[KeyVault] - Deploy attestation service as a test resource

[maorleger]

What

• When deploying a Managed HSM, deploy a mock attestation service from the EngSys managed Docker container
• Update our Secure Key Release to work with a dynamically deployed attestation service

Why

For Secure Key Release we require an additional live resource - a service that can generate and sign tokens as well as provide
the OIDC Configuration to discover the jwks URI. We currently use a static test fixture that I have spun up and deployed to
Azure App Service; however, that is not sustainable and really not in line with our guidelines on test assets

This allows us to maintain an image and keep the code centralized and in a repository owned by EngSys.

See https://github.com/Azure/azure-sdk-tools/tree/main/tools/keyvault-mock-attestation for the source code for the container.

[sadasant]

I think this is ok, but I have the feeling that this just got 1.5x as complex as before.

I have the feeling an outsider might not clearly see how these changes interoperate. Should we add some kind of documentation to remember about this PR or these changes somewhere? What I’m trying to say is, next time we onboard someone on the Key Vault clients, how can we make their experience more straightforward?

I’m not proposing to address this feedback as part of this PR. If this argument doesn’t sound strong enough, I’m also ok with leaving this as a comment in case someone goes back to this PR from the future.

[maorleger]

I think this is ok, but I have the feeling that this just got 1.5x as complex as before.

Agree - it's a lot added for a single scenario but we do need to deploy something for live testing SKR

I have the feeling an outsider might not clearly see how these changes interoperate. Should we add some kind of documentation to remember about this PR or these changes somewhere? What I’m trying to say is, next time we onboard someone on the Key Vault clients, how can we make their experience more straightforward?

Definitely, I can do the following:

• [ ] Add documentation about this scenario (created [KeyVault] - Review the contributing guide and add information about secure key release #16919)
• experiment with simplifying the template - i bet there's a lot of crud I don't need there and can get rid of

I’m not proposing to address this feedback as part of this PR. If this argument doesn’t sound strong enough, I’m also ok with leaving this as a comment in case someone goes back to this PR from the future.

No worries, I dont think there's a huge rush since we have a static test resource. I can try to add it to this PR

Thanks for the feedback!

[maorleger]

/azp run js - keyvault-keys - tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).