The previous answer by Shengbao Shui shows the command to store a secret using the Azure CLI 1.0 (Node). For Azure CLI 2.0 (Python) use the following syntax:
Set / Store Key:
az keyvault secret set --vault-name 'myvault' -n 'secret-name' -f '~/.ssh/id_rsa'
Arguments:
Arguments --name -n [Required]: Name of the secret. --vault-name [Required]: Name of the key vault. --description : Description of the secret contents (e.g. password, connection string, etc). --disabled : Create secret in disabled state. Allowed values: false, true. --expires : Expiration UTC datetime (Y-m-d'T'H:M:S'Z'). --not-before : Key not usable before the provided UTC datetime (Y-m-d'T'H:M:S'Z'). --tags : Space-separated tags in 'key[=value]' format. Use '' to clear existing tags. Content Source Arguments --encoding -e : Source file encoding. The value is saved as a tag (`file- encoding=<val>`) and used during download to automatically encode the resulting file. Allowed values: ascii, base64, hex, utf-16be, utf-16le, utf-8. Default: utf-8. --file -f : Source file for secret. Use in conjunction with '--encoding'. --value : Plain text secret value. Cannot be used with '--file' or '--encoding'. Global Arguments --debug : Increase logging verbosity to show all debug logs. --help -h : Show this help message and exit. --output -o : Output format. Allowed values: json, jsonc, table, tsv. Default: json. --query : JMESPath query string. See http://jmespath.org/ for more information and examples. --verbose : Increase logging verbosity. Use --debug for full debug logs.
Retrieve / Get Key:
Save the key to a file ~/.ssh/mykey using the jq utility.
az keyvault secret show --vault-name myvault --name 'secret-name' | jq -r .value > ~/.ssh/mykey
Files may print with a trailing newline, which you can remove with a perl one-liner:
perl -pi -e 'chomp if eof' ~/.ssh/mykey # Set permissions to user-read only chmod 600 ~/.ssh/mykey
Generate the public key from the private key file...
ssh-keygen -y -f ~/.ssh/myfile > ~/.ssh/myfile.pub
