Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ReadOnly DataProtection keys /8 #32549

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

ReadOnly DataProtection keys /8 #32549

wants to merge 11 commits into from

Conversation

Rick-Anderson
Copy link
Contributor

@Rick-Anderson Rick-Anderson commented May 8, 2024

@Rick-Anderson Rick-Anderson marked this pull request as draft May 8, 2024 23:40
@Rick-Anderson
Copy link
Contributor Author

@Rmattmann1221 @adityamandaleeka I'm working on #32530 while @amcasey is OOF. I can only find autoConfigureDataProtection in
azure-rest-api-specs but not in .net org

Can someone help me get started with #32530 ?

@adityamandaleeka
Copy link
Member

@Rick-Anderson That's correct. The autoConfigureDataProtection variable is an Azure concept (AZD and ACA are aware of it), not an ASP.NET Core concept. When it's enabled, ACA does some magic behind the scenes to properly set up a volume via which data protection keys can be shared. To do so, it uses the ASP.NET Core variable added here: dotnet/aspnetcore#54266 (ReadOnlyDataProtectionKeyDirectory, DOTNET_ReadOnlyDataProtectionKeyDirectory, or ASPNETCORE_ReadOnlyDataProtectionKeyDirectory, in descending order of precedence) to specify a directory that should be used in read-only mode to get the keys to be used.

@amcasey
Copy link
Member

amcasey commented May 13, 2024

I'm back(ish), but now @claudiaregio is out. I'd like to question the premise a bit - I don't believe those docs presently say anything about what happens when you deploy your app. This page does, but I think it's helpful as a worked example of how to do things manually.

I thought there had already been some documentation of this scenario on the ACA side. Maybe our page could link to that as an easy path but still provide details about how to do things manually?

@amcasey
Copy link
Member

amcasey commented May 13, 2024

I think @jcjiang may have been the one to add/update the ACA docs?

@jcjiang
Copy link

jcjiang commented May 13, 2024

I'm not aware of any additional documentation from the ACA side. There is a new page from ACA for .NET, but on the topic of data protection we have actually been linking to .NET docs.

@anthonychu might be able to give more insight.

@amcasey
Copy link
Member

amcasey commented May 13, 2024

I'm not aware of any additional documentation from the ACA side. There is a new page from ACA for .NET, but on the topic of data protection we have actually been linking to .NET docs.

@anthonychu might be able to give more insight.

Thanks! I'm pretty sure that's the page I was thinking of. Do you have a link to that ACA for .net page?

@jcjiang
Copy link

jcjiang commented May 13, 2024

https://github.com/MicrosoftDocs/azure-docs-pr/pull/269838 Here is the PR - let me know if any changes need to be made, otherwise I can work to get this pushed soon.

@amcasey
Copy link
Member

amcasey commented May 13, 2024

Personally, I'd put something here. Just a tiny mention like, "by default the keys will be provided automatically to your app instances, but you still have the option of following the aspnetcore docs here".

Copy link
Member

@amcasey amcasey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Rick-Anderson has been very helpful and accommodating, but I could really use a comment from someone on the AspNetCore side (@claudiaregio? @adityamandaleeka?) about whether we want to change the docs at all and what our goal is if we do.

aspnetcore/security/data-protection/introduction.md Outdated Show resolved Hide resolved
aspnetcore/security/data-protection/introduction.md Outdated Show resolved Hide resolved
Rick-Anderson and others added 3 commits May 22, 2024 14:47
Co-authored-by: Andrew Casey <amcasey@users.noreply.github.com>
@Rick-Anderson Rick-Anderson marked this pull request as ready for review May 23, 2024 05:51
@adityamandaleeka
Copy link
Member

When do we expect people to hit this doc?

The new "Data consistency in Azure Container Apps" section seems a bit out of the blue. Maybe the organization we want is something more like:

- Intro to Data Protection (what is it)
  - What do you need to do when scaling your app
    - NOTE about ACA handling this for you (and a link to the ACA docs about it)

@amcasey
Copy link
Member

amcasey commented May 23, 2024

When do we expect people to hit this doc?

The new "Data consistency in Azure Container Apps" section seems a bit out of the blue. Maybe the organization we want is something more like:

- Intro to Data Protection (what is it)
  - What do you need to do when scaling your app
    - NOTE about ACA handling this for you (and a link to the ACA docs about it)

Unfortunately, the how to scale your app page isn't with the data protection docs. I've been unable to find a good place for such a note.

@Rick-Anderson Rick-Anderson self-assigned this May 23, 2024
@Rick-Anderson Rick-Anderson changed the title ReadOnly DataProtection keys ReadOnly DataProtection keys /8 May 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update Data Protection docs to include default behavior when deploying ASP.NET Core apps to ACA
4 participants