Introduce AzureKeyVaultSecretReference #8171

davidfowl · 2025-03-19T08:02:25Z

Description

This is a replacement for the magic secret outputs implementation. Resources that support keys push those keys into an explicitly defined per resource key vault and now into any key vault that is provided. The IKeyVaultSecretReference is a new primitive reference type that can is understood natively by compute environments like ACA and the azure preparer.

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Is this introducing a breaking change?
    - Yes
      - Link to aspire-docs issue (please use this breaking-change template): [Breaking change]: WithAccessKeyAuthenticaton and WithPasswordAuthentication create a keyvault resource in the app model docs-aspire#2889
    - No
      - Link to aspire-docs issue (please use this doc-idea template):
- No

src/Aspire.Hosting.Azure/IKeyVaultSecretReference.cs

- This is a replacement for the magic secret outputs implementation. Resources that support keys push those keys into an explicitly defined per resoure key vault and now into any keyvault that is provided. The IKeyVaultSecretReference is a new primitive reference type that can is understood natively by compute environments like ACA and the azure preparer.

…g references in Bicep manifests

…ource and related classes

…ion in BicepProvisioner

…project file

…ust related comments

src/Aspire.Hosting.Azure/AzureResourcePreparer.cs

src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResource.cs

tests/Aspire.Hosting.Azure.Tests/AzureContainerAppsTests.cs

mitchdenny · 2025-03-23T03:08:17Z

tests/Aspire.Hosting.Azure.Tests/AzurePostgresExtensionsTests.cs

            {
              "type": "azure.bicep.v0",
-              "connectionString": "{postgres-data.secretOutputs.connectionString}",
+              "connectionString": "{postgres-data-kv.secrets.postgres-data--connectionString}",


Is there a change queued up on the azd side to process .secrets instead of secret outputs?

cc @vhvb1989

mitchdenny

This is looking good - a few minor questions/comments.

I think it's worth going through all the playgrounds and regenerating the manifest publisher output, so we have a new baseline for comparison. The outputs of that command all make sense.

…nal access to secrets and secret client

…ey vault references

…names and improve authentication handling

…nt prefix across Azure resources

…ix across Azure resources

…nsistency

…ned type

eerhardt · 2025-03-24T15:09:03Z

src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppsInfrastructure.cs

+            SetKnownParameterValue(r, AzureBicepResource.KnownParameters.PrincipalId, _ => environment.ContainerRegistryManagedIdentityId);
            SetKnownParameterValue(r, AzureBicepResource.KnownParameters.PrincipalType, _ => "ServicePrincipal");
            SetKnownParameterValue(r, AzureBicepResource.KnownParameters.PrincipalName, _ => environment.PrincipalName);


It feels wrong that we still have PrincipalName on the environment. Shouldn't it be ContainerRegistryManagedIdentityPrincipalName?

I almost half wonder if we should no longer support these "KnownParameters" for PrincipalId, Type, and Name in ACA. Our Azure resources will never use them (or at least, if they do it is a mistake that needs to be fixed).

Separate change. Not in this PR, it's too big already 😄 . I agree.

src/Aspire.Hosting.Azure.Redis/AzureRedisCacheResource.cs

src/Aspire.Hosting.Azure.CosmosDB/AzureCosmosDBExtensions.cs

src/Aspire.Hosting.Azure.Redis/AzureRedisExtensions.cs

src/Aspire.Hosting.Azure/IKeyVaultResource.cs

src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultSecretReference.cs

tests/Aspire.Hosting.Azure.Tests/AzureRedisExtensionsTests.cs

src/Aspire.Hosting.Azure/Provisioning/Provisioners/BicepProvisioner.cs

eerhardt · 2025-03-24T19:27:21Z

We should open a breaking change issue in our docs for this.

Refactor Azure Key Vault integration to use a secret resolver function for runtime secret resolution

github-actions bot added the area-app-model Issues pertaining to the APIs in Aspire.Hosting, e.g. DistributedApplication label Mar 19, 2025

eerhardt reviewed Mar 19, 2025

View reviewed changes

src/Aspire.Hosting.Azure/IKeyVaultSecretReference.cs Show resolved Hide resolved

eerhardt mentioned this pull request Mar 20, 2025

Support CosmosDB and Redis role assignments on app specific managed identity #8140

Merged

7 tasks

davidfowl force-pushed the davidfowl/no-secret-outputs branch from 0d4156b to 94ceb65 Compare March 21, 2025 06:55

davidfowl force-pushed the davidfowl/no-secret-outputs branch from 94ceb65 to b66df54 Compare March 22, 2025 06:40

davidfowl added 5 commits March 21, 2025 23:42

Fix indentation in AzurePublisher for improved readability

79b8b2c

Refactor Azure resource identity handling and update connection strin…

bc7bd96

…g references in Bicep manifests

Remove key vault secret handling from AzureContainerAppEnvironmentRes…

6430593

…ource and related classes

Add Azure Key Vault resource identifier and secret client support

41abb08

Fix key vault output resolution and improve secret client initializat…

86afd2b

…ion in BicepProvisioner

davidfowl marked this pull request as ready for review March 22, 2025 09:08

davidfowl added 2 commits March 22, 2025 02:11

Remove unnecessary Aspire.Hosting.Azure.AppContainers reference from …

db2e2ff

…project file

Update exception message for unsupported key vault generation and adj…

345912b

…ust related comments

mitchdenny reviewed Mar 23, 2025

View reviewed changes

src/Aspire.Hosting.Azure/AzureResourcePreparer.cs Outdated Show resolved Hide resolved

mitchdenny reviewed Mar 23, 2025

View reviewed changes

src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResource.cs Outdated Show resolved Hide resolved

mitchdenny reviewed Mar 23, 2025

View reviewed changes

tests/Aspire.Hosting.Azure.Tests/AzureContainerAppsTests.cs Show resolved Hide resolved

mitchdenny reviewed Mar 23, 2025

View reviewed changes

davidfowl added 11 commits March 22, 2025 22:27

Add output for Key Vault ID in Bicep resource tests

fc6cd64

Refactor Azure Key Vault resource output references and improve inter…

edebd8c

…nal access to secrets and secret client

Add output for Key Vault ID in existing Azure resource tests

eb9824e

Refactor AzureKeyVaultResource to simplify output reference properties

1c408c0

Rename KeyVaultResource property to Resource for consistency across k…

9a74e0f

…ey vault references

Refactor Azure Key Vault resource tests to support dynamic Key Vault …

7309928

…names and improve authentication handling

Refactor connection string secret naming convention to use a consiste…

aac96ef

…nt prefix across Azure resources

Refactor connection string naming convention to use a consistent pref…

f1f0b99

…ix across Azure resources

Refactor IKeyVaultResource interface documentation for clarity and co…

cef5c65

…nsistency

Update manifests

2a9f630

Refactor Azure Container Apps identity configuration to use UserAssig…

f522f3d

…ned type