ReadOnly DataProtection keys /8

[Rick-Anderson]

Fixes #32530

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/security/data-protection/introduction.md	ASP.NET Core Data Protection Overview

[Rick-Anderson]

@Rmattmann1221 @adityamandaleeka I'm working on #32530 while @amcasey is OOF. I can only find autoConfigureDataProtection in
azure-rest-api-specs but not in .net org

Can someone help me get started with #32530 ?

[adityamandaleeka]

@Rick-Anderson That's correct. The autoConfigureDataProtection variable is an Azure concept (AZD and ACA are aware of it), not an ASP.NET Core concept. When it's enabled, ACA does some magic behind the scenes to properly set up a volume via which data protection keys can be shared. To do so, it uses the ASP.NET Core variable added here: dotnet/aspnetcore#54266 (ReadOnlyDataProtectionKeyDirectory, DOTNET_ReadOnlyDataProtectionKeyDirectory, or ASPNETCORE_ReadOnlyDataProtectionKeyDirectory, in descending order of precedence) to specify a directory that should be used in read-only mode to get the keys to be used.

[amcasey]

I'm back(ish), but now @claudiaregio is out. I'd like to question the premise a bit - I don't believe those docs presently say anything about what happens when you deploy your app. This page does, but I think it's helpful as a worked example of how to do things manually.

I thought there had already been some documentation of this scenario on the ACA side. Maybe our page could link to that as an easy path but still provide details about how to do things manually?

[amcasey]

I think @jcjiang may have been the one to add/update the ACA docs?

[jcjiang]

I'm not aware of any additional documentation from the ACA side. There is a new page from ACA for .NET, but on the topic of data protection we have actually been linking to .NET docs.

@anthonychu might be able to give more insight.

[amcasey]

I'm not aware of any additional documentation from the ACA side. There is a new page from ACA for .NET, but on the topic of data protection we have actually been linking to .NET docs.

@anthonychu might be able to give more insight.

Thanks! I'm pretty sure that's the page I was thinking of. Do you have a link to that ACA for .net page?

[jcjiang]

https://github.com/MicrosoftDocs/azure-docs-pr/pull/269838 Here is the PR - let me know if any changes need to be made, otherwise I can work to get this pushed soon.

[amcasey]

Personally, I'd put something here. Just a tiny mention like, "by default the keys will be provided automatically to your app instances, but you still have the option of following the aspnetcore docs here".

[amcasey]

@Rick-Anderson has been very helpful and accommodating, but I could really use a comment from someone on the AspNetCore side (@claudiaregio? @adityamandaleeka?) about whether we want to change the docs at all and what our goal is if we do.

[adityamandaleeka]

When do we expect people to hit this doc?

The new "Data consistency in Azure Container Apps" section seems a bit out of the blue. Maybe the organization we want is something more like:

- Intro to Data Protection (what is it)
  - What do you need to do when scaling your app
    - NOTE about ACA handling this for you (and a link to the ACA docs about it)

[amcasey]

When do we expect people to hit this doc?

The new "Data consistency in Azure Container Apps" section seems a bit out of the blue. Maybe the organization we want is something more like:

- Intro to Data Protection (what is it)
  - What do you need to do when scaling your app
    - NOTE about ACA handling this for you (and a link to the ACA docs about it)

Unfortunately, the how to scale your app page isn't with the data protection docs. I've been unable to find a good place for such a note.

[claudiaregio]

@Rick-Anderson I like the suggestion that @adityamandaleeka has above. Could we try to add the information using that format?

[Rick-Anderson]

EDIT CoPilot helped me write an introduction.

@adityamandaleeka proposed:

When do we expect people to hit this doc?

The new "Data consistency in Azure Container Apps" section seems a bit out of the blue. Maybe the organization we want is something more like:

- Intro to Data Protection (what is it)
  - What do you need to do when scaling your app
    - NOTE about ACA handling this for you (and a link to the ACA docs about it)

What do you need to do when scaling your app
> - NOTE about ACA handling this for you (and a link to the ACA docs about it)

Shouldn't that be in the Azure docs here as suggested by @amcasey? ACA topics should be in Azure docs and obviously we'd link to that section.

If we decide to go with a new doc (or expanded) on

• Intro to Data Protection (what is it)
  • What do you need to do when scaling your app
    • NOTE about ACA handling this for you (and a link to the ACA docs about it)

Someone from the Product Unit would need to write it and the writing team can do the edits.

[Rick-Anderson]

@adityamandaleeka CoPilot helped me write an introduction.

[Rick-Anderson]

@claudiaregio see https://github.com/MicrosoftDocs/azure-docs-pr/pull/279853/files

[amcasey]

Someone from the Product Unit would need to write it and the writing team can do the edits.

Thanks, @Rick-Anderson - I'll try to get to this next week.

[amcasey]

@Rick-Anderson This is the sort of thing I had in mind. Please feel free to change it as much as you like to make it fit our guidelines and conventions.

#33086