Cirreum.Secrets.Azure 2.0.0

Cirreum.Secrets.Azure

Azure Key Vault secrets provider for the Cirreum Foundation Framework

Overview

Cirreum.Secrets.Azure provides seamless integration between Azure Key Vault and the Cirreum secrets provider framework, enabling secure configuration management for .NET applications.

This package implements the SecretsProviderRegistrar pattern to automatically configure Azure Key Vault as a secrets source, with built-in support for Azure Identity authentication and flexible configuration options.

Key Features

• Seamless Integration: Drop-in Azure Key Vault support for Cirreum-based applications
• Azure Identity: the nested Credential block selects DefaultAzureCredential, a deterministic ManagedIdentityCredential, or developer tooling credentials, with optional tenant-specific authentication
• Flexible Configuration: Two-tier settings model for provider and instance-level configuration
• Activity Tracing: Built-in support for distributed tracing with Azure SDK telemetry
• Production Ready: Follows Microsoft.Extensions.* patterns and conventions

Usage

// Register Azure Key Vault as a secrets provider
services.AddSecretsProvider<AzureKeyVaultRegistrar>(configuration =>
{
    configuration.Configure<AzureKeyVaultSettings>(settings =>
    {
        settings.Instances.Add(new AzureKeyVaultInstanceSettings
        {
            Endpoint = "https://your-vault.vault.azure.net/",
            Identifier = "your-tenant-id" // Optional
        });
    });
});

Credential Modes

The nested Credential block (shared across Cirreum providers) selects how the instance authenticates:

settings.Instances.Add(new AzureKeyVaultInstanceSettings
{
    Endpoint = "https://your-vault.vault.azure.net/",
    Credential = new()
    {
        Mode = CredentialMode.ManagedIdentity,
        IdentityId = "<user-assigned-client-id>" // Optional; omit for system-assigned
    }
});

"Instances": {
  "default": {
    "Endpoint": "https://your-vault.vault.azure.net/",
    "Credential": { "Mode": "ManagedIdentity", "IdentityId": "<user-assigned-client-id>" }
  }
}

IdentityId selects a user-assigned managed identity: under ManagedIdentity it picks the identity directly, and under Default it pins the chain's managed-identity leg. It is ignored by Developer.

Identifier sets the tenant ID and applies to Default and Developer. It has no effect under ManagedIdentity, since a managed identity's tenant is implicit to the resource it's attached to.

Configuration

The provider supports hierarchical configuration through:

• AzureKeyVaultSettings: Provider-level settings
• AzureKeyVaultInstanceSettings: Individual Key Vault instance settings. Set Endpoint to the vault's URI (appears as "DNS Name" in the Azure portal) — it's parsed into the vault URI used by the underlying SecretClient internally.

Contribution Guidelines

1. Be conservative with new abstractions
   The API surface must remain stable and meaningful.

2. Limit dependency expansion
   Only add foundational, version-stable dependencies.

3. Favor additive, non-breaking changes
   Breaking changes ripple through the entire ecosystem.

4. Include thorough unit tests
   All primitives and patterns should be independently testable.

5. Document architectural decisions
   Context and reasoning should be clear for future maintainers.

6. Follow .NET conventions
   Use established patterns from Microsoft.Extensions.* libraries.

Versioning

Cirreum.Secrets.Azure follows Semantic Versioning:

• Major - Breaking API changes
• Minor - New features, backward compatible
• Patch - Bug fixes, backward compatible

License

This project is licensed under the MIT License - see the LICENSE file for details.

Cirreum Foundation Framework
Layered simplicity for modern .NET