.tmpl registry: azuretre @@ -23,6 +23,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id type: string diff --git a/templates/shared_services/sonatype-nexus-vm/porter.yaml b/templates/shared_services/sonatype-nexus-vm/porter.yaml index 8aea05c7c8..f2404df760 100644 --- a/templates/shared_services/sonatype-nexus-vm/porter.yaml +++ b/templates/shared_services/sonatype-nexus-vm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-sonatype-nexus -version: 3.10.0 +version: 3.10.1 description: "A Sonatype Nexus shared service" dockerfile: Dockerfile.tmpl registry: azuretre @@ -22,6 +22,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id type: string diff --git a/templates/workspace_services/azureml/porter.yaml b/templates/workspace_services/azureml/porter.yaml index d6d4593ad4..6370e9ceb6 100644 --- a/templates/workspace_services/azureml/porter.yaml +++ b/templates/workspace_services/azureml/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-azureml -version: 1.1.4 +version: 1.1.5 description: "An Azure TRE service for Azure Machine Learning" registry: azuretre dockerfile: Dockerfile.tmpl @@ -16,6 +16,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id diff --git a/templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml b/templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml index 34d3ee7844..e766e13b01 100644 --- a/templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml +++ b/templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-user-resource-aml-compute-instance -version: 0.5.12 +version: 0.5.13 description: "Azure Machine Learning Compute Instance" registry: azuretre dockerfile: Dockerfile.tmpl @@ -17,6 +17,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: id diff --git a/templates/workspace_services/azuresql/porter.yaml b/templates/workspace_services/azuresql/porter.yaml index 7e72065bba..1e82fb5840 100644 --- a/templates/workspace_services/azuresql/porter.yaml +++ b/templates/workspace_services/azuresql/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-azuresql -version: 1.0.17 +version: 1.0.18 description: "An Azure SQL workspace service" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id type: string diff --git a/templates/workspace_services/databricks/porter.yaml b/templates/workspace_services/databricks/porter.yaml index abfdd18a83..8ac927b006 100644 --- a/templates/workspace_services/databricks/porter.yaml +++ b/templates/workspace_services/databricks/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-databricks -version: 1.0.16 +version: 1.0.17 description: "An Azure TRE service for Azure Databricks." registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id diff --git a/templates/workspace_services/gitea/porter.yaml b/templates/workspace_services/gitea/porter.yaml index f9044eb34e..340bb3ffec 100644 --- a/templates/workspace_services/gitea/porter.yaml +++ b/templates/workspace_services/gitea/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-gitea -version: 1.3.3 +version: 1.3.4 description: "A Gitea workspace service" dockerfile: Dockerfile.tmpl registry: azuretre @@ -23,6 +23,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id type: string diff --git a/templates/workspace_services/guacamole/porter.yaml b/templates/workspace_services/guacamole/porter.yaml index b2ce9174b4..0556edd1f2 100644 --- a/templates/workspace_services/guacamole/porter.yaml +++ b/templates/workspace_services/guacamole/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole -version: 0.14.2 +version: 0.14.3 description: "An Azure TRE service for Guacamole" dockerfile: Dockerfile.tmpl registry: azuretre @@ -23,6 +23,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml index ef129291f7..66d0b901f3 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-export-reviewvm -version: 2.0.0 +version: 2.0.1 description: "An Azure TRE User Resource Template for reviewing Airlock export requests" dockerfile: Dockerfile.tmpl registry: azuretre @@ -33,6 +33,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id @@ -82,6 +83,7 @@ parameters: default: "2 CPU | 8GB RAM" - name: airlock_request_sas_url type: string + sensitive: true description: "A SAS token to access storage resource in workspace under review" env: airlock_request_sas_url - name: enable_cmk_encryption diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml index 28e5167a4b..eb098791f8 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-import-reviewvm -version: 2.0.0 +version: 2.0.1 description: "An Azure TRE User Resource Template for reviewing Airlock import requests" dockerfile: Dockerfile.tmpl registry: azuretre @@ -40,6 +40,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id @@ -89,6 +90,7 @@ parameters: default: "2 CPU | 8GB RAM" - name: airlock_request_sas_url type: string + sensitive: true description: "A SAS token to access storage resource in workspace under review" env: airlock_request_sas_url - name: enable_cmk_encryption diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml index 186da0d571..50f9c0c9b3 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-linuxvm -version: 1.4.3 +version: 1.4.4 description: "An Azure TRE User Resource Template for Guacamole (Linux)" dockerfile: Dockerfile.tmpl registry: azuretre @@ -42,11 +42,13 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true # Credentials for interacting with the AAD Auth tenant - name: auth_client_id env: AUTH_CLIENT_ID - name: auth_client_secret env: AUTH_CLIENT_SECRET + sensitive: true - name: auth_tenant_id env: AUTH_TENANT_ID diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml index f994d0e021..cda028d1ec 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-windowsvm -version: 3.0.0 +version: 3.0.1 description: "An Azure TRE User Resource Template for Guacamole (Windows 11 or Windows Server 2025)" dockerfile: Dockerfile.tmpl registry: azuretre @@ -48,11 +48,13 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true # Credentials for interacting with the AAD Auth tenant - name: auth_client_id env: AUTH_CLIENT_ID - name: auth_client_secret env: AUTH_CLIENT_SECRET + sensitive: true - name: auth_tenant_id env: AUTH_TENANT_ID diff --git a/templates/workspace_services/health-services/porter.yaml b/templates/workspace_services/health-services/porter.yaml index d7dd92c469..f8ddacc892 100644 --- a/templates/workspace_services/health-services/porter.yaml +++ b/templates/workspace_services/health-services/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-health -version: 0.3.5 +version: 0.3.6 description: "An Azure Data Health Services workspace service" registry: azuretre dockerfile: Dockerfile.tmpl @@ -16,6 +16,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id diff --git a/templates/workspace_services/mysql/porter.yaml b/templates/workspace_services/mysql/porter.yaml index 80ce54d0a8..e4ce4c507d 100644 --- a/templates/workspace_services/mysql/porter.yaml +++ b/templates/workspace_services/mysql/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-mysql -version: 1.0.12 +version: 1.0.13 description: "A MySQL workspace service" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id type: string diff --git a/templates/workspace_services/ohdsi/porter.yaml b/templates/workspace_services/ohdsi/porter.yaml index ca5e7ef556..317f93be70 100644 --- a/templates/workspace_services/ohdsi/porter.yaml +++ b/templates/workspace_services/ohdsi/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-ohdsi -version: 0.3.7 +version: 0.3.8 description: "An OHDSI workspace service" registry: azuretre dockerfile: Dockerfile.tmpl @@ -19,6 +19,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id diff --git a/templates/workspace_services/openai/porter.yaml b/templates/workspace_services/openai/porter.yaml index 4ad4efc6b9..ef9068e266 100644 --- a/templates/workspace_services/openai/porter.yaml +++ b/templates/workspace_services/openai/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-openai -version: 1.0.8 +version: 1.0.9 description: "An OpenAI workspace service" registry: azuretre dockerfile: Dockerfile.tmpl @@ -15,6 +15,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: workspace_id type: string diff --git a/templates/workspaces/airlock-import-review/porter.yaml b/templates/workspaces/airlock-import-review/porter.yaml index 464a41d4f7..c9134ac87c 100644 --- a/templates/workspaces/airlock-import-review/porter.yaml +++ b/templates/workspaces/airlock-import-review/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-airlock-import-review -version: 0.15.0 +version: 0.15.1 description: "A workspace to do Airlock Data Import Reviews for Azure TRE" dockerfile: Dockerfile.tmpl registry: azuretre @@ -12,6 +12,7 @@ credentials: env: AUTH_CLIENT_ID - name: auth_client_secret env: AUTH_CLIENT_SECRET + sensitive: true - name: auth_tenant_id env: AUTH_TENANT_ID # Credentials for interacting with Azure @@ -23,6 +24,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id @@ -83,6 +85,7 @@ parameters: when you create the ws application" - name: client_secret type: string + sensitive: true description: "The client secret of the workspace in the identity provider. This value is typically provided to you when you create the ws application" diff --git a/templates/workspaces/base/porter.yaml b/templates/workspaces/base/porter.yaml index 22cb6cdfc3..7b6dd70d49 100644 --- a/templates/workspaces/base/porter.yaml +++ b/templates/workspaces/base/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-base -version: 2.8.4 +version: 2.8.5 description: "A base Azure TRE workspace" dockerfile: Dockerfile.tmpl registry: azuretre @@ -12,6 +12,7 @@ credentials: env: AUTH_CLIENT_ID - name: auth_client_secret env: AUTH_CLIENT_SECRET + sensitive: true - name: auth_tenant_id env: AUTH_TENANT_ID # Credentials for interacting with Azure @@ -23,6 +24,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id @@ -86,6 +88,7 @@ parameters: when you create the ws application" - name: client_secret type: string + sensitive: true description: "The client secret of the workspace in the identity provider. This value is typically provided to you when you create the ws application" diff --git a/templates/workspaces/unrestricted/porter.yaml b/templates/workspaces/unrestricted/porter.yaml index bd4373b587..b26fa25254 100644 --- a/templates/workspaces/unrestricted/porter.yaml +++ b/templates/workspaces/unrestricted/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-unrestricted -version: 0.13.7 +version: 0.13.8 description: "A base Azure TRE workspace" dockerfile: Dockerfile.tmpl registry: azuretre @@ -12,6 +12,7 @@ credentials: env: AUTH_CLIENT_ID - name: auth_client_secret env: AUTH_CLIENT_SECRET + sensitive: true - name: auth_tenant_id env: AUTH_TENANT_ID # Credentials for interacting with Azure @@ -23,6 +24,7 @@ credentials: env: ARM_CLIENT_ID - name: azure_client_secret env: ARM_CLIENT_SECRET + sensitive: true parameters: - name: tre_id @@ -94,6 +96,7 @@ parameters: when you create the ws application" - name: client_secret type: string + sensitive: true description: "The client secret of the workspace in the identity provider. This value is typically provided to you when you create the ws application" From 4a4d240e5cd390882112e6c99a9c70432e249315 Mon Sep 17 00:00:00 2001 From: James Chapman <196318169+JC-wk@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:14:42 +0100 Subject: [PATCH 2/5] changelog Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 76c17c4d66..0e7477bb4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,7 +16,7 @@ ENHANCEMENTS: * Update the version of `super-linter` used in the `build_validation_develop` workflow to 8.7.0 ([#4957](https://github.com/microsoft/AzureTRE/issues/4957)) BUG FIXES: -* Fix porter.yaml secret params to `sensitive: true` to prevent secrets appearing in debug logs. ([#5011](https://github.com/microsoft/AzureTRE/issues/5011)) +* Mark secret parameters in porter.yaml as `sensitive: true` to prevent secrets from appearing in debug logs ([#5011](https://github.com/microsoft/AzureTRE/issues/5011)) * Fix Nexus shared service security: fetch admin password from Key Vault at runtime via managed identity (IMDS) instead of embedding it in the VM Run Command script content. Fix `deploy_nexus_container.sh` short-circuit path to fail loudly if the container does not start. (`sonatype-nexus` 3.10.0) ([#4983](https://github.com/microsoft/AzureTRE/pull/4983)) * Fix UI TypeScript deprecation warning by updating `moduleResolution` to `bundler` in `tsconfig.json`. ([#4968](https://github.com/microsoft/AzureTRE/issues/4968)) * Fix API timeout and name collision failures on workspace creation by checking storage account name availability and improved logging. ([#4946](https://github.com/microsoft/AzureTRE/pull/4946)) From f765f4a65a06e8e1f10c1b0dd72ddc2040e90209 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Wed, 29 Jul 2026 12:27:32 +0000 Subject: [PATCH 3/5] airlock sas token --- .../guacamole-azure-import-reviewvm/terraform/variables.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/terraform/variables.tf b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/terraform/variables.tf index b557c708cb..110eba516b 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/terraform/variables.tf +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/terraform/variables.tf @@ -21,7 +21,8 @@ variable "image_gallery_id" { default = "" } variable "airlock_request_sas_url" { - type = string + type = string + sensitive = true } variable "enable_cmk_encryption" { type = bool From 4bdb66340750ee001ee414faa55d04bf049757fe Mon Sep 17 00:00:00 2001 From: James Chapman <196318169+JC-wk@users.noreply.github.com> Date: Tue, 4 Aug 2026 15:24:12 +0100 Subject: [PATCH 4/5] Bump version from 0.7.11 to 0.7.12 --- templates/shared_services/certs/porter.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/shared_services/certs/porter.yaml b/templates/shared_services/certs/porter.yaml index 456caf8cdf..e9bcd6d100 100755 --- a/templates/shared_services/certs/porter.yaml +++ b/templates/shared_services/certs/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-certs -version: 0.7.11 +version: 0.7.12 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt" registry: azuretre dockerfile: Dockerfile.tmpl From ede9588546b5d68717a5401eab5c64618175f350 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Mon, 10 Aug 2026 11:16:58 +0000 Subject: [PATCH 5/5] bump versions --- templates/shared_services/admin-vm/porter.yaml | 2 +- templates/shared_services/airlock_notifier/porter.yaml | 2 +- templates/shared_services/certs/porter.yaml | 2 +- templates/shared_services/gitea/porter.yaml | 2 +- templates/shared_services/sonatype-nexus-vm/porter.yaml | 2 +- templates/workspace_services/azureml/porter.yaml | 2 +- templates/workspace_services/azuresql/porter.yaml | 2 +- templates/workspace_services/databricks/porter.yaml | 2 +- templates/workspace_services/gitea/porter.yaml | 2 +- templates/workspace_services/guacamole/porter.yaml | 2 +- .../user_resources/guacamole-azure-export-reviewvm/porter.yaml | 2 +- .../user_resources/guacamole-azure-import-reviewvm/porter.yaml | 2 +- .../user_resources/guacamole-azure-linuxvm/porter.yaml | 2 +- .../user_resources/guacamole-azure-windowsvm/porter.yaml | 2 +- templates/workspace_services/health-services/porter.yaml | 2 +- templates/workspace_services/mysql/porter.yaml | 2 +- templates/workspace_services/ohdsi/porter.yaml | 2 +- templates/workspace_services/openai/porter.yaml | 2 +- 18 files changed, 18 insertions(+), 18 deletions(-) diff --git a/templates/shared_services/admin-vm/porter.yaml b/templates/shared_services/admin-vm/porter.yaml index 9916f91b74..11f47f897f 100644 --- a/templates/shared_services/admin-vm/porter.yaml +++ b/templates/shared_services/admin-vm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-admin-vm -version: 0.5.5 +version: 0.5.6 description: "An admin vm shared service" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/shared_services/airlock_notifier/porter.yaml b/templates/shared_services/airlock_notifier/porter.yaml index dad786e56a..cf708af7b0 100644 --- a/templates/shared_services/airlock_notifier/porter.yaml +++ b/templates/shared_services/airlock_notifier/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-airlock-notifier -version: 1.0.11 +version: 1.0.12 description: "A shared service notifying on Airlock Operations" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/shared_services/certs/porter.yaml b/templates/shared_services/certs/porter.yaml index 456caf8cdf..e9bcd6d100 100755 --- a/templates/shared_services/certs/porter.yaml +++ b/templates/shared_services/certs/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-certs -version: 0.7.11 +version: 0.7.12 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/shared_services/gitea/porter.yaml b/templates/shared_services/gitea/porter.yaml index cfe298f6ea..5a28cc0b11 100644 --- a/templates/shared_services/gitea/porter.yaml +++ b/templates/shared_services/gitea/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-gitea -version: 1.2.3 +version: 1.2.4 description: "A Gitea shared service" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/shared_services/sonatype-nexus-vm/porter.yaml b/templates/shared_services/sonatype-nexus-vm/porter.yaml index f2404df760..974ad4e44b 100644 --- a/templates/shared_services/sonatype-nexus-vm/porter.yaml +++ b/templates/shared_services/sonatype-nexus-vm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-shared-service-sonatype-nexus -version: 3.10.1 +version: 3.10.2 description: "A Sonatype Nexus shared service" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/azureml/porter.yaml b/templates/workspace_services/azureml/porter.yaml index 6370e9ceb6..e57858caa2 100644 --- a/templates/workspace_services/azureml/porter.yaml +++ b/templates/workspace_services/azureml/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-azureml -version: 1.1.5 +version: 1.1.6 description: "An Azure TRE service for Azure Machine Learning" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/azuresql/porter.yaml b/templates/workspace_services/azuresql/porter.yaml index 1e82fb5840..268853475b 100644 --- a/templates/workspace_services/azuresql/porter.yaml +++ b/templates/workspace_services/azuresql/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-azuresql -version: 1.0.18 +version: 1.0.19 description: "An Azure SQL workspace service" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/databricks/porter.yaml b/templates/workspace_services/databricks/porter.yaml index 8ac927b006..9cef35d4b7 100644 --- a/templates/workspace_services/databricks/porter.yaml +++ b/templates/workspace_services/databricks/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-databricks -version: 1.0.17 +version: 1.0.18 description: "An Azure TRE service for Azure Databricks." registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/gitea/porter.yaml b/templates/workspace_services/gitea/porter.yaml index 340bb3ffec..14d71b6464 100644 --- a/templates/workspace_services/gitea/porter.yaml +++ b/templates/workspace_services/gitea/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-gitea -version: 1.3.4 +version: 1.3.5 description: "A Gitea workspace service" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/guacamole/porter.yaml b/templates/workspace_services/guacamole/porter.yaml index 0556edd1f2..44bd959c96 100644 --- a/templates/workspace_services/guacamole/porter.yaml +++ b/templates/workspace_services/guacamole/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole -version: 0.14.3 +version: 0.14.4 description: "An Azure TRE service for Guacamole" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml index 66d0b901f3..a81080dad0 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-export-reviewvm -version: 2.0.1 +version: 2.0.2 description: "An Azure TRE User Resource Template for reviewing Airlock export requests" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml index eb098791f8..1f300e47da 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-import-reviewvm -version: 2.0.1 +version: 2.0.2 description: "An Azure TRE User Resource Template for reviewing Airlock import requests" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml index 50f9c0c9b3..54f58b2d74 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-linuxvm -version: 1.4.4 +version: 1.4.5 description: "An Azure TRE User Resource Template for Guacamole (Linux)" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml b/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml index cda028d1ec..dae7170020 100644 --- a/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml +++ b/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-service-guacamole-windowsvm -version: 3.0.1 +version: 3.0.2 description: "An Azure TRE User Resource Template for Guacamole (Windows 11 or Windows Server 2025)" dockerfile: Dockerfile.tmpl registry: azuretre diff --git a/templates/workspace_services/health-services/porter.yaml b/templates/workspace_services/health-services/porter.yaml index f8ddacc892..c68dae6aad 100644 --- a/templates/workspace_services/health-services/porter.yaml +++ b/templates/workspace_services/health-services/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-health -version: 0.3.6 +version: 0.3.7 description: "An Azure Data Health Services workspace service" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/mysql/porter.yaml b/templates/workspace_services/mysql/porter.yaml index e4ce4c507d..d347c10173 100644 --- a/templates/workspace_services/mysql/porter.yaml +++ b/templates/workspace_services/mysql/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-mysql -version: 1.0.13 +version: 1.0.14 description: "A MySQL workspace service" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/ohdsi/porter.yaml b/templates/workspace_services/ohdsi/porter.yaml index 317f93be70..106e3f337a 100644 --- a/templates/workspace_services/ohdsi/porter.yaml +++ b/templates/workspace_services/ohdsi/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-ohdsi -version: 0.3.8 +version: 0.3.9 description: "An OHDSI workspace service" registry: azuretre dockerfile: Dockerfile.tmpl diff --git a/templates/workspace_services/openai/porter.yaml b/templates/workspace_services/openai/porter.yaml index ef9068e266..d6be6a40d1 100644 --- a/templates/workspace_services/openai/porter.yaml +++ b/templates/workspace_services/openai/porter.yaml @@ -1,7 +1,7 @@ --- schemaVersion: 1.0.0 name: tre-workspace-service-openai -version: 1.0.9 +version: 1.0.10 description: "An OpenAI workspace service" registry: azuretre dockerfile: Dockerfile.tmpl