Add flexibility for versioned secrets to KeyPerFileConfigurationProvider/Source
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Is your feature request related to a problem? Please describe the problem.
I am trying to read versioned secrets that are created by the [Azure Key Vault CSI driver](https://github.com/Azure/secrets-store-csi-driver-provider-azure) but there is not enough extensibility to correctly map the secrets into my configuration.
Example: I have a certificate used for token encryption and decryption. The certificate is in the process of being rolled and so for a period of time I need both the current and the v-next version of the secret loaded into my configuration. The CSI driver creates files on disk in the following structure:
```
/mnt/secrets
/Service__SigningCertificates
/0
/1
```
where `0` and `1` are the two versions of the certificate. In my code I have an options object:
```csharp
{
class ServiceOptions
{
public IEnumerable SigningCertificates { get; set; }
}
}
```
The `KeyPerFileConfigurationProvider` ignores any directories, so I cannot point it at `/mnt/secrets` to get the certificates loaded. I know that I can add a [Composite File Provider](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.fileproviders.compositefileprovider) to add the subdirectory to the `KeyPerFileConfigurationProvider` but because it uses the file names as keys, I end up with configuration keys of `0` and `1` which are not usable.
### Describe the solution you'd like
A version of the `KeyPerFileConfigurationProvider` that understands the subdirectory format that the Key Vault secret store csi driver creates, or a version that exposes a callback so that I can override the configuration keys that the provider generates.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.