confeasy-azure-appc 1.0.0

Azure AppConfiguration extension for confeasy.

confeasy.azure_appc

Application configuration inspired by Microsoft.Extensions.Configuration (.NET).
See details in GitHub confeasy (PyPI).

This package is an extension to confeasy using Azure AppConfiguration service.

Getting started

Install required packages.

poetry add confeasy confeasy-azure-appc
# or similar command for your package manager of choice

In python, usually around application start:

# DbOptions class is an illustrative example of strongly typed configuration.
class DbOptions:
    def __init__(self):
        self.connnection_string: str = ""
        self.max_connections: int = 100

from confeasy import Builder
from confeasy.envars import EnvironmentVariables
from confeasy.cmdline import CommandLine
from confeasy.azure_appc import AzureAppConfig

# Order of the configuration sources matters; later sources can overwrite values from earlier ones.
builder = (Builder()
           .add_source(AzureAppConfig.from_base_url_in_envars(prefix="db.*"))
           .add_source(EnvironmentVariables("MYAPP_"))
           .add_source(CommandLine()))

config = builder.build()

# Bind configuration to a class instance and pass the instance to other objects.
options = config.bind(DbOptions(), prefix="db")

# OR pick up individual values:
db_conn_str = config.get_value("db.connection_string")

Authentication to Azure resources

Important Facts:

• The Python SDK for AppConfiguration allows authentication using both connection strings and credential providers from the azure-identity package.
• The Python SDK for KeyVault supports only credential providers from the azure-identity package, not connection strings.
• AppConfiguration can reference secrets from one or more key vaults.
• The most commonly used provider from azure-identity is DefaultAzureCredential, which combines several potential sources of authentication information, such as access tokens generated by az login or environment variables with conventional names.

[!IMPORTANT] This creates a somewhat complex situation where a simple approach, such as using a single connection string, may not work (unless you are using only AppConfiguration).

Suggestion:

In the most common scenario, where authentication is required for both AppConfiguration and one or more KeyVault resources, I recommend familiarizing yourself with managed identities and service principals in Azure and creating a specialized "account" for your application.

An example of how to do this is available in tests/app_service_principal.sh (a PowerShell variant is also available).

Once the service principal has been created, ensure the following environment variables are present in the environment:

• AZURE_APPC_BASE_URL: Set this to the URL of the Azure AppConfiguration resource, e.g., https://{name}.azconfig.io.
• AZURE_CLIENT_ID: Set this to the Application (client) ID of the service principal.
• AZURE_CLIENT_SECRET: Set this to the Client Secret of the service principal.
• AZURE_TENANT_ID: Set this to the Directory (tenant) ID.

This setup allows you to use the factory method AzureAppConfig.from_base_url_in_envars, enabling it to work both in local environments (such as a developer's machine) and after deployment, such as in a GitHub Action or on the final host.