Unclear how to create custom bicep resources which generate secrets

[onionhammer]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

With the changes to custom bicep resources utilizing a single keyvault in 9.2, it's become less clear to me how to create bicep resources which have secret output.

Looking at #2587 (comment) I see it seems like this may be the way to go, so I created this repository:

https://github.com/onionhammer/repro-aspire-issue/blob/master/repro-aspire-issue.AppHost/Program.cs

With this repro, it runs and works once, but subsequent runs fail, unless you clear out the deployments section of your secrets.json and restart your apphost.

I may be going about this all wrong, but the docs aren't updated so forgive me :)

Expected Behavior

There should be a straightforward/documented way to create and retrieve secrets generated in bicep

Steps To Reproduce

1. Clone https://github.com/onionhammer/repro-aspire-issue/
2. Add your subscription to the apphost path; cd into the directory and use dotnet user-secrets set "Azure:SubscriptionId" "your-subscription-id"
3. Run the apphost with dotnet run - should work the first time
4. Stop the app host, then run it again
5. This time you'll see it will not be able to resolve the Translator API key

Exceptions (if any)

No response

.NET Version info

.NET SDK:
Version: 9.0.202
Commit: 3a53853c30
Workload version: 9.0.200-manifests.5c4e24dc
MSBuild version: 17.13.13+1c2026462

Anything else?

No response

[davidfowl]

It looks right at first glance. I’ll take a look and see if we broke the caching somehow.

[davidfowl]

I can reproduce it. Putting the exception here for more info:

System.InvalidOperationException: Secret 'connectionstrings--translator' not found in Key Vault 'vault'.
   at Aspire.Hosting.Azure.AzureKeyVaultSecretReference.Aspire.Hosting.ApplicationModel.IValueProvider.GetValueAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultSecretReference.cs:line 34
   at Aspire.Hosting.ApplicationModel.ExpressionResolver.EvalValueProvider(IValueProvider vp) in /_/src/Aspire.Hosting/ApplicationModel/ExpressionResolver.cs:line 106
   at Aspire.Hosting.ApplicationModel.ExpressionResolver.ResolveInternalAsync(Object value) in /_/src/Aspire.Hosting/ApplicationModel/ExpressionResolver.cs:line 182
   at Aspire.Hosting.ApplicationModel.ExpressionResolver.ResolveWithContainerSourceAsync(IValueProvider valueProvider, String containerHostName, Boolean sourceIsContainer, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/ApplicationModel/ExpressionResolver.cs:line 194
   at Aspire.Hosting.ApplicationModel.ExpressionResolver.ResolveAsync(Boolean sourceIsContainer, IValueProvider valueProvider, String containerHostName, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/ApplicationModel/ExpressionResolver.cs:line 202
   at Aspire.Hosting.ApplicationModel.ResourceExtensions.GetValue(String key, IValueProvider valueProvider, ILogger logger, Boolean isContainer, String containerHostName, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/ApplicationModel/ResourceExtensions.cs:line 463
   at Aspire.Hosting.ApplicationModel.ResourceExtensions.ProcessEnvironmentVariableValuesAsync(IResource resource, DistributedApplicationExecutionContext executionContext, Action`4 processValue, ILogger logger, String containerHostName, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/ApplicationModel/ResourceExtensions.cs:line 361

Secret retrieval is busted somehow at runtime.

[davidfowl]

We don't set the SecretResolver in the case when the outputs are cached.

PS: This code needs a rewrite to make it testable, we have very little coverage here.