microsoft / microsoft/aspire

[Proposal] First party support for the Azure Key Vault Emulator

Open
#10,758 11 comments 5 reactions 0 assignees View on GitHub
area-integrations azure-keyvault
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I'm the author of the [Azure Key Vault Emulator](https://github.com/james-gould/azure-keyvault-emulator) which has an [Aspire AppHost library](https://www.nuget.org/packages/AzureKeyVaultEmulator.Aspire.Hosting) to help override an existing KV and use the emulator. This prevents provisioning, but the exposed APIs on the `AzureKeyVaultResource` aren't suitable for overriding.

While it works currently, the [overriding functionality](https://github.com/james-gould/azure-keyvault-emulator/blob/9f9f151d0acbb6586c141e1759d83340e16aa590/src/AzureKeyVaultEmulator.Aspire.Hosting/KeyVaultEmulatorExtensions.cs#L86-L137) is rather clunky and brittle. The resource has no expectation of being *able to* be overridden (totally fair), meaning a series of workarounds have to be employed to get the Aspire SDK to play ball.

First party support/integration would mean doing away with some of the more unpredictable workarounds, such as the `vaultUri` [being unavailable](https://github.com/james-gould/azure-keyvault-emulator/issues/304) which I believe is partly related to the deprecation of the `BicepSecretOutputReference` in https://github.com/dotnet/aspire/issues/9614

### Describe the solution you'd like

- The ability to declare the `AzureKeyVaultResource` as overridable would be amazing, allowing the resource to delegate the `vaultUri` fulfillment to the Emulator and being able to use proper `HealthCheck` for standardisation.

- Either direct integration of the library to enable `.RunAsEmulator()` when installing the `Aspire.Hosting.Azure.KeyVault` integration package, or being able to host the client libraries underneath the `Aspire` reserved tag so they appear under the parent package in NuGet.

- An addition to the Aspire documentation, should the integration go ahead, detailing the usage. Happy to write this myself, [docs](https://github.com/james-gould/azure-keyvault-emulator/blob/master/docs/CONFIG.md) are available in the docs dir and [base README](https://github.com/james-gould/azure-keyvault-emulator/blob/master/README.md) to extrapolate from.

### Additional context

There are some notable requirements of the Emulator which may conflict with the values of Aspire:

- SSL certificates are required for the Azure Client SDK, so the `AzureKeyVaultEmulator.Aspire.Hosting` interacts with the host machine's disk to write and reuse `X509Certificate2` localhost certs [as you can see from this helper class](https://github.com/james-gould/azure-keyvault-emulator/blob/master/src/AzureKeyVaultEmulator.Aspire.Hosting/Helpers/KeyVaultEmulatorCertHelper.cs). I'm aware Aspire has done a lot of work for SSL parity between resources, this may be a viable path forward.
- The SSL installation is done to the `Personal` store in the `User Certificates`, identical to the `dotnet dev-certs` behaviour (including the popup prompt when first installing).

- The Emulator itself has first-class support for Aspire, but it isn't an Aspire project specifically. A large portion of users are integrating directly via Docker in a variety of languages and stacks, so the projects would need to remain as separate entities.
- This may prevent hooking into some of the nicer internal APIs Aspire has to offer around the orchastration of resources and emulators as a concept.

The project is currently [in seed phase with the .NET Foundation](https://github.com/dotnet-foundation/projects/issues/441) and I'm hopeful it will receive increased support during the next review round in ~3 months time (ish).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.