Keyvault not working within application run via Docker in Visual Studio

Question

I have a .NET Core 3.1 console application which needs access to a KeyVault

When running this application as a console in Visual Studio all is fine, because my Visual Studio is logged in with my Azure credentials, so access is granted

However, in reality the application is run inside Docker

Visual Studio gives the option to run the application inside docker

The startup code is below

public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {
                var keyVaultEndpoint = new Uri(Environment.GetEnvironmentVariable("VaultUri"));
                config.AddAzureKeyVault(
                keyVaultEndpoint,
                new DefaultAzureCredential());
            })
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            })
            .ConfigureLogging(logging =>
            {
                logging.ClearProviders();
                logging.SetMinimumLevel(Microsoft.Extensions.Logging.LogLevel.Trace);
            })
            .UseNLog();  // NLog: Setup NLog for Dependency injection
}

When running inside Docker from Visual Studio the above errors with Value cannot be null

Im assuming its because DefaultAzureCredential doesnt work

This is a development environment only issue

How can I get around this?

Paul

Answer 1

You need to authenticate the container, it looks like there is a bunch of ways of doing this.

From the DefaultAzureCredential docs:

Provides a default TokenCredential authentication flow for applications that will be deployed to Azure. The following credential types if enabled will be tried, in order:

EnvironmentCredential, ManagedIdentityCredential, SharedTokenCacheCredential, VisualStudioCredential, VisualStudioCodeCredential, AzureCliCredential, InteractiveBrowserCredential

Likely you have been using VisualStudioCredential without realizing it when you were working inside VS, now that your environment is isolated in a docker container you will need to manually authenticate. I would probably use EnvironmentCredential for this as you simply need to acquire and expose your credentials to the container through environment variables.