Wallero.KeyVault 1.0.0

Wallero.KeyVault

Copyright

Copyright (c) Wallero Technologies (2025-present). All rights reserved.

A flexible Azure Key Vault integration package for Wallero Technologies applications, providing secure secret management with development fallback support.

Installation

Install the package via NuGet:

bash dotnet add package Wallero.KeyVault --version 1.0.0

Configuration

Configure settings in your appsettings.json and appsettings.Development.json:

appsettings.json

json { "WalleroConfiguration": { "LicenseKey": "Wallero-License-2025-Secure" }, "KeyVault": { "SharedVaultUri": "https://your-shared-keyvault.vault.azure.net/", "EnvironmentVaultUri": "https://your-{ASPNETCORE_ENVIRONMENT}-keyvault.vault.azure.net/", "TimeoutSeconds": 30 }, "EnvironmentSettings": { "ASPNETCORE_ENVIRONMENT": "{ASPNETCORE_ENVIRONMENT}", "IsLocalDevelopment": false, "AllowKeyVaultInLocal": false }, "AzureKeyVaultSettings": { "KeyVaultTenantId": "{KEY_VAULT_TENANT_ID}", "KeyVaultClientId": "{KEY_VAULT_CLIENT_ID}", "KeyVaultClientSecret": "{KEY_VAULT_CLIENT_SECRET}" } }

appsettings.Development.json

json { "WalleroConfiguration": { "LicenseKey": "Wallero-License-2025-Secure" }, "KeyVault": { "SharedVaultUri": "https://your-shared-keyvault.vault.azure.net/", "EnvironmentVaultUri": "https://your-{ASPNETCORE_ENVIRONMENT}-keyvault.vault.azure.net/", "TimeoutSeconds": 30 }, "EnvironmentSettings": { "ASPNETCORE_ENVIRONMENT": "{ASPNETCORE_ENVIRONMENT}", "IsLocalDevelopment": false, "AllowKeyVaultInLocal": false }, "AzureKeyVaultSettings": { "KeyVaultTenantId": "{KEY_VAULT_TENANT_ID}", "KeyVaultClientId": "{KEY_VAULT_CLIENT_ID}", "KeyVaultClientSecret": "{KEY_VAULT_CLIENT_SECRET}" } }

Setup

Add to your Program.cs:

csharp using Wallero.KeyVault.Extensions;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers(); builder.Services.AddHttpContextAccessor();

// Add Wallero Key Vault builder.Services.AddWalleroKeyVault(builder.Configuration);

// Register your secret mapping provider builder.Services.AddSecretMappingProvider<YourSecretConfiguration>();

// Register Secret Management Service for startup loading builder.Services.AddSingleton<ISecretManagementService, SecretManagementService>();

var app = builder.Build();

// Load secrets at startup await LoadSecretsAtStartup(app.Services);

app.UseHttpsRedirection(); app.MapControllers(); app.Run();

static async Task LoadSecretsAtStartup(IServiceProvider services) { using var scope = services.CreateScope(); var secretManagementService = scope.ServiceProvider.GetRequiredService<ISecretManagementService>(); await secretManagementService.LoadSecretsAsync(); }

Create Secret Configuration

Create a secret mapping provider:

csharp public class YourSecretConfiguration : ISecretMappingProvider { public IEnumerable<SecretRequest> GetSecretMappings() { return new[] { new SecretRequest { SecretName = "DatabaseConnectionString", UseSharedVault = false, // Environment-specific LocalFallbackKey = "ConnectionStrings:DefaultConnection", Description = "Database connection string for current environment" }, new SecretRequest { SecretName = "EncryptionKey", UseSharedVault = true, // Shared across environments LocalFallbackKey = "EncryptionSettings:EncryptionKey", Description = "Encryption key for data protection" } }; } }

Usage

Inject IKeyVaultService in your controllers or services:

csharp public class MyController : ControllerBase { private readonly IKeyVaultService keyVaultService;

public MyController(IKeyVaultService keyVaultService)
{
    this.keyVaultService = keyVaultService;
}

[HttpGet("secret/{name}")]
public async Task<IActionResult> GetSecret(string name)
{
    var secret = await keyVaultService.GetSecretAsync(name);
    return Ok(new { SecretName = name, HasValue = !string.IsNullOrEmpty(secret) });
}

}

Features

Azure Key Vault Integration: Secure access to Azure Key Vault secrets

Development Fallback: Automatic fallback to local configuration in development

Flexible Secret Mapping: Define secrets via provider pattern with local fallback keys

Credential Management: Automatic credential selection (DefaultAzureCredential vs ClientSecretCredential)

Startup Secret Loading: Pre-load secrets at application startup for better performance

Environment Support: Different handling for local development vs production environments

License Validation: Restricts usage to authorized Wallero applications

Environment Behavior

IsLocalDevelopment = true, AllowKeyVaultInLocal = false: Uses local configuration only

IsLocalDevelopment = true, AllowKeyVaultInLocal = true: Uses Key Vault with DefaultAzureCredential

IsLocalDevelopment = false: Uses Key Vault with ClientSecretCredential (production)

License

This project is licensed under the MIT License.

Contact

For support, contact Wallero Technologies at support@wallero.com