[Proposal] First party support for the Azure Key Vault Emulator
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Is your feature request related to a problem? Please describe the problem.
I'm the author of the [Azure Key Vault Emulator](https://github.com/james-gould/azure-keyvault-emulator) which has an [Aspire AppHost library](https://www.nuget.org/packages/AzureKeyVaultEmulator.Aspire.Hosting) to help override an existing KV and use the emulator. This prevents provisioning, but the exposed APIs on the `AzureKeyVaultResource` aren't suitable for overriding.
While it works currently, the [overriding functionality](https://github.com/james-gould/azure-keyvault-emulator/blob/9f9f151d0acbb6586c141e1759d83340e16aa590/src/AzureKeyVaultEmulator.Aspire.Hosting/KeyVaultEmulatorExtensions.cs#L86-L137) is rather clunky and brittle. The resource has no expectation of being *able to* be overridden (totally fair), meaning a series of workarounds have to be employed to get the Aspire SDK to play ball.
First party support/integration would mean doing away with some of the more unpredictable workarounds, such as the `vaultUri` [being unavailable](https://github.com/james-gould/azure-keyvault-emulator/issues/304) which I believe is partly related to the deprecation of the `BicepSecretOutputReference` in https://github.com/dotnet/aspire/issues/9614
### Describe the solution you'd like
- The ability to declare the `AzureKeyVaultResource` as overridable would be amazing, allowing the resource to delegate the `vaultUri` fulfillment to the Emulator and being able to use proper `HealthCheck` for standardisation.
- Either direct integration of the library to enable `.RunAsEmulator()` when installing the `Aspire.Hosting.Azure.KeyVault` integration package, or being able to host the client libraries underneath the `Aspire` reserved tag so they appear under the parent package in NuGet.
- An addition to the Aspire documentation, should the integration go ahead, detailing the usage. Happy to write this myself, [docs](https://github.com/james-gould/azure-keyvault-emulator/blob/master/docs/CONFIG.md) are available in the docs dir and [base README](https://github.com/james-gould/azure-keyvault-emulator/blob/master/README.md) to extrapolate from.
### Additional context
There are some notable requirements of the Emulator which may conflict with the values of Aspire:
- SSL certificates are required for the Azure Client SDK, so the `AzureKeyVaultEmulator.Aspire.Hosting` interacts with the host machine's disk to write and reuse `X509Certificate2` localhost certs [as you can see from this helper class](https://github.com/james-gould/azure-keyvault-emulator/blob/master/src/AzureKeyVaultEmulator.Aspire.Hosting/Helpers/KeyVaultEmulatorCertHelper.cs). I'm aware Aspire has done a lot of work for SSL parity between resources, this may be a viable path forward.
- The SSL installation is done to the `Personal` store in the `User Certificates`, identical to the `dotnet dev-certs` behaviour (including the popup prompt when first installing).
- The Emulator itself has first-class support for Aspire, but it isn't an Aspire project specifically. A large portion of users are integrating directly via Docker in a variety of languages and stacks, so the projects would need to remain as separate entities.
- This may prevent hooking into some of the nicer internal APIs Aspire has to offer around the orchastration of resources and emulators as a concept.
The project is currently [in seed phase with the .NET Foundation](https://github.com/dotnet-foundation/projects/issues/441) and I'm hopeful it will receive increased support during the next review round in ~3 months time (ish).
Contributor guide
Assessment
This issue has not been assessed yet.