microsoft / microsoft/aspire

Implementors of `IResourceWithAzureFunctionsConfig` should set additional params for identity-based configuration.

Open
#8,116 9 comments 0 reactions 0 assignees View on GitHub
area-integrations azure-functions
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Aspire will set `AZURE_CLIENT_ID` to inform connections of the client ID to use. When exploring scale rules setup for Azure Functions, it appears that KEDA is one example of a component that doesn't process `AZURE_CLIENT_ID` yet.

### Describe the solution you'd like

Functions also offers a combination of two other parameters, and this is the typical recommendation for setting up connections with a user-assigned identity: `__credential` (always set to "managedidentity") and `__clientId` (set to the client ID). These are documented [here](https://learn.microsoft.com/azure/azure-functions/functions-reference?pivots=programming-language-csharp#common-properties-for-identity-based-connections).

This combination of settings should be valid for all existing implementers of `IResourceWithAzureFunctionsConfig`, but this should be approached on a case-by-case basis.

There's a bit of repetition and verbosity here, but it ensures the components will work as expected. Longer-term, KEDA could be updated to process `AZURE_CLIENT_ID`, and we could explore removing some of the repetition if needed.

### Additional context

Triggers and bindings will _mostly_ be set up to consume `AZURE_CLIENT_ID`, but there may be some variance in the overall config approach. Ensuring we capture a complete setup within each `IResourceWithAzureFunctionsConfig` will improve resilience to this.

This would also be preferable if there were to be support for multiple identities in the distributed application.

Note that these settings should be set together. Setting only one will not have the desired effect. Today, the integration uses `DefaultAzureCredential`, which during probing picks up `AZURE_CLIENT_ID` to use for MI. Just setting the connection-level client ID would be ignored. By setting the credential property, though, we force the system to instead use `ManagedIdentityCredential`, and without the client ID setting, it would just attempt to resolve a system-assigned managed identity, which would not exist in normal Aspire configurations.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.