Skip to content

Conversation

@zhiyuanliang-ms
Copy link
Member

@zhiyuanliang-ms zhiyuanliang-ms commented Feb 24, 2025

Why this PR?

Usage:

const settings = await load("connection-string", {
  keyvaultOptions: {
    credential: credential,
    secretRefreshIntervalInMs: 120_000 // cannot less than 60 seconds
  }
});

Allow periodic reload of key vault secrets. In this case, even if there is no change on App Configuration key-values. This feature is targeted on the scenario where user is using latest version of a secret. In this case, the key vault reference url will not change, but the secret value will change if user rotates their secret.

Secret cache

Secret with version will be cached after the initial load and whenever a secret reference of that secret is resolved, the value will always be served from the cache.

Secret with no version (which means latest), will be cached after the initial load, and it will be served from cache if the secret refresh interval is configured and not expired. Otherwise, the provider will reload it from the Key Vault.

reference: #249

@zhiyuanliang-ms zhiyuanliang-ms merged commit d59f8cf into main Jul 10, 2025
5 checks passed
@zhiyuanliang-ms zhiyuanliang-ms deleted the zhiyuanliang/secret-refresh branch July 10, 2025 02:55
@jimmyca15
Copy link
Member

🥳 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants