Auto-Reload secrets from Key Vault

[avanigupta]

Overview

This PR introduces two new APIs which allow users to opt-in for periodically reloading secrets and certificates from Key Vault:

Set refresh interval for individual keys of Key Vault references in App Config:

AzureAppConfigurationKeyVaultOptions SetSecretRefreshInterval(string secretReferenceKey, TimeSpan refreshInterval)

This method allows users to set a refresh interval per key of Key Vault references. The API can be called multiple times to register multiple keys of Key Vault references for refresh.

Set refresh interval for all Key Vault references in App Config:

AzureAppConfigurationKeyVaultOptions SetSecretRefreshInterval(TimeSpan refreshInterval)

This method allows users to set a refresh interval for all Key Vault references which do not have individual refresh intervals.

Usage example:

If your App Configuration has the following Key Vault references:

Key	Value
KeyVaultRef1	{"uri":"https://abc.vault.azure.net/secrets/Secret1"}
KeyVaultRef2	{"uri":"https://xyz.vault.azure.net/secrets/Secret2"}
KeyVaultRef3	{"uri":"https://abc.vault.azure.net/secrets/Secret3"}
KeyVaultRef4	{"uri":"https://abc.vault.azure.net/secrets/Secret4"}

You can set different refresh intervals for any/all of your secret references:

var builder = new ConfigurationBuilder();
builder.AddAzureAppConfiguration(options =>
{
  options.Connect(connectionString)
         .Select("KeyVaultRef*")
         .ConfigureRefresh(refreshOptions =>
          {
            refreshOptions.Register("Sentinel", true);
            refreshOptions.SetCacheExpiration(TimeSpan.FromMinutes(1));
          })
         .ConfigureKeyVault(kvOptions =>
		{
		    kvOptions.SetSecretRefreshInterval("KeyVaultRef1", TimeSpan.FromHours(24)); // Secret1 will be reloaded from Key Vault every 24 hours

			kvOptions.SetSecretRefreshInterval("KeyVaultRef2", TimeSpan.FromHours(12)); // Secret2 will be reloaded from Key Vault every 12 hours

			kvOptions.SetSecretRefreshInterval(TimeSpan.FromDays(2)); // Secret3 and Secret4 will be reloaded from Key Vault every 2 days
		});
});

Notes:

• SetSecretRefreshInterval does not monitor the value of a key in App Config. For monitoring the value in AppConfig, use the ConfigureRefresh API to register keys for refresh.
• The frequency of reloading secrets from Key Vault should be chosen appropriately based on your needs. If the refresh interval is too low, there is a risk of being throttled by Key Vault.
• If SetSecretRefreshInterval is not invoked, secrets will not be automatically reloaded from Key Vault. In this case, secrets would be reloaded only if any of the following occur:
  • App restarts;
  • Sentinel key registered for refresh changes in App Config and triggeres a refresh of entire configuration; or
  • A Key Vault reference is registered for refresh using ConfigureRefresh API, and the reference value changes in App Config.
• Any refresh operation triggered using IConfigurationRefresher will not update the value for a Key Vault secret until the cached value for that secret has expired.

Fix #248 and #142.