Conversation
…should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
Added entry parameter to indicate the private key should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * cleaned up docs, split RBAC permissions into seperate file for brevity * Update generated docs * Updated changelog, nuget package references * Explicit update of Newtonsoft.Json.Bson from 1.0.2 (used by Microsoft.AspNet.WebApi.Client) to 1.0.3 to address vulnerability --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Merge 3.2.0 to main (#74) * chore: create 3.2 branch * feat: release 3.2, Added entry parameter to indicate the private key should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * cleaned up docs, split RBAC permissions into seperate file for brevity * Update generated docs * Updated changelog, nuget package references * Explicit update of Newtonsoft.Json.Bson from 1.0.2 (used by Microsoft.AspNet.WebApi.Client) to 1.0.3 to address vulnerability * now returning the serialized certificate tags, as well as the exportable flag. Updated README image * Update generated docs --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Merge 3.2.0 to main (#74) * chore: create 3.2 branch * feat: release 3.2, Added entry parameter to indicate the private key should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * cleaned up docs, split RBAC permissions into seperate file for brevity * Update generated docs * Updated changelog, nuget package references * Explicit update of Newtonsoft.Json.Bson from 1.0.2 (used by Microsoft.AspNet.WebApi.Client) to 1.0.3 to address vulnerability * now returning the serialized certificate tags, as well as the exportable flag. Updated README image * added check for vault name parameter coming through as empty string. async safety. naming cleanup. * Update generated docs * replaced count() with count * Added helper method to determine key sized and curve in order to pass the value to AKV (the fix) * cleanup * Added unit tests * update changelog --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Merge 3.2.0 to main (#74) * chore: create 3.2 branch * feat: release 3.2, Added entry parameter to indicate the private key should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * cleaned up docs, split RBAC permissions into seperate file for brevity * Update generated docs * Updated changelog, nuget package references * Explicit update of Newtonsoft.Json.Bson from 1.0.2 (used by Microsoft.AspNet.WebApi.Client) to 1.0.3 to address vulnerability * now returning the serialized certificate tags, as well as the exportable flag. Updated README image * added check for vault name parameter coming through as empty string. async safety. naming cleanup. * Update generated docs * replaced count() with count * Added helper method to determine key sized and curve in order to pass the value to AKV (the fix) * cleanup * Added unit tests * update changelog * Fixed issue with Create that would throw an exception for missing entry parameter * Updated documentation with alias requirements; now returning a more helpful error message when alias is invalid; unit tests * Update generated docs * removed unused images; updated screenshots to latest UI, fixed broken links * Update generated docs * Updated store type screenshots. Removed TenantID as store parameter as it was redundant. * Update generated docs * Update starter workflow version to v5 * Update secrets in keyfactor-release-workflow.yml Added scan_token secret for SAST integration. * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This automated merge brings the release-3.2 line (v3.2.4) into main, updating the Azure Key Vault orchestrator to support new store-type parameters (including non-exportable imports), improving documentation, and adding a dedicated unit test project.
Changes:
- Update management/inventory/discovery flows to support new entry parameters (notably
NonExportable) and improve error messaging/logging. - Refresh documentation structure (README + docsource) and add RBAC guidance (
rbac.md), along with updated generated store-type creation scripts. - Add
AzureKeyVault.Testsproject and update dependencies/solution/workflow to support the release.
Reviewed changes
Copilot reviewed 26 out of 84 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/store_types/powershell/restmethod_create_store_types.ps1 | Generated PowerShell REST script to create the AKV store type. |
| scripts/store_types/powershell/kfutil_create_store_types.ps1 | Generated PowerShell kfutil helper to create the AKV store type. |
| scripts/store_types/bash/kfutil_create_store_types.sh | Generated bash kfutil helper to create the AKV store type. |
| scripts/store_types/bash/curl_create_store_types.sh | Generated curl helper to create the AKV store type. |
| README.md | Major documentation updates (setup flow, discovery instructions, screenshots/anchors). |
| rbac.md | New RBAC guidance and sample role definitions. |
| integration-manifest.json | Store type definition updates (required alias, new NonExportable param, remove TenantId). |
| docsource/images/AKV-entry-parameters-store-type-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-PreserveExistingTags.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-PreserveExistingTags-validation-options.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-NonExportable.svg | New generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-NonExportable-validation-options.svg | New generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-CertificateTags.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-entry-parameters-store-type-dialog-CertificateTags-validation-options.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-fields-store-type-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-VaultRegion-validation-options-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-VaultRegion-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-SkuType-validation-options-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-SkuType-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-PrivateEndpoint-validation-options-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-PrivateEndpoint-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-AzureCloud-validation-options-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-custom-field-AzureCloud-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-basic-store-type-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/images/AKV-advanced-store-type-dialog.svg | Updated generated documentation image asset (SVG). |
| docsource/content.md | Documentation source updates aligned with README changes. |
| create_sp_azure.md | Documentation fixes/anchor updates for service principal setup. |
| CHANGELOG.md | Adds 3.2.0–3.2.4 entries and related release notes. |
| AzureKeyVault/Jobs/Management.cs | Adds NonExportable handling and improves entry-parameter parsing/error messaging. |
| AzureKeyVault/Jobs/Inventory.cs | Switches to GetAwaiter().GetResult() and improves logging text. |
| AzureKeyVault/Jobs/Discovery.cs | Improves warning handling and truncation behavior. |
| AzureKeyVault/Jobs/AzureKeyVaultJob.cs | Makes InitializeStore virtual and exposes internals to the new test assembly. |
| AzureKeyVault/Helpers.cs | Returns PKCS#12 conversion metadata (key type/size) alongside the converted bytes. |
| AzureKeyVault/Constants.cs | Adds NonExportable entry parameter constant. |
| AzureKeyVault/AzureKeyVault.csproj | Updates Azure/Keyfactor/MSAL packages; adds Newtonsoft.Json.Bson; updates System.Drawing.Common. |
| AzureKeyVault/AzureClient.cs | Adds nonExportable import support and returns entry parameters during inventory. |
| AzureKeyVault/AkvProperties.cs | Adjusts internal visibility for managed-identity/endpoint helpers. |
| AzureKeyVault.Tests/ManagementTests.cs | New unit tests for management behavior and regressions. |
| AzureKeyVault.Tests/HelpersTests.cs | New unit tests for PKCS#12 conversion + JSON validation helpers. |
| AzureKeyVault.Tests/DiscoveryAndInventoryTests.cs | New unit tests for discovery and inventory flows. |
| AzureKeyVault.Tests/CertificateFixtures.cs | Test fixtures for PFX inputs (RSA/EC). |
| AzureKeyVault.Tests/AzureKeyVault.Tests.csproj | New test project definition and dependencies. |
| AzureKeyVault.sln | Adds test project and RBAC doc to solution items. |
| .github/workflows/keyfactor-release-workflow.yml | Updates to newer shared starter workflow and secret inputs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+52
to
+57
| tagsJSON = config.JobProperties.ContainsKey(EntryParameters.TAGS) | ||
| ? config.JobProperties[EntryParameters.TAGS] as string ?? string.Empty | ||
| : string.Empty; | ||
| preserveTags = config.JobProperties.ContainsKey(EntryParameters.PRESERVE_TAGS) | ||
| ? config.JobProperties[EntryParameters.PRESERVE_TAGS] as bool? ?? true | ||
| : true; |
Comment on lines
310
to
+313
| var cert = await CertClient.GetCertificateAsync(certificate.Name); | ||
| logger.LogTrace($"got certificate details"); | ||
| Logger.LogTrace($"got certificate details"); | ||
| Logger.LogTrace($"cert properties: {JsonConvert.SerializeObject(cert.Value?.Properties)}"); | ||
| var itemEntryParams = new Dictionary<string, object>(); |
Comment on lines
+7
to
+16
| # Configuration - set these variables before running | ||
| KEYFACTOR_HOSTNAME="${KEYFACTOR_HOSTNAME}" | ||
| KEYFACTOR_API_PATH="${KEYFACTOR_API_PATH:-KeyfactorAPI}" | ||
| KEYFACTOR_AUTH_TOKEN="${KEYFACTOR_AUTH_TOKEN}" | ||
|
|
||
| echo "Creating store type: AKV" | ||
| curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/CertificateStoreTypes" \ | ||
| -H "Authorization: Bearer ${KEYFACTOR_AUTH_TOKEN}" \ | ||
| -H "Content-Type: application/json" \ | ||
| -H "x-keyfactor-requested-with: APIClient" \ |
Comment on lines
+67
to
71
| 1) [Configure client access; permissions and authentication](#configure-the-azure-keyvault-for-client-access) | ||
|
|
||
| 1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access) | ||
|
|
||
| 1) [Create the Store Type in Keyfactor](#create-the-akv-certificate-store-type) | ||
| 1) [Create the Store Type in Keyfactor](#AKV-Certificate-Store-Type) | ||
|
|
||
| 1) [Install the Extension on the Orchestrator](#installation) |
Comment on lines
+24
to
28
| 1) [Configure client access; permissions and authentication](#configure-the-azure-keyvault-for-client-access) | ||
|
|
||
| 1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access) | ||
|
|
||
| 1) [Create the Store Type in Keyfactor](#create-the-akv-certificate-store-type) | ||
| 1) [Create the Store Type in Keyfactor](#AKV-Certificate-Store-Type) | ||
|
|
||
| 1) [Install the Extension on the Orchestrator](#installation) |
Comment on lines
+19
to
+22
| - 3.2.0 | ||
| - Added an optional entry parameter to indicate whether the private key of the cert should be not exportable when stored in KeyVault | ||
| - Now specifying the pkcs12 format when wirting certs to Azure KeyVault. This should prevent the error when a PEM cert was added outside of Command and then we attempt to update without specifying the format (Azure assumes PEM and throws an error if not). | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-3.2 to main - Automated PR