Add flexibility for versioned secrets to KeyPerFileConfigurationProvider/Source

[msft-mw]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

I am trying to read versioned secrets that are created by the Azure Key Vault CSI driver but there is not enough extensibility to correctly map the secrets into my configuration.

Example: I have a certificate used for token encryption and decryption. The certificate is in the process of being rolled and so for a period of time I need both the current and the v-next version of the secret loaded into my configuration. The CSI driver creates files on disk in the following structure:

/mnt/secrets
      /Service__SigningCertificates
          /0
          /1

where 0 and 1 are the two versions of the certificate. In my code I have an options object:

{
    class ServiceOptions
    {
        public IEnumerable<string> SigningCertificates { get; set; }
    }
}

The KeyPerFileConfigurationProvider ignores any directories, so I cannot point it at /mnt/secrets to get the certificates loaded. I know that I can add a Composite File Provider to add the subdirectory to the KeyPerFileConfigurationProvider but because it uses the file names as keys, I end up with configuration keys of 0 and 1 which are not usable.

Describe the solution you'd like

A version of the KeyPerFileConfigurationProvider that understands the subdirectory format that the Key Vault secret store csi driver creates, or a version that exposes a callback so that I can override the configuration keys that the provider generates.

Additional context

No response