1// .NET 8 — Zero-secret config with Key Vault + Managed Identity
2// Program.cs
3var builder = WebApplication.CreateBuilder(args);
4
5// DefaultAzureCredential tries, in order:
6// 1. Environment variables, 2. Workload Identity, 3. Managed Identity,
7// 4. Visual Studio, 5. Azure CLI, 6. Azure PowerShell, 7. Interactive
8var credential = new DefaultAzureCredential();
9
10// Add Key Vault as a configuration provider
11builder.Configuration.AddAzureKeyVault(
12    new Uri(builder.Configuration["KeyVault:VaultUri"]!),
13    credential
14);
15
16// SecretClient for imperative access
17builder.Services.AddSingleton(_ =>
18    new SecretClient(new Uri(builder.Configuration["KeyVault:VaultUri"]!), credential));
19
20var app = builder.Build();
21
22// -----------------------------------------------
23// Fetching a secret imperatively (with caching)
24// -----------------------------------------------
25public class SecretService
26{
27    private readonly SecretClient _client;
28    private readonly IMemoryCache _cache;
29
30    public async Task<string> GetSecretAsync(string name)
31    {
32        // Cache for 5 minutes — balance freshness vs rate limits (5 RPS per secret)
33        return await _cache.GetOrCreateAsync($"secret:{name}", async entry =>
34        {
35            entry.AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5);
36            var secret = await _client.GetSecretAsync(name);
37            return secret.Value.Value;
38        });
39    }
40}
41
42// -----------------------------------------------
43// App Service config reference (NO code needed!)
44// -----------------------------------------------
45// In App Service Application Settings, add:
46// Name:  ConnectionStrings__Sql
47// Value: @Microsoft.KeyVault(SecretUri=https://contoso-prod.vault.azure.net/secrets/sql-connstr/)
48//
49// App Service resolves this at runtime using its managed identity.
50// The secret value appears as a regular config value to your app.