Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor!: parser, credentials and secret handling #30

Merged
merged 58 commits into from
Sep 14, 2023

Conversation

KarlGW
Copy link
Owner

@KarlGW KarlGW commented Sep 14, 2023

This pull request contains major changes on the layout of the entire module.

  • Credential handling for service principals and managed identities have been built-in into the module
  • Secret retreival have been built-in into the module

This to remove a lot of dependencies that might not be desired (azcore, azidentity and azsecrets) and make the module more self-contained. To those who wants to reuse credentials (minimizing calls for tokens, have the same credentials across the whole application) retreived with the help of azidentity can still do so with the submodule authopts which provides the option function WithTokenCredential().

The built-in credential handling has some limitiations in regards to client credentials (service principal) and managed identities. As for now it only supports client secret and not certificate or assertion. The supported managed identitiy platforms is those based on IMDS(Azure VMs, Container Instances etc) and app service (including container apps). For now a user of the module will have to use authopts and TokenCredential retreived from azidentity to those scenarios.

Since the removal of the dependency azidentity and DefaultAzureCredential an update to the configuration environment variables have been done. This to yet further the module as self-contained, and to not overlap configuration of this is not desired.

The new environment variables are:

Service Principal

  • AZCFG_KEYVAULT_NAME - Name of the Azure Key Vault.
  • AZCFG_TENANT_ID - Tenant ID of the service principal/application registration.
  • AZCFG_CLIENT_ID - Client ID (also called Application ID) of the service principal/application registration.
  • AZCFG_CLIENT_SECRET- Client Secret of the service principal/application registration.

Managed identity

  • AZCFG_KEYVAULT_NAME - Name of the Azure Key Vault.
  • AZCFG_CLIENT_ID - (Optional) Client ID (also called Application ID) of the Managed Identity. Set if using a user assigned managed identity.

Note that the various environment variable names that can be used for the key vault name has been narrowed down to one.

Furthermore the entire model of how options have been updated to the function options pattern. More details can be gleaned from the README.md file.

Additionally a lot of cleanup of the internal workings have been done and a lot of less good design decisions have been addressed. No more package level variables to configure, instead these are always passed as options to the Parse function, or when createing a new parser.

Resolves #28 and resolves #29.

@KarlGW KarlGW merged commit be4ce36 into main Sep 14, 2023
3 checks passed
@KarlGW KarlGW deleted the refactor/credentials-and-secrets branch September 14, 2023 21:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant