ND.FW.SecretManagement 1.0.2

ND.FW.SecretManagement

Azure Key Vault-backed configuration source for Novacis Digital services.

Resolves the Key Vault credential through ND.FW.ClientManagement (IClientManagement), so Key Vault access uses the correct credential for the environment — cloud vs. local dev — with no if/else credential logic in application code. Supports multiple named Key Vault sources per service (e.g. one vault for app secrets, another for a shared/tenant vault).

Install

dotnet add package ND.FW.SecretManagement

Depends on ND.FW.ClientManagement. NuGet restores it transitively — you don't need to install it separately, but you do need AddAzureClientManagement() registered (see below) for credential resolution to work.

Register

using ClientManagement.Implementations;
using SecretManagement.Extensions;

// 1. Register credential/client factory (from ND.FW.ClientManagement)
services.AddAzureClientManagement();

// 2. Register one or more named Key Vault secret sources
services.AddAzureKeyVaultSecretSource("primary", options =>
{
    options.KeyVaultName = "nd-prod-kv";           // resolves to https://nd-prod-kv.vault.azure.net/
    // — or — options.KeyVaultUri = "https://custom.vault.azure.net/";
    options.CredentialType = CredentialType.ManagedIdentity; // default
});

Wire into configuration

At startup, after the service provider is built, pull all registered secret sources into the configuration pipeline:

var app = builder.Build();

builder.Configuration.AddSecretSources(app.Services);

Each registered ISecretSource calls AddAzureKeyVault(...) on the IConfigurationBuilder, so secrets surface as ordinary configuration values (IConfiguration["MySecretName"]) alongside appsettings.json and environment variables.

Multiple named vaults

services.AddAzureKeyVaultSecretSource("app", o => o.KeyVaultName = "nd-app-kv");
services.AddAzureKeyVaultSecretSource("shared", o =>
{
    o.KeyVaultName = "nd-shared-kv";
    o.CredentialType = CredentialType.CommandLineInterface; // e.g. local dev override
});

Both are picked up automatically by AddSecretSources — no extra wiring per vault.

API

AddAzureKeyVaultSecretSource(name, configureOptions)

Registers a named ISecretSource backed by Azure Key Vault.

AddSecretSources(serviceProvider)

Extension on IConfigurationBuilder. Resolves all registered ISecretSource instances and adds each one to the configuration pipeline.

KeyVaultSecretSourceOptions

If neither KeyVaultUri nor KeyVaultName is set, the source is a no-op (AddSecrets returns without adding anything) rather than throwing — useful for environments where a given vault isn't configured.

Dependencies

• Microsoft.Extensions.Configuration 8.0.0
• ND.FW.ClientManagement (>= 1.0.0) — required. Must be published to the registry before this package.

Publish order

ND.FW.ClientManagement  →  ND.FW.SecretManagement