Configuration in Production

apiVersion: v1
kind: Secret
metadata:
  name: orders-api-secrets
type: Opaque
stringData:
  ConnectionStrings__Shop: "Host=orders-db;Database=shop;Username=orders_api;Password=<from-secret-store>"
  Payments__ApiKey: "<from-secret-store>"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: orders-api
  template:
    metadata:
      labels:
        app: orders-api
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1654
        fsGroup: 1654
      containers:
        - name: api
          image: registry.example.com/shop/orders-api:1.14.2
          env:
            - name: ASPNETCORE_ENVIRONMENT
              value: Production
            - name: Payments__Provider
              value: Adyen
          volumeMounts:
            - name: secrets
              mountPath: /run/secrets/orders-api
              readOnly: true
      volumes:
        - name: secrets
          secret:
            secretName: orders-api-secrets
            defaultMode: 0440

var builder = WebApplication.CreateBuilder(args);

// In production the store wraps your vault SDK client; the provider does not care which.
ISecretStore store = new EnvironmentFallbackSecretStore();
builder.Configuration.Sources.Add(new SecretStoreConfigurationSource(
    store, "orders-api/", refreshInterval: TimeSpan.FromMinutes(5), fetchTimeout: TimeSpan.FromSeconds(20)));

var app = builder.Build();
app.MapGet("/", () => "orders-api");
app.Run();

public interface ISecretStore
{
    Task<IReadOnlyDictionary<string, string>> GetSecretsAsync(string prefix, CancellationToken cancellationToken);
}

public sealed class EnvironmentFallbackSecretStore : ISecretStore
{
    public Task<IReadOnlyDictionary<string, string>> GetSecretsAsync(string prefix, CancellationToken cancellationToken) =>
        Task.FromResult<IReadOnlyDictionary<string, string>>(new Dictionary<string, string>
        {
            [prefix + "Payments--ApiKey"] = Environment.GetEnvironmentVariable("LOCAL_PAYMENTS_KEY") ?? ""
        });
}

public sealed class SecretStoreConfigurationSource(ISecretStore store, string prefix, TimeSpan refreshInterval, TimeSpan fetchTimeout)
    : IConfigurationSource
{
    public IConfigurationProvider Build(IConfigurationBuilder builder) =>
        new SecretStoreConfigurationProvider(store, prefix, refreshInterval, fetchTimeout);
}

public sealed class SecretStoreConfigurationProvider(ISecretStore store, string prefix, TimeSpan refreshInterval, TimeSpan fetchTimeout)
    : ConfigurationProvider, IDisposable
{
    private Timer? _timer;

    public override void Load()
    {
        // Start-up must see the secrets, so the first load blocks; refreshes run in the background.
        Data = FetchAsync().GetAwaiter().GetResult();
        _timer ??= new Timer(_ => _ = RefreshAsync(), null, refreshInterval, refreshInterval);
    }

    private async Task RefreshAsync()
    {
        try
        {
            var fresh = await FetchAsync();
            if (fresh.Count != Data.Count || fresh.Any(kv => !Data.TryGetValue(kv.Key, out var old) || old != kv.Value))
            {
                Data = fresh;
                OnReload();
            }
        }
        catch (Exception)
        {
            // Keep serving with the last good values; the next tick tries again.
        }
    }

    private async Task<IDictionary<string, string?>> FetchAsync()
    {
        // Bounded, so a hung vault fails start-up with a clear message instead of hanging until a probe kills the pod.
        using var timeout = new CancellationTokenSource(fetchTimeout);
        IReadOnlyDictionary<string, string> secrets;
        try
        {
            secrets = await store.GetSecretsAsync(prefix, timeout.Token);
        }
        catch (OperationCanceledException) when (timeout.IsCancellationRequested)
        {
            throw new TimeoutException($"Secret store did not return '{prefix}*' within {fetchTimeout.TotalSeconds}s.");
        }
        // Vault names cannot contain ':', so "orders-api/Payments--ApiKey" becomes "Payments:ApiKey".
        return secrets.ToDictionary(
            s => s.Key[prefix.Length..].Replace("--", ConfigurationPath.KeyDelimiter),
            s => (string?)s.Value,
            StringComparer.OrdinalIgnoreCase);
    }

    public void Dispose() => _timer?.Dispose();
}

using Xunit;

public class CommittedSettingsTests
{
    private static readonly string[] SecretWords = ["password", "apikey", "secret", "token", "connectionstring"];

    public static TheoryData<string> SettingsFiles()
    {
        var files = new TheoryData<string>();
        foreach (var path in Directory.EnumerateFiles(AppContext.BaseDirectory, "appsettings*.json"))
        {
            if (!path.EndsWith(".Development.json", StringComparison.OrdinalIgnoreCase))
            {
                files.Add(Path.GetFileName(path));
            }
        }
        return files;
    }

    [Theory]
    [MemberData(nameof(SettingsFiles))]
    public void Settings_files_hold_no_secret_values(string fileName)
    {
        var config = new ConfigurationBuilder()
            .AddJsonFile(Path.Combine(AppContext.BaseDirectory, fileName))
            .Build();

        var leaks = config.AsEnumerable()
            .Where(e => !string.IsNullOrEmpty(e.Value))
            .Where(e => SecretWords.Any(w => e.Key.Replace(":", "").Contains(w, StringComparison.OrdinalIgnoreCase)))
            .Where(e => e.Value != "<from-secret-store>")
            .Select(e => e.Key)
            .ToList();

        Assert.Empty(leaks);
    }
}