Environment variables and configuration in Azure - Deep Dive

Overview - Environment variables and configuration

What is it?

Environment variables are simple key-value pairs stored outside your application code that provide configuration settings. They let your app know important details like database addresses or feature flags without changing the code. Configuration is the process of setting these values so your app behaves correctly in different places, like development or production. This keeps your app flexible and secure.

Why it matters

Without environment variables, you would have to hardcode sensitive or changing information inside your app, risking security and making updates hard. Imagine having to change your app's code every time you move it to a new server or change a password. Environment variables solve this by separating configuration from code, making apps easier to manage, safer, and ready for cloud environments like Azure.

Where it fits

Before learning this, you should understand basic app development and how apps run on servers. After this, you can learn about Azure App Service configuration, Azure Key Vault for secrets, and infrastructure as code tools like ARM templates or Terraform that manage environment variables automatically.

Mental Model

Core Idea

Environment variables are like a remote control that sets how your app behaves without touching its internal parts.

Think of it like...

Think of environment variables as the settings on a coffee machine. Instead of rebuilding the machine to change the coffee strength or cup size, you just adjust the settings. Similarly, environment variables let you change app behavior without rewriting code.

┌─────────────────────────────┐
│       Application Code       │
│  (does not change itself)    │
├─────────────┬───────────────┤
│             │               │
│             ▼               │
│   Environment Variables     │
│  (external key-value pairs) │
└─────────────┴───────────────┘

Build-Up - 6 Steps

1

Foundation

What are environment variables

Concept: Introduce environment variables as external settings for apps.

Environment variables are simple text values stored outside your app's code. They hold information like usernames, passwords, or URLs your app needs to work. For example, instead of writing a database password inside your app, you store it as an environment variable.

Result

You understand that environment variables keep sensitive or changeable info separate from code.

Knowing that environment variables are external lets you change app behavior without touching the code, improving security and flexibility.

2

Foundation

How environment variables work in Azure

Concept: Explain how Azure provides environment variables to apps.

In Azure, services like Azure App Service let you define environment variables through their settings panel or CLI. When your app runs, it reads these variables automatically. This means you can change settings in Azure without redeploying your app.

Result

You see how Azure makes it easy to manage environment variables separately from your app.

Understanding Azure's environment variable support shows how cloud platforms simplify configuration management.

3

Intermediate

Using environment variables for different environments

🤔Before reading on: do you think one set of environment variables works for all environments or each needs its own? Commit to your answer.

Concept: Learn why different environments (dev, test, prod) need separate environment variables.

Each environment your app runs in has different needs. For example, your development database is not the same as production. By setting different environment variables per environment, you ensure your app connects to the right resources and behaves correctly.

Result

You understand the importance of environment-specific configuration for safe and reliable deployments.

Knowing that environment variables vary by environment prevents costly mistakes like using test data in production.

4

Intermediate

Securely managing sensitive data

🤔Before reading on: do you think environment variables are always secure or can they be exposed? Commit to your answer.

Concept: Introduce the need to protect sensitive environment variables and Azure tools for this.

Environment variables can hold secrets like passwords. If exposed, they risk security. Azure offers services like Azure Key Vault to store secrets securely and inject them as environment variables at runtime, keeping secrets safe and out of code or config files.

Result

You learn how to keep sensitive data safe while still using environment variables.

Understanding secret management prevents accidental leaks and strengthens app security.

5

Advanced

Overriding environment variables in Azure pipelines

🤔Before reading on: do you think environment variables set in Azure App Service can be changed during deployment pipelines? Commit to your answer.

Concept: Explain how Azure DevOps pipelines can override environment variables during deployment.

Azure DevOps pipelines let you define or override environment variables dynamically during deployment. This means you can automate setting different variables per deployment without manual changes, enabling continuous integration and delivery with flexible configuration.

Result

You see how automation integrates with environment variables for smooth deployments.

Knowing pipeline overrides helps build robust, automated deployment workflows that adapt configuration per release.

6

Expert

Environment variables and containerized Azure apps

🤔Before reading on: do you think environment variables inside containers behave the same as in Azure App Service? Commit to your answer.

Concept: Explore how environment variables work inside Azure container services and Kubernetes.

When running apps in Azure Kubernetes Service or Azure Container Instances, environment variables are passed to containers at startup. Kubernetes ConfigMaps and Secrets manage these variables, allowing fine-grained control and updates without rebuilding containers. This adds complexity but powerful flexibility.

Result

You understand environment variables in container orchestration and their management tools.

Recognizing container-specific environment variable handling is key for modern cloud-native app configuration.

Under the Hood

Environment variables are stored by the operating system or cloud platform as key-value pairs accessible to running processes. When an app starts, it inherits these variables from its environment. In Azure, the platform injects these variables into the app's runtime environment before execution. For containers, orchestration systems like Kubernetes mount ConfigMaps or Secrets as environment variables inside container processes.

Why designed this way?

Separating configuration from code was designed to improve security, flexibility, and portability. Early software hardcoded settings, making changes risky and error-prone. Environment variables provide a simple, standardized interface supported by operating systems and cloud platforms, avoiding code changes for config updates. Alternatives like config files exist but can be less secure or harder to manage at scale.

┌───────────────┐       ┌─────────────────────┐
│ Azure Platform│──────▶│ Environment Variables│
│  (App Service)│       │  (key-value store)  │
└──────┬────────┘       └─────────┬───────────┘
       │                            │
       │                            ▼
       │                  ┌─────────────────┐
       │                  │ Application Run │
       │                  │  Environment    │
       │                  └─────────────────┘
       │                            │
       └────────────────────────────┤
                                    ▼
                          ┌────────────────────┐
                          │ Application Code    │
                          │  reads variables    │
                          └────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Are environment variables automatically encrypted by Azure? Commit to yes or no.

Common Belief: Environment variables are always encrypted and safe by default in Azure.

Reality: Environment variables are stored as plain text in Azure App Service settings and visible to anyone with access unless stored in Azure Key Vault or similar.

Why it matters: Assuming automatic encryption can lead to accidental exposure of secrets and security breaches.

Quick: Do environment variables set in Azure App Service update immediately in running apps? Commit to yes or no.

Common Belief: Changing environment variables in Azure App Service instantly updates the running app without restart.

Reality: Most apps need to restart or reload configuration to see updated environment variables.

Why it matters: Expecting instant updates can cause confusion and debugging delays when changes don't take effect.

Quick: Can environment variables be used to store large configuration files? Commit to yes or no.

Common Belief: Environment variables are suitable for storing any size of configuration data.

Reality: Environment variables have size limits and are best for small pieces of data, not large files or complex configs.

Why it matters: Trying to store large data in environment variables can cause failures or performance issues.

Quick: Are environment variables the only way to configure Azure apps? Commit to yes or no.

Common Belief: Environment variables are the only or best way to configure Azure applications.

Reality: Azure supports multiple configuration methods like app settings, Azure Key Vault, and managed identities alongside environment variables.

Why it matters: Relying solely on environment variables can limit security and flexibility options.

Expert Zone

1

Azure App Service environment variables are stored as app settings but can be overridden by deployment slots, enabling safe testing before production swaps.

2

When using containers, environment variables can be injected via Kubernetes ConfigMaps or Secrets, but Secrets require careful handling to avoid exposure in logs or process lists.

3

Azure Functions use a different configuration model where environment variables are combined with function app settings and can be overridden by local.settings.json during development.

When NOT to use

Avoid using environment variables for very large or complex configuration data; instead, use configuration files or Azure App Configuration service. For highly sensitive secrets, prefer Azure Key Vault with managed identities over plain environment variables. When running distributed systems, centralized configuration services provide better consistency than scattered environment variables.

Production Patterns

In production, teams use environment variables combined with Azure Key Vault references to keep secrets secure. Deployment pipelines inject environment variables dynamically per environment. Containerized apps use Kubernetes ConfigMaps and Secrets for configuration, enabling rolling updates without rebuilding images. Feature flags are often controlled via environment variables to toggle features without redeploying.

Connections

12-Factor App Methodology

Environment variables are a core principle in 12-Factor apps for configuration management.

Understanding environment variables helps grasp how modern cloud apps separate config from code, a key 12-Factor practice.

Secrets Management

Environment variables often hold secrets, linking them closely to secrets management practices.

Knowing environment variables' limits clarifies why dedicated secrets management tools like Azure Key Vault are essential.

Human Memory and Context Switching

Just as environment variables separate configuration from code, human memory separates context from tasks to avoid overload.

Recognizing separation of concerns in computing mirrors how humans manage focus, improving understanding of modular design.

Common Pitfalls

#1 Hardcoding sensitive data inside application code.

Wrong approach:

const dbPassword = "MySecret123"; // hardcoded password

Correct approach:

const dbPassword = process.env.DB_PASSWORD; // read from environment variable

Root cause:

Not understanding the risk of embedding secrets in code and the benefits of externalizing configuration.

#2 Assuming environment variable changes apply immediately without app restart.

Wrong approach:

Change environment variable in Azure portal and expect app to use new value instantly.

Correct approach:

After changing environment variables, restart the app or reload configuration to apply changes.

Root cause:

Misunderstanding how environment variables are loaded into app memory at startup.

#3 Storing large JSON config files as environment variables.

Wrong approach:

Set a huge JSON string as a single environment variable for app config.

Correct approach:

Store large configs in Azure App Configuration or files, and reference them in the app.

Root cause:

Not knowing environment variables have size limits and are meant for small, simple values.

Key Takeaways

Environment variables keep configuration separate from code, making apps flexible and secure.

Azure provides easy ways to set and manage environment variables for your apps and containers.

Different environments need different environment variables to avoid mistakes and ensure correct behavior.

Sensitive data should be stored securely using Azure Key Vault, not plain environment variables.

Understanding environment variables is essential for modern cloud app deployment and configuration management.

Practice

1. What is the main purpose of using environment variables in Azure web apps?

easy

A. To write application logic inside the environment

B. To separate configuration settings from the application code

C. To store large files for the application

D. To replace the need for a database

Solution

1. Step 1: Understand environment variables role

   Environment variables hold configuration data outside the code, making apps flexible and secure.

2. Step 2: Identify correct purpose in Azure context

   Azure web apps use environment variables to keep settings separate from code, allowing easy updates without code changes.

3. Final Answer:

   To separate configuration settings from the application code -> Option B

4. Quick Check:

   Environment variables separate config from code [OK]

Hint: Think: config outside code for easy updates [OK]

Common Mistakes:

• Confusing environment variables with code logic
• Using environment variables to store large files
• Assuming environment variables replace databases

2. Which Azure CLI command correctly sets an environment variable named API_KEY with value 12345 for a web app called myapp?

easy

A. az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345

B. az webapp set env --app myapp --key API_KEY --value 12345

C. az appservice env set --app myapp --name API_KEY --value 12345

D. az webapp config set --app myapp --env API_KEY=12345

Solution

1. Step 1: Recall Azure CLI syntax for setting app settings

   The correct command uses az webapp config appsettings set with --name, --resource-group, and --settings.

2. Step 2: Match command to given options

   az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345 matches the correct syntax exactly; others use incorrect commands or flags.

3. Final Answer:

   az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345 -> Option A

4. Quick Check:

   Use az webapp config appsettings set with correct flags [OK]

Hint: Remember: 'az webapp config appsettings set' sets env vars [OK]

Common Mistakes:

• Using wrong Azure CLI commands or flags
• Omitting resource group parameter
• Confusing appsettings with environment commands

3. Given this Azure web app environment variable setup:
API_URL=https://api.example.com
What will the following Python code print?

import os
print(os.getenv('API_URL'))

medium

A. os.getenv('API_URL')

B. API_URL

C. None

D. https://api.example.com

Solution

1. Step 1: Understand os.getenv behavior

   os.getenv('API_URL') fetches the value of environment variable 'API_URL' if set.

2. Step 2: Match environment variable value

   The environment variable 'API_URL' is set to 'https://api.example.com', so the print outputs this string.

3. Final Answer:

   https://api.example.com -> Option D

4. Quick Check:

   os.getenv returns env var value [OK]

Hint: os.getenv returns the variable's value, not the name [OK]

Common Mistakes:

• Expecting the variable name instead of its value
• Assuming None if variable is set
• Confusing function call with string output

4. You tried to update an environment variable in Azure CLI but the app still uses the old value. What is the most likely cause?

medium

A. Azure CLI does not support environment variable updates

B. You used the wrong variable name in the code

C. You forgot to restart the web app after updating the variable

D. Environment variables cannot be updated once set

Solution

1. Step 1: Understand environment variable update behavior

   After updating environment variables, Azure web apps often require a restart to apply changes.

2. Step 2: Identify common mistake

   Not restarting the app causes it to keep using old cached environment values.

3. Final Answer:

   You forgot to restart the web app after updating the variable -> Option C

4. Quick Check:

   Restart app to apply env var changes [OK]

Hint: Restart app after env var changes to apply them [OK]

Common Mistakes:

• Assuming variables update instantly without restart
• Confusing variable name errors with update issues
• Thinking Azure CLI cannot update variables

5. You want to securely store a database password as an environment variable in Azure App Service. Which approach is best practice?

hard

A. Use Azure Key Vault and reference the secret in the app settings

B. Store the password directly in the app settings as plain text

C. Hardcode the password inside your application code

D. Send the password as a query parameter in URLs

Solution

1. Step 1: Identify secure storage options

   Azure Key Vault is designed to securely store secrets like passwords and keys.

2. Step 2: Understand integration with app settings

   You can reference Key Vault secrets in Azure App Service app settings, avoiding plain text storage.

3. Step 3: Evaluate other options

   Storing passwords in plain text, code, or URLs exposes security risks and is not recommended.

4. Final Answer:

   Use Azure Key Vault and reference the secret in the app settings -> Option A

5. Quick Check:

   Use Key Vault for secure secret storage [OK]

Hint: Always use Key Vault for sensitive secrets [OK]

Common Mistakes:

• Storing passwords in plain text app settings
• Hardcoding secrets in code
• Exposing secrets in URLs