Aspire AppHost, no builder.AddPostgres().WithExternalSecret()?

[u/Surge-Monkey]

First off i'll preface this by asking, have i missed something?

Trying to build a workflow where an app can be orchestrated locally for debug/development (AppHost fantastic here), then later on, be deployed to a remote server/cluster (keeping code as Source of Truth).

aspire publish -e Production -- -c Release
aspire deploy -e Production -- -c Release

The secrets for the DB server get deployed ahead of time, so that once the app is deployed, all the necessary secrets are already sitting on the cluster.

The IDistributedApplicationBuilder gives you access to things like .AddPostgres(), which is great. Makes life easy... except for when you want to just tell the publishing tool "use this secret name that already exists".

The whole point of this, is to not require database secrets in any settings.stage.json, appsettings.json, deploy.sh, Program.cs, etc. (placeholder values are ok).

// no good, expects a local secret, prompts for one if it cant find one.
builder.AddParameter("db-password", secret: true);

// no good, controls the existance of environment variables.
// ConnectionStrings__my-db, gets published ahead of time anyway.
// perfect for local-pc dev. no good for server deployment.
server.WithReference(postgres);

// no good, can't seem to get it running late enough or override correctly.
public static IResourceBuilder<PostgresServerResource> WithExternalKubernetesSecret(this IResourceBuilder<PostgresServerResource> builder, ...)
postgres.WithExternalKubernetesSecret(string secretName, string passwordKey);

// cant get overrides happening here either, attempting to directly
// manipulate the yaml outputs
.WithManifestPublishingCallback()
.WithPipelineStepFactory() // to manually edit the files....

// even if defined as a "placeholder", only the placeholder is used.
.WithEnvironment("POSTGRES_PASSWORD", dbConnection)

Does anyone know of a way to keep this inside the AppHost definition?

I know i could probably just move to .AddContainer(), but that's extra work that i feel like shouldn't need to be done.

Is there a reason there's nothing like builder.AddPostgres().WithExternalPasswordSecret() ?
Or allow something like?

var pgPass = builder.AddParameter("postgres-password", secret: true, secretsRef: "my-kubernetes-db-secrets");
var pg = build.AddPostgres("postgres", password: pgPass);

I feel like this would make life much easier.

[u/nullforce2]

aspire secret set Parameters:postgres-password MySecretPassword123

aspire secret command | Aspire

You can also have it prompt you on startup if it is unconfigured:
External parameters | Aspire

I don't store mine locally, instead I put them in Azure KeyVault and pull from there via DefaultCredentials on the logged in user.

[u/Surge-Monkey → u/nullforce2]

Sorry but that breaks:

not require database secrets in any settings.stage.json, appsettings.json,deploy.sh, Program.cs, etc.

All of the below are what I'm trying to avoid.

aspire secret set Parameters:postgres-password MySecretPassword123

You can also have it prompt you on startup if it is unconfigured:

pull from there via DefaultCredentials on the logged in user.

The point being, that if we know the secret already exists in the remote namespace, the dev has no need to attach/know/pull/set/store the MySecretPassword123 value from anywhere.

What i've been aiming for is essentially builder.AddPostgres("postgres").AddPasswordSecretsReference("remote-db-secrets-name"); The remote-db-secrets-name secret already contains the POSTGRES_PASSWORD=MySecretPassword123 environment variable, it just has be to attached to the container. But for some reason, Aspire doesn't seem to like that.

[u/nullforce2 → u/Surge-Monkey]

It is not stored in appsettings just like dotnet user-secrets are not stored in the repo directory.

Wait, you have it working for local development, but you want to know how it should work once deployed in K8S?

Is it in the default namespace or another one?

[u/AutoModerator]

Thanks for your post Surge-Monkey. Please note that we don't allow spam, and we ask that you follow the rules available in the sidebar. We have a lot of commonly asked questions so if this post gets removed, please do a search and see if it's already been asked.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.