dotnet / dotnet/aspnetcore

Add flexibility for versioned secrets to KeyPerFileConfigurationProvider/Source

Open
#59,464 0 comments 0 reactions 0 assignees View on GitHub
area-networking
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I am trying to read versioned secrets that are created by the [Azure Key Vault CSI driver](https://github.com/Azure/secrets-store-csi-driver-provider-azure) but there is not enough extensibility to correctly map the secrets into my configuration.

Example: I have a certificate used for token encryption and decryption. The certificate is in the process of being rolled and so for a period of time I need both the current and the v-next version of the secret loaded into my configuration. The CSI driver creates files on disk in the following structure:

```
/mnt/secrets
/Service__SigningCertificates
/0
/1
```
where `0` and `1` are the two versions of the certificate. In my code I have an options object:
```csharp
{
class ServiceOptions
{
public IEnumerable SigningCertificates { get; set; }
}
}
```

The `KeyPerFileConfigurationProvider` ignores any directories, so I cannot point it at `/mnt/secrets` to get the certificates loaded. I know that I can add a [Composite File Provider](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.fileproviders.compositefileprovider) to add the subdirectory to the `KeyPerFileConfigurationProvider` but because it uses the file names as keys, I end up with configuration keys of `0` and `1` which are not usable.

### Describe the solution you'd like

A version of the `KeyPerFileConfigurationProvider` that understands the subdirectory format that the Key Vault secret store csi driver creates, or a version that exposes a callback so that I can override the configuration keys that the provider generates.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.