C# examples using pod identity

[zimmerab]

Anybody have any examples using pod identity for APIs to authenticate to key vault and app configuration?

[cramsey86]

Disclaimer: I am not a developer, this is code from a generic library we have.

        private static IConfigurationBuilder AddAzureAppConfiguration(this IConfigurationBuilder config, IConfigurationRoot settings, string serviceName, bool useTimerForRefresh = true)
        {
            var credentials = BuildCredentials(settings);

            config.AddAzureAppConfiguration(options =>
            {
                // This takes the place of the UserName of the user on the machine.
                var userName = settings[UserName];

                // Get the Contoso Environment Variable.  This should take the place of the ASPNETCORE_ENVIRONMENT environment variable.
                var environmentType = settings[EnvironmentType];

                // Get the specific environment (e.g Dev1, Qa5, Prod2)
                var environmentSpecific = settings[EnvironmentSpecific];

                // Get the the endpoint for AppConfiguration.
                var appConfigUrl = settings[AppConfigUrl];

                options.Connect(new Uri(appConfigUrl), credentials)
                    .Select(KeyFilter.Any, LabelFilter.Null)
                    .Select(KeyFilter.Any, environmentType)
                    .SelectIfExists(serviceName)
                    .SelectIfExists(environmentSpecific)
                    .SelectIfExists($"{environmentType}-{serviceName}", environmentType, serviceName)
                    .SelectIfExists($"{environmentSpecific}-{serviceName}", environmentSpecific, serviceName)
                    .SelectIfExists($"Local-{userName}", userName)
                    .ConfigureRefresh(refresh =>
                    {
                        // This will register _only_ label-less Settings:Sentinel key-values.
                        // Only one label can be registered for a Settings:Sentinel key-value.
                        // Previously, we tried an order-of-precendence pattern,
                        // but that lead to only the _last_ registered label being registered.
                        // Teams should be only be using a label-less Settings:Sentinel key-value in their App Config instances.
                        refresh.Register("Settings:Sentinel", refreshAll: true);
                    })
                    .UseFeatureFlags(featureFlagOptions =>
                    {
                        featureFlagOptions.CacheExpirationInterval = TimeSpan.FromSeconds(30);

                        // Pull feature flags for the specific environment so a feature can be off in Dev1 and on in Dev2
                        featureFlagOptions.Label = environmentSpecific;
                    })
                    .ConfigureKeyVault(kv => kv.SetCredential(credentials));

                // This ensures that references to the configuration are updated regularly in combination with the
                //  sentinel values, in user code.  (To clarify, sentinel values must be updated in AppConfiguration, not user code.)
                //  The exact same mechanics affect feature flag functionality as well.
                if (useTimerForRefresh)
                {
                    _refresher = options.GetRefresher();

                    _timer = new Timer(_ =>
                    {
                        _refresher.TryRefreshAsync();
                    }, null, TimeSpan.FromSeconds(0), TimeSpan.FromSeconds(30));
                }
            });

            return config;
        }

        private static TokenCredential BuildCredentials(IConfigurationRoot settings)
        {
            // Get the environment variables needed for secrets.  If they don't exist, try the settings, which should
            //  be pulling them from the application's config file.

            var credentialCandidates = new List<TokenCredential>();

            var managedIdentityClientId = settings[ManagedIdentityClientId];
            credentialCandidates.Add(new ManagedIdentityCredential(managedIdentityClientId, null));

           // Other Credentials for the Chain

            var credentials = new ChainedTokenCredential(credentialCandidates.ToArray());

            return credentials;
        }