PollyAzureKeyVault 1.0.0

PollyAzureKeyVault

Polly v8 resilience for Azure.Security.KeyVault.Secrets — add retry, timeout, and circuit-breaker to any Azure Key Vault operation in two lines.

var secretClient = new SecretClient(new Uri("https://my-vault.vault.azure.net/"), credential);

var resilient = secretClient.WithPolly(pipeline => pipeline
    .AddRetry(new RetryStrategyOptions
    {
        MaxRetryAttempts = 3,
        Delay = TimeSpan.FromSeconds(2),
        BackoffType = DelayBackoffType.Exponential,
        UseJitter = true,
        ShouldHandle = KeyVaultTransientErrors.IsTransient,
    })
    .AddTimeout(TimeSpan.FromSeconds(10)));

var secret = await resilient.GetSecretAsync("my-secret");

Why PollyAzureKeyVault?

Azure Key Vault is a hard dependency for most production apps — connection failures at startup or runtime cause outages. This library adds Polly v8 resilience without boilerplate:

Installation

dotnet add package PollyAzureKeyVault
dotnet add package Polly.Core

Quick-start

1. Manual wiring

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Polly;
using Polly.Retry;

var credential = new DefaultAzureCredential();
var client = new SecretClient(new Uri("https://my-vault.vault.azure.net/"), credential);

var resilient = client.WithPolly(p => p
    .AddRetry(new RetryStrategyOptions
    {
        MaxRetryAttempts = 3,
        Delay = TimeSpan.FromSeconds(2),
        BackoffType = DelayBackoffType.Exponential,
        UseJitter = true,
        ShouldHandle = KeyVaultTransientErrors.IsTransient,
    }));

// Typed convenience methods
var secret = await resilient.GetSecretAsync("connection-string");
Console.WriteLine(secret.Value.Value);

2. Dependency injection

// Program.cs / Startup.cs
builder.Services.AddSingleton(new SecretClient(
    new Uri("https://my-vault.vault.azure.net/"),
    new DefaultAzureCredential()));

builder.Services.AddPollyAzureKeyVault(pipeline => pipeline
    .AddRetry(new RetryStrategyOptions
    {
        MaxRetryAttempts = 3,
        Delay = TimeSpan.FromSeconds(2),
        BackoffType = DelayBackoffType.Exponential,
        UseJitter = true,
        ShouldHandle = KeyVaultTransientErrors.IsTransient,
    })
    .AddTimeout(TimeSpan.FromSeconds(10)));

// Inject ResilientSecretClient into your services
public class SecretsService(ResilientSecretClient client)
{
    public async Task<string> GetConnectionStringAsync(CancellationToken ct) =>
        (await client.GetSecretAsync("db-connection-string", cancellationToken: ct)).Value.Value;
}

3. With a URI shortcut (registers SecretClient automatically)

builder.Services.AddPollyAzureKeyVault(
    new Uri("https://my-vault.vault.azure.net/"),
    pipeline => pipeline
        .AddRetry(new RetryStrategyOptions
        {
            MaxRetryAttempts = 5,
            ShouldHandle = KeyVaultTransientErrors.IsTransient,
        }));

Transient error reference

// Use in any Polly strategy:
ShouldHandle = KeyVaultTransientErrors.IsTransient

Handling only 429s with a longer back-off

.AddRetry(new RetryStrategyOptions
{
    ShouldHandle = new PredicateBuilder()
        .Handle<RequestFailedException>(ex => ex.Status == 429),
    MaxRetryAttempts = 5,
    Delay = TimeSpan.FromSeconds(10),
    BackoffType = DelayBackoffType.Exponential,
})

Advanced pipelines

Full production pipeline

client.WithPolly(p => p
    .AddTimeout(TimeSpan.FromSeconds(30))
    .AddRetry(new RetryStrategyOptions
    {
        MaxRetryAttempts = 4,
        Delay = TimeSpan.FromSeconds(2),
        BackoffType = DelayBackoffType.Exponential,
        UseJitter = true,
        ShouldHandle = KeyVaultTransientErrors.IsTransient,
        OnRetry = args =>
        {
            logger.LogWarning("Key Vault retry {Attempt} — {Exception}",
                args.AttemptNumber, args.Outcome.Exception?.Message);
            return ValueTask.CompletedTask;
        },
    })
    .AddCircuitBreaker(new CircuitBreakerStrategyOptions
    {
        FailureRatio = 0.5,
        SamplingDuration = TimeSpan.FromSeconds(30),
        MinimumThroughput = 5,
        BreakDuration = TimeSpan.FromSeconds(30),
        ShouldHandle = KeyVaultTransientErrors.IsTransient,
    }));

Arbitrary operations via ExecuteAsync

// Use ExecuteAsync<T> for any SecretClient method not covered by typed overloads
var props = await resilient.ExecuteAsync(
    (c, ct) => c.GetDeletedSecretAsync("old-secret", ct));

API reference

ResilientSecretClient

KeyVaultTransientErrors

Extension methods

DI extensions

Target frameworks

Related packages

License

MIT © Justin Bannister