Add Azure Keyvault as Supported Secret Backend about nautobot-app-secrets-providers

[kingfetty]

Azure Key Vault supports storing 3 types of data, Certificates, Keys, and Secrets. Of the 3, only secret storage supports accessing the secret value in a way that is useful. For this reason all use cases would be to access secret storage. Secrets must be stored using a name following DNS host naming rules [a-zA-Z0-9-]

As for authentication, AKV has it's own permissions system and only supports OAUTH2 methods for authentication. Users of the setup would need to create a service principal within Azure to represent the Nautobot service and grant the appropriate permissions to this principal. Microsoft provides python libraries for both the authentication (Azure Identity Module) and the keyvault access

Below are example link to using the python libraries:

https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate-service-principals
https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python

Creating service principal for keyvault access of application
https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

[jathanism]

Thanks for the submission!

If you wouldn't mind providing some more background details on the most common types of secrets you would need? This appears to be a robust solution and we likely wouldn't be able to implement full support for everything out the gate.

The big starting points from my perspective would be:

• Object type: Secrets?
• Authentication method

Any background you can share will help us to scope and prioritize implementing this in the future! Thanks in advance!

[jathanism]

Azure Key Vault supports storing 3 types of data, Certificates, Keys, and Secrets. Of the 3, only secret storage supports accessing the secret value in a way that is useful. For this reason all use cases would be to access secret storage. Secrets must be stored using a name following DNS host naming rules [a-zA-Z0-9-]

As for authentication, AKV has it's own permissions system and only supports OAUTH2 methods for authentication. Users of the setup would need to create a service principal within Azure to represent the Nautobot service and grant the appropriate permissions to this principal. Microsoft provides python libraries for both the authentication (Azure Identity Module) and the keyvault access

Below are example link to using the python libraries:

https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate-service-principals https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python

Creating service principal for keyvault access of application https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

THANK YOU for this background. This helps a lot!

[JonathanNathanson]

This would be a fantastic addition - I would be happy to help test as and when.