Azure Key Vault Health check package and Unit tests project #19
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| using Microsoft.Azure.KeyVault; | ||
| using Microsoft.Extensions.Diagnostics.HealthChecks; | ||
| using Microsoft.IdentityModel.Clients.ActiveDirectory; | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Net.Http; | ||
| using System.Text; | ||
| using System.Threading; | ||
| using System.Threading.Tasks; | ||
|
|
||
| namespace HealthChecks.AzureKeyVault | ||
| { | ||
| public class AzureKeyVaultHealthCheck : IHealthCheck | ||
| { | ||
| private readonly AzureKeyVaultOptions _keyVaultOptions; | ||
|
|
||
| public AzureKeyVaultHealthCheck(AzureKeyVaultOptions keyVaultOptions) | ||
| { | ||
| if (string.IsNullOrEmpty(keyVaultOptions.KeyVaultUrlBase)) throw new ArgumentNullException(keyVaultOptions.KeyVaultUrlBase); | ||
|
|
||
| if (string.IsNullOrEmpty(keyVaultOptions.ClientId)) throw new ArgumentNullException(keyVaultOptions.ClientId); | ||
| if (string.IsNullOrEmpty(keyVaultOptions.ClientSecret)) throw new ArgumentNullException(keyVaultOptions.ClientSecret); | ||
|
|
||
| _keyVaultOptions = keyVaultOptions; | ||
| } | ||
| public async Task<HealthCheckResult> CheckHealthAsync(HealthCheckContext context, CancellationToken cancellationToken = default) | ||
| { | ||
| string currentSecret = string.Empty; | ||
|
|
||
|
|
||
| try | ||
| { | ||
| var client = new KeyVaultClient(GetToken); | ||
| foreach (var secretIdentifier in _keyVaultOptions.Secrets) | ||
| { | ||
| currentSecret = secretIdentifier; | ||
| await client.GetSecretAsync(_keyVaultOptions.KeyVaultUrlBase, secretIdentifier, cancellationToken); | ||
| } | ||
|
|
||
| return HealthCheckResult.Healthy(); | ||
|
|
||
|
|
||
| } | ||
| catch (Exception ex) | ||
| { | ||
| var secretException = new Exception($"{currentSecret} secret error - {ex.Message}", ex); | ||
| return new HealthCheckResult(context.Registration.FailureStatus, exception: secretException); | ||
| } | ||
| } | ||
|
|
||
|
|
||
| public async Task<string> GetToken(string authority, string resource, string scope) | ||
|
There was a problem hiding this comment. what about Azure MSI? For Azure hosted applications KeyVaultClient can be created with AzureServiceTokenProvider and you don't need get token or specify clientId and client secret. Add support for Azure MSI var azureServiceTokenProvider = new AzureServiceTokenProvider(); |
||
| { | ||
| var authContext = new AuthenticationContext(authority); | ||
| ClientCredential clientCred = new ClientCredential(_keyVaultOptions.ClientId, _keyVaultOptions.ClientSecret); | ||
| AuthenticationResult result = await authContext.AcquireTokenAsync(resource, clientCred); | ||
|
|
||
| if (result == null) | ||
| throw new InvalidOperationException($"[{nameof(AzureKeyVaultHealthCheck)}] - Failed to obtain the JWT token"); | ||
|
|
||
| return result.AccessToken; | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Text; | ||
|
|
||
| namespace HealthChecks.AzureKeyVault | ||
| { | ||
| public class AzureKeyVaultOptions | ||
| { | ||
| internal List<string> Secrets { get; } = new List<string>(); | ||
| /// <summary> | ||
| /// Azure Key Vault base url - https://[vaultname].vault.azure.net/ | ||
| /// </summary> | ||
| public string KeyVaultUrlBase { get; set; } | ||
| /// <summary> | ||
| /// Registered application Id | ||
| /// </summary> | ||
| public string ClientId { get; set; } | ||
| /// <summary> | ||
| /// Registered application secret | ||
| /// </summary> | ||
| public string ClientSecret { get; set; } | ||
|
|
||
| /// <summary> | ||
| /// Add a Azure Key Vault secret to be checked | ||
| /// </summary> | ||
| /// <param name="secretIdentifier"></param> | ||
| /// <returns></returns> | ||
| public AzureKeyVaultOptions AddSecret(string secretIdentifier) | ||
| { | ||
| if(!Secrets.Contains(secretIdentifier)) | ||
| { | ||
| Secrets.Add(secretIdentifier); | ||
| } | ||
|
|
||
| return this; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| using HealthChecks.AzureKeyVault; | ||
| using Microsoft.Extensions.DependencyInjection; | ||
| using Microsoft.Extensions.Diagnostics.HealthChecks; | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Text; | ||
|
|
||
| namespace Microsoft.Extensions.DependencyInjection | ||
| { | ||
| public static class AzureKeyVaultHealthChecksBuilderExtensions | ||
| { | ||
| /// <summary> | ||
| /// Add a health check for Azure Key Vault | ||
| /// </summary> | ||
| /// <param name="builder">The <see cref="IHealthChecksBuilder"/>.</param> | ||
| /// <param name="setup"> Setup action to configure Azure Key Vault options </param> | ||
| /// <param name="name">The health check name. Optional. If <c>null</c> the type name 'dynamodb' will be used for the name.</param> | ||
| /// <param name="failureStatus"> | ||
| /// The <see cref="HealthStatus"/> that should be reported when the health check fails. Optional. If <c>null</c> then | ||
| /// the default status of <see cref="HealthStatus.Unhealthy"/> will be reported. | ||
| /// </param> | ||
| /// <param name="tags">A list of tags that can be used to filter sets of health checks. Optional.</param> | ||
| /// <returns>The <see cref="IHealthChecksBuilder"/>.</returns></param> | ||
| public static IHealthChecksBuilder AddAzureKeyVault(this IHealthChecksBuilder builder, Action<AzureKeyVaultOptions> setup, | ||
| string name = default, HealthStatus? failureStatus = default, IEnumerable<string> tags = default) | ||
| { | ||
| var azureKeyVaultOptions = new AzureKeyVaultOptions(); | ||
|
|
||
|
|
||
| setup?.Invoke(azureKeyVaultOptions); | ||
|
|
||
| return builder.Add(new HealthCheckRegistration( | ||
| name ?? "azurekeyvault", | ||
| sp => new AzureKeyVaultHealthCheck(azureKeyVaultOptions), | ||
| failureStatus, | ||
| tags)); | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
| <PropertyGroup> | ||
| <TargetFramework>$(NetStandardTargetVersion)</TargetFramework> | ||
| <PackageLicenseUrl>$(PackageLicenseUrl)</PackageLicenseUrl> | ||
| <PackageProjectUrl>$(PackageProjectUrl)</PackageProjectUrl> | ||
| <PackageTags>HealthCheck;Azure Key Vault;Secrets</PackageTags> | ||
| <Description>HealthChecks.AzureKeyVault is the health check package for Azure Key Vault secrets</Description> | ||
| <Version>$(HealthCheckKeyVault)</Version> | ||
| <RepositoryUrl>$(RepositoryUrl)</RepositoryUrl> | ||
| <Company>$(Company)</Company> | ||
| <Authors>$(Authors)</Authors> | ||
| <LangVersion>latest</LangVersion> | ||
| <PackageId>AspNetCore.HealthChecks.AzureKeyVault</PackageId> | ||
| <PublishRepositoryUrl>$(PublishRepositoryUrl)</PublishRepositoryUrl> | ||
| <AllowedOutputExtensionsInPackageBuildOutputFolder>$(AllowedOutputExtensionsInPackageBuildOutputFolder)</AllowedOutputExtensionsInPackageBuildOutputFolder> | ||
| </PropertyGroup> | ||
| <ItemGroup> | ||
| <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="$(MicrosoftExtensionsDiagnosticsHealthChecks)" /> | ||
| <PackageReference Include="Microsoft.Azure.KeyVault" Version="$(MicrosoftAzureKeyVault)" /> | ||
| <PackageReference Include="Microsoft.IdentityModel.Clients.ActiveDirectory" Version="$(MicrosoftIdentityModelClientsActiveDirectory)" /> | ||
| <PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0-beta-63127-02"> | ||
| <PrivateAssets>all</PrivateAssets> | ||
| <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets> | ||
| </PackageReference> | ||
| </ItemGroup> | ||
| </Project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why a new version on service bus
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because health checks contructor validations changed. It does not make sense to check only for null and not for empty string when initializing configuration towards an azure service