diff options
author | CoprDistGit <infra@openeuler.org> | 2023-04-10 08:37:19 +0000 |
---|---|---|
committer | CoprDistGit <infra@openeuler.org> | 2023-04-10 08:37:19 +0000 |
commit | d412576f264d13025612cffdd5045f30b4959d51 (patch) | |
tree | 608990e38cf5f3a4f0ca2880cf5c908a72327239 /python-azure-keyvault-secrets.spec | |
parent | f4f8edd34eef06491b5d59309a00873d6fa67dd7 (diff) |
automatic import of python-azure-keyvault-secrets
Diffstat (limited to 'python-azure-keyvault-secrets.spec')
-rw-r--r-- | python-azure-keyvault-secrets.spec | 1879 |
1 files changed, 1879 insertions, 0 deletions
diff --git a/python-azure-keyvault-secrets.spec b/python-azure-keyvault-secrets.spec new file mode 100644 index 0000000..c74deef --- /dev/null +++ b/python-azure-keyvault-secrets.spec @@ -0,0 +1,1879 @@ +%global _empty_manifest_terminate_build 0 +Name: python-azure-keyvault-secrets +Version: 4.7.0 +Release: 1 +Summary: Microsoft Azure Key Vault Secrets Client Library for Python +License: MIT License +URL: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets +Source0: https://mirrors.nju.edu.cn/pypi/web/packages/5c/a1/78ecabf98e97d600dcac1559ff64b4bc9f84eca126c0aeba859916832b0c/azure-keyvault-secrets-4.7.0.zip +BuildArch: noarch + +Requires: python3-azure-common +Requires: python3-azure-core +Requires: python3-isodate +Requires: python3-typing-extensions + +%description +# Azure Key Vault Secrets client library for Python +Azure Key Vault helps solve the following problems: + +- Secrets management (this library) - +securely store and control access to tokens, passwords, certificates, API keys, +and other secrets +- Cryptographic key management +([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - +create, store, and control access to the keys used to encrypt your data +- Certificate management +([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) - +create, manage, and deploy public and private SSL/TLS certificates +- Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options + +[Source code][library_src] +| [Package (PyPI)][pypi_package_secrets] +| [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/) +| [API reference documentation][reference_docs] +| [Product documentation][azure_keyvault] +| [Samples][secret_samples] + +## _Disclaimer_ + +_Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_. +_Python 3.7 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._ + +## Getting started +### Install packages +Install [azure-keyvault-secrets][pypi_package_secrets] and +[azure-identity][azure_identity_pypi] with [pip][pip]: +```Bash +pip install azure-keyvault-secrets azure-identity +``` +[azure-identity][azure_identity] is used for Azure Active Directory +authentication as demonstrated below. + +### Prerequisites +* An [Azure subscription][azure_sub] +* Python 3.7 or later +* An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli]. + +### Authenticate the client +In order to interact with the Azure Key Vault service, you will need an instance of a [SecretClient][secret_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments. + +See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types. + +#### Create a client +After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a secret client (replacing the value of `VAULT_URL` with your vault's URL): + +<!-- SNIPPET:hello_world.create_secret_client --> + +```python +VAULT_URL = os.environ["VAULT_URL"] +credential = DefaultAzureCredential() +client = SecretClient(vault_url=VAULT_URL, credential=credential) +``` + +<!-- END SNIPPET --> + +> **NOTE:** For an asynchronous client, import `azure.keyvault.secrets.aio`'s `SecretClient` instead. + +## Key concepts +### Secret +A secret consists of a secret value and its associated metadata and management +information. This library handles secret values as strings, but Azure Key Vault +doesn't store them as such. For more information about secrets and how Key +Vault stores and manages them, see the +[Key Vault documentation](https://docs.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates). + +[SecretClient][secret_client_docs] can set secret values in the vault, update +secret metadata, and delete secrets, as shown in the +[examples](#examples) below. + +## Examples +This section contains code snippets covering common tasks: +* [Set a secret](#set-a-secret) +* [Retrieve a secret](#retrieve-a-secret) +* [Update secret metadata](#update-secret-metadata) +* [Delete a secret](#delete-a-secret) +* [List secrets](#list-secrets) +* [Async API](#async-api) +* [Asynchronously create a secret](#asynchronously-create-a-secret) +* [Asynchronously list secrets](#asynchronously-list-secrets) + +### Set a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.set_secret) +creates new secrets and changes the values of existing secrets. If no secret with the +given name exists, `set_secret` creates a new secret with that name and the +given value. If the given name is in use, `set_secret` creates a new version +of that secret, with the given value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Retrieve a secret +[get_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.get_secret) +retrieves a secret previously stored in the Key Vault. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.get_secret("secret-name") + +print(secret.name) +print(secret.value) +``` + +### Update secret metadata +[update_secret_properties](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.update_secret_properties) +updates a secret's metadata. It cannot change the secret's value; use [set_secret](#set-a-secret) to set a secret's +value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +# Clients may specify the content type of a secret to assist in interpreting the secret data when it's retrieved +content_type = "text/plain" + +# We will also disable the secret for further use + +updated_secret_properties = secret_client.update_secret_properties("secret-name", content_type=content_type, enabled=False) + +print(updated_secret_properties.updated_on) +print(updated_secret_properties.content_type) +print(updated_secret_properties.enabled) +``` + +### Delete a secret +[begin_delete_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.begin_delete_secret) +requests Key Vault delete a secret, returning a poller which allows you to wait for the deletion to finish. Waiting is +helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge (permanently delete) the secret as +soon as possible. When [soft-delete][soft_delete] is disabled, `begin_delete_secret` itself is permanent. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +deleted_secret = secret_client.begin_delete_secret("secret-name").result() + +print(deleted_secret.name) +print(deleted_secret.deleted_date) +``` + +### List secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. This list doesn't include the secret's values. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +### Async API +This library includes a complete set of async APIs. To use them, you must +first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). +See +[azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport) +for more information. + +Async clients and credentials should be closed when they're no longer needed. These +objects are async context managers and define async `close` methods. For +example: + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() + +# call close when the client and credential are no longer needed +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +... +await client.close() +await credential.close() + +# alternatively, use them as async context managers (contextlib.AsyncExitStack can help) +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +async with client: + async with credential: + ... +``` + +### Asynchronously create a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.set_secret) +creates a secret in the Key Vault with the specified optional arguments. +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +secret = await secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Asynchronously list secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +async for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +## Troubleshooting + +See the `azure-keyvault-secrets` +[troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/TROUBLESHOOTING.md) +for details on how to diagnose various failure scenarios. + +### General +Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions]. +For example, if you try to get a key that doesn't exist in the vault, +[SecretClient][secret_client_docs] raises +[ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error): + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +from azure.core.exceptions import ResourceNotFoundError + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +try: + secret_client.get_secret("which-does-not-exist") +except ResourceNotFoundError as e: + print(e.message) +``` + +### Logging +This library uses the standard +[logging](https://docs.python.org/3.5/library/logging.html) library for logging. +Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO +level. + +Detailed DEBUG level logging, including request/response bodies and unredacted +headers, can be enabled on a client with the `logging_enable` argument: +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +import sys +import logging + +# Create a logger for the 'azure' SDK +logger = logging.getLogger('azure') +logger.setLevel(logging.DEBUG) + +# Configure a console output +handler = logging.StreamHandler(stream=sys.stdout) +logger.addHandler(handler) + +credential = DefaultAzureCredential() + +# This client will log detailed information about its HTTP sessions, at DEBUG level +secret_client = SecretClient( + vault_url="https://my-key-vault.vault.azure.net/", + credential=credential, + logging_enable=True +) +``` + +Similarly, `logging_enable` can enable detailed logging for a single operation, +even when it isn't enabled for the client: +```python +secret_client.get_secret("my-secret", logging_enable=True) +``` + +## Next steps +Several samples are available in the Azure SDK for Python GitHub repository. +These provide example code for additional Key Vault scenarios: +| File | Description | +|-------------|-------------| +| [hello_world.py][hello_world_sample] ([async version][hello_world_async_sample]) | create/get/update/delete secrets | +| [list_operations.py][list_operations_sample] ([async version][list_operations_async_sample]) | basic list operations for secrets | +| [backup_restore_operations.py][backup_operations_sample] ([async version][backup_operations_async_sample]) | back up and restore secrets | +| [recover_purge_operations.py][recover_purge_sample] ([async version][recover_purge_async_sample]) | recover and purge secrets | + +### Additional Documentation +For more extensive documentation on Azure Key Vault, see the +[API reference documentation][reference_docs]. + +## Contributing +This project welcomes contributions and suggestions. Most contributions require +you to agree to a Contributor License Agreement (CLA) declaring that you have +the right to, and actually do, grant us the rights to use your contribution. +For details, visit https://cla.microsoft.com. + +When you submit a pull request, a CLA-bot will automatically determine whether +you need to provide a CLA and decorate the PR appropriately (e.g., label, +comment). Simply follow the instructions provided by the bot. You will only +need to do this once across all repos using our CLA. + +This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct]. +For more information, see the +[Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or +contact opencode@microsoft.com with any additional questions or comments. + + +<!-- LINKS --> +[azure_cloud_shell]: https://shell.azure.com/bash +[azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions +[azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity +[azure_identity_pypi]: https://pypi.org/project/azure-identity/ +[azure_keyvault]: https://docs.microsoft.com/azure/key-vault/general/overview +[azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli +[azure_sub]: https://azure.microsoft.com/free/ + +[backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations.py +[backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations_async.py + +[code_of_conduct]: https://opensource.microsoft.com/codeofconduct/ + +[default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential + +[hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world.py +[hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world_async.py + +[library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets +[list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations.py +[list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations_async.py + +[managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview + +[pip]: https://pypi.org/project/pip/ +[pypi_package_secrets]: https://pypi.org/project/azure-keyvault-secrets/ + +[recover_purge_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations.py +[recover_purge_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations_async.py +[reference_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs + +[secret_client_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient +[secret_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples +[soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview + + + + +# Release History + +## 4.7.0 (2023-03-16) + +### Features Added +- Added support for service API version `7.4` +- Clients each have a `send_request` method that can be used to send custom requests using the + client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172)) + +### Other Changes +- Python 3.6 is no longer supported. Please use Python version 3.7 or later. +- Key Vault API version `7.4` is now the default +- Updated minimum `azure-core` version to 1.24.0 +- Dropped `msrest` requirement +- Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`) +- Added requirement for `typing-extensions>=4.0.1` + +## 4.6.0 (2022-09-19) + +### Breaking Changes +- Clients verify the challenge resource matches the vault domain. This should affect few customers, + who can provide `verify_challenge_resource=False` to client constructors to disable. + See https://aka.ms/azsdk/blog/vault-uri for more information. + +## 4.5.1 (2022-08-11) + +### Other Changes +- Documentation improvements + ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039)) + +## 4.5.0b1 (2022-06-07) + +### Bugs Fixed +- Port numbers are now preserved in the `vault_url` property of a `KeyVaultSecretIdentifier` + ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446)) + +## 4.4.0 (2022-03-28) + +### Features Added +- Key Vault API version 7.3 is now the default +- Added support for multi-tenant authentication when using `azure-identity` + 1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) +- (From 4.4.0b3) Added `managed` property to SecretProperties + +### Other Changes +- (From 4.4.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- Updated minimum `azure-core` version to 1.20.0 +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See + https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate + this parameter if `get_token` is implemented by a custom credential. + +## 4.4.0b3 (2022-02-08) + +### Features Added +- Added `managed` property to SecretProperties + +### Other Changes +- Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +## 4.4.0b2 (2021-11-11) + +### Features Added +- Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +### Other Changes +- Updated minimum `azure-core` version to 1.15.0 + +## 4.4.0b1 (2021-09-09) + +### Features Added +- Key Vault API version 7.3-preview is now the default + +### Other Changes +- Updated type hints to fix mypy errors + ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158)) + +## 4.3.0 (2021-06-22) +This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+. +### Fixed +- Correct typing for async paging methods + +### Changed +- Key Vault API version 7.2 is now the default +- Updated minimum `msrest` version to 0.6.21 + +### Added +- Added class `KeyVaultSecretIdentifier` that parses out a full ID returned by Key Vault, + so users can easily access the secret's `name`, `vault_url`, and `version`. + +## 4.2.0 (2020-08-11) +### Fixed +- Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers + are no longer redacted in logging output + +### Changed +- Key Vault API version 7.1 is now the default +- Updated minimum `azure-core` version to 1.7.0 + +### Added +- At construction, clients accept a `CustomHookPolicy` through the optional + keyword argument `custom_hook_policy` +- All client requests include a unique ID in the header `x-ms-client-request-id` +- Dependency on `azure-common` for multiapi support + +## 4.2.0b1 (2020-03-10) +- Support for Key Vault API version 7.1-preview +([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124)) + - Added `recoverable_days` to `CertificateProperties` + - Added `ApiVersion` enum identifying Key Vault versions supported by this package + +## 4.1.0 (2020-03-10) +- `SecretClient` instances have a `close` method which closes opened sockets. +Used as a context manager, a `SecretClient` closes opened sockets on exit. +([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906)) +- Pollers no longer sleep after operation completion +([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991)) + +## 4.0.1 (2020-02-11) +- `azure.keyvault.secrets` defines `__version__` +- Challenge authentication policy preserves request options +([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999)) +- Updated `msrest` requirement to >=0.6.0 +- Challenge authentication policy requires TLS +([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457)) +- Methods no longer raise the internal error `KeyVaultErrorException` +([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690)) + +## 4.0.0 (2019-10-31) +### Breaking changes: +- Moved optional parameters of two methods into kwargs ( +[docs](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-keyvault-secrets/4.0.0/azure.keyvault.secrets.html) +detail the new keyword arguments): + - `set_secret` now has positional parameters `name` and `value` + - `update_secret_properties` now has positional parameters `name` and + (optional) `version` +- Renamed `list_secrets` to `list_properties_of_secrets` +- Renamed `list_secret_versions` to `list_properties_of_secret_versions` +- Renamed sync method `delete_secret` to `begin_delete_secret` +- The sync method `begin_delete_secret` and async `delete_secret` now return pollers that return a `DeletedSecret` +- Renamed `Secret` to `KeyVaultSecret` +- `KeyVaultSecret` properties `created`, `expires`, and `updated` renamed to `created_on`, +`expires_on`, and `updated_on` +- The `vault_endpoint` parameter of `SecretClient` has been renamed to `vault_url` +- The property `vault_endpoint` has been renamed to `vault_url` in all models + + +## 4.0.0b4 (2019-10-08) +### Breaking changes: +- `Secret` now has attribute `properties`, which holds certain properties of the +secret, such as `version`. This changes the shape of the returned `Secret` type, +as certain properties of `Secret` (such as `version`) have to be accessed +through the `properties` property. + +- `update_secret` has been renamed to `update_secret_properties` +- The `vault_url` parameter of `SecretClient` has been renamed to `vault_endpoint` +- The property `vault_url` has been renamed to `vault_endpoint` in all models + +### Fixes and improvements +- `list_secrets` and `list_secret_versions` return the correct type + +## 4.0.0b3 (2019-09-11) +This release includes only internal changes. + +## 4.0.0b2 (2019-08-06) +### Breaking changes: +- Removed `azure.core.Configuration` from the public API in preparation for a +revamped configuration API. Static `create_config` methods have been renamed +`_create_config`, and will be removed in a future release. +- This version of the library requires `azure-core` 1.0.0b2 + - If you later want to revert to a version requiring azure-core 1.0.0b1, + of this or another Azure SDK library, you must explicitly install azure-core + 1.0.0b1 as well. For example: + `pip install azure-core==1.0.0b1 azure-keyvault-secrets==4.0.0b1` + +### New features: +- Distributed tracing framework OpenCensus is now supported +- Added support for HTTP challenge based authentication, allowing clients to +interact with vaults in sovereign clouds. + +## 4.0.0b1 (2019-06-28) +Version 4.0.0b1 is the first preview of our efforts to create a user-friendly +and Pythonic client library for Azure Key Vault. For more information about +preview releases of other Azure SDK libraries, please visit +https://aka.ms/azure-sdk-preview1-python. + +This library is not a direct replacement for `azure-keyvault`. Applications +using that library would require code changes to use `azure-keyvault-secrets`. +This package's +[documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) +and +[samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples) +demonstrate the new API. + +### Major changes from `azure-keyvault` +- Packages scoped by functionality + - `azure-keyvault-secrets` contains a client for secret operations, + `azure-keyvault-keys` contains a client for key operations +- Client instances are scoped to vaults (an instance interacts with one vault +only) +- Asynchronous API supported on Python 3.5.3+ + - the `azure.keyvault.secrets.aio` namespace contains an async equivalent of + the synchronous client in `azure.keyvault.secrets` +- Authentication using `azure-identity` credentials + - see this package's + [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) + , and the + [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md) + for more information + +### `azure-keyvault` features not implemented in this library +- Certificate management APIs +- National cloud support. This release supports public global cloud vaults, + e.g. https://{vault-name}.vault.azure.net + + +%package -n python3-azure-keyvault-secrets +Summary: Microsoft Azure Key Vault Secrets Client Library for Python +Provides: python-azure-keyvault-secrets +BuildRequires: python3-devel +BuildRequires: python3-setuptools +BuildRequires: python3-pip +%description -n python3-azure-keyvault-secrets +# Azure Key Vault Secrets client library for Python +Azure Key Vault helps solve the following problems: + +- Secrets management (this library) - +securely store and control access to tokens, passwords, certificates, API keys, +and other secrets +- Cryptographic key management +([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - +create, store, and control access to the keys used to encrypt your data +- Certificate management +([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) - +create, manage, and deploy public and private SSL/TLS certificates +- Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options + +[Source code][library_src] +| [Package (PyPI)][pypi_package_secrets] +| [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/) +| [API reference documentation][reference_docs] +| [Product documentation][azure_keyvault] +| [Samples][secret_samples] + +## _Disclaimer_ + +_Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_. +_Python 3.7 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._ + +## Getting started +### Install packages +Install [azure-keyvault-secrets][pypi_package_secrets] and +[azure-identity][azure_identity_pypi] with [pip][pip]: +```Bash +pip install azure-keyvault-secrets azure-identity +``` +[azure-identity][azure_identity] is used for Azure Active Directory +authentication as demonstrated below. + +### Prerequisites +* An [Azure subscription][azure_sub] +* Python 3.7 or later +* An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli]. + +### Authenticate the client +In order to interact with the Azure Key Vault service, you will need an instance of a [SecretClient][secret_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments. + +See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types. + +#### Create a client +After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a secret client (replacing the value of `VAULT_URL` with your vault's URL): + +<!-- SNIPPET:hello_world.create_secret_client --> + +```python +VAULT_URL = os.environ["VAULT_URL"] +credential = DefaultAzureCredential() +client = SecretClient(vault_url=VAULT_URL, credential=credential) +``` + +<!-- END SNIPPET --> + +> **NOTE:** For an asynchronous client, import `azure.keyvault.secrets.aio`'s `SecretClient` instead. + +## Key concepts +### Secret +A secret consists of a secret value and its associated metadata and management +information. This library handles secret values as strings, but Azure Key Vault +doesn't store them as such. For more information about secrets and how Key +Vault stores and manages them, see the +[Key Vault documentation](https://docs.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates). + +[SecretClient][secret_client_docs] can set secret values in the vault, update +secret metadata, and delete secrets, as shown in the +[examples](#examples) below. + +## Examples +This section contains code snippets covering common tasks: +* [Set a secret](#set-a-secret) +* [Retrieve a secret](#retrieve-a-secret) +* [Update secret metadata](#update-secret-metadata) +* [Delete a secret](#delete-a-secret) +* [List secrets](#list-secrets) +* [Async API](#async-api) +* [Asynchronously create a secret](#asynchronously-create-a-secret) +* [Asynchronously list secrets](#asynchronously-list-secrets) + +### Set a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.set_secret) +creates new secrets and changes the values of existing secrets. If no secret with the +given name exists, `set_secret` creates a new secret with that name and the +given value. If the given name is in use, `set_secret` creates a new version +of that secret, with the given value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Retrieve a secret +[get_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.get_secret) +retrieves a secret previously stored in the Key Vault. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.get_secret("secret-name") + +print(secret.name) +print(secret.value) +``` + +### Update secret metadata +[update_secret_properties](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.update_secret_properties) +updates a secret's metadata. It cannot change the secret's value; use [set_secret](#set-a-secret) to set a secret's +value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +# Clients may specify the content type of a secret to assist in interpreting the secret data when it's retrieved +content_type = "text/plain" + +# We will also disable the secret for further use + +updated_secret_properties = secret_client.update_secret_properties("secret-name", content_type=content_type, enabled=False) + +print(updated_secret_properties.updated_on) +print(updated_secret_properties.content_type) +print(updated_secret_properties.enabled) +``` + +### Delete a secret +[begin_delete_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.begin_delete_secret) +requests Key Vault delete a secret, returning a poller which allows you to wait for the deletion to finish. Waiting is +helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge (permanently delete) the secret as +soon as possible. When [soft-delete][soft_delete] is disabled, `begin_delete_secret` itself is permanent. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +deleted_secret = secret_client.begin_delete_secret("secret-name").result() + +print(deleted_secret.name) +print(deleted_secret.deleted_date) +``` + +### List secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. This list doesn't include the secret's values. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +### Async API +This library includes a complete set of async APIs. To use them, you must +first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). +See +[azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport) +for more information. + +Async clients and credentials should be closed when they're no longer needed. These +objects are async context managers and define async `close` methods. For +example: + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() + +# call close when the client and credential are no longer needed +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +... +await client.close() +await credential.close() + +# alternatively, use them as async context managers (contextlib.AsyncExitStack can help) +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +async with client: + async with credential: + ... +``` + +### Asynchronously create a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.set_secret) +creates a secret in the Key Vault with the specified optional arguments. +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +secret = await secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Asynchronously list secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +async for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +## Troubleshooting + +See the `azure-keyvault-secrets` +[troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/TROUBLESHOOTING.md) +for details on how to diagnose various failure scenarios. + +### General +Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions]. +For example, if you try to get a key that doesn't exist in the vault, +[SecretClient][secret_client_docs] raises +[ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error): + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +from azure.core.exceptions import ResourceNotFoundError + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +try: + secret_client.get_secret("which-does-not-exist") +except ResourceNotFoundError as e: + print(e.message) +``` + +### Logging +This library uses the standard +[logging](https://docs.python.org/3.5/library/logging.html) library for logging. +Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO +level. + +Detailed DEBUG level logging, including request/response bodies and unredacted +headers, can be enabled on a client with the `logging_enable` argument: +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +import sys +import logging + +# Create a logger for the 'azure' SDK +logger = logging.getLogger('azure') +logger.setLevel(logging.DEBUG) + +# Configure a console output +handler = logging.StreamHandler(stream=sys.stdout) +logger.addHandler(handler) + +credential = DefaultAzureCredential() + +# This client will log detailed information about its HTTP sessions, at DEBUG level +secret_client = SecretClient( + vault_url="https://my-key-vault.vault.azure.net/", + credential=credential, + logging_enable=True +) +``` + +Similarly, `logging_enable` can enable detailed logging for a single operation, +even when it isn't enabled for the client: +```python +secret_client.get_secret("my-secret", logging_enable=True) +``` + +## Next steps +Several samples are available in the Azure SDK for Python GitHub repository. +These provide example code for additional Key Vault scenarios: +| File | Description | +|-------------|-------------| +| [hello_world.py][hello_world_sample] ([async version][hello_world_async_sample]) | create/get/update/delete secrets | +| [list_operations.py][list_operations_sample] ([async version][list_operations_async_sample]) | basic list operations for secrets | +| [backup_restore_operations.py][backup_operations_sample] ([async version][backup_operations_async_sample]) | back up and restore secrets | +| [recover_purge_operations.py][recover_purge_sample] ([async version][recover_purge_async_sample]) | recover and purge secrets | + +### Additional Documentation +For more extensive documentation on Azure Key Vault, see the +[API reference documentation][reference_docs]. + +## Contributing +This project welcomes contributions and suggestions. Most contributions require +you to agree to a Contributor License Agreement (CLA) declaring that you have +the right to, and actually do, grant us the rights to use your contribution. +For details, visit https://cla.microsoft.com. + +When you submit a pull request, a CLA-bot will automatically determine whether +you need to provide a CLA and decorate the PR appropriately (e.g., label, +comment). Simply follow the instructions provided by the bot. You will only +need to do this once across all repos using our CLA. + +This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct]. +For more information, see the +[Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or +contact opencode@microsoft.com with any additional questions or comments. + + +<!-- LINKS --> +[azure_cloud_shell]: https://shell.azure.com/bash +[azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions +[azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity +[azure_identity_pypi]: https://pypi.org/project/azure-identity/ +[azure_keyvault]: https://docs.microsoft.com/azure/key-vault/general/overview +[azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli +[azure_sub]: https://azure.microsoft.com/free/ + +[backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations.py +[backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations_async.py + +[code_of_conduct]: https://opensource.microsoft.com/codeofconduct/ + +[default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential + +[hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world.py +[hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world_async.py + +[library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets +[list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations.py +[list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations_async.py + +[managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview + +[pip]: https://pypi.org/project/pip/ +[pypi_package_secrets]: https://pypi.org/project/azure-keyvault-secrets/ + +[recover_purge_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations.py +[recover_purge_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations_async.py +[reference_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs + +[secret_client_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient +[secret_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples +[soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview + + + + +# Release History + +## 4.7.0 (2023-03-16) + +### Features Added +- Added support for service API version `7.4` +- Clients each have a `send_request` method that can be used to send custom requests using the + client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172)) + +### Other Changes +- Python 3.6 is no longer supported. Please use Python version 3.7 or later. +- Key Vault API version `7.4` is now the default +- Updated minimum `azure-core` version to 1.24.0 +- Dropped `msrest` requirement +- Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`) +- Added requirement for `typing-extensions>=4.0.1` + +## 4.6.0 (2022-09-19) + +### Breaking Changes +- Clients verify the challenge resource matches the vault domain. This should affect few customers, + who can provide `verify_challenge_resource=False` to client constructors to disable. + See https://aka.ms/azsdk/blog/vault-uri for more information. + +## 4.5.1 (2022-08-11) + +### Other Changes +- Documentation improvements + ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039)) + +## 4.5.0b1 (2022-06-07) + +### Bugs Fixed +- Port numbers are now preserved in the `vault_url` property of a `KeyVaultSecretIdentifier` + ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446)) + +## 4.4.0 (2022-03-28) + +### Features Added +- Key Vault API version 7.3 is now the default +- Added support for multi-tenant authentication when using `azure-identity` + 1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) +- (From 4.4.0b3) Added `managed` property to SecretProperties + +### Other Changes +- (From 4.4.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- Updated minimum `azure-core` version to 1.20.0 +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See + https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate + this parameter if `get_token` is implemented by a custom credential. + +## 4.4.0b3 (2022-02-08) + +### Features Added +- Added `managed` property to SecretProperties + +### Other Changes +- Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +## 4.4.0b2 (2021-11-11) + +### Features Added +- Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +### Other Changes +- Updated minimum `azure-core` version to 1.15.0 + +## 4.4.0b1 (2021-09-09) + +### Features Added +- Key Vault API version 7.3-preview is now the default + +### Other Changes +- Updated type hints to fix mypy errors + ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158)) + +## 4.3.0 (2021-06-22) +This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+. +### Fixed +- Correct typing for async paging methods + +### Changed +- Key Vault API version 7.2 is now the default +- Updated minimum `msrest` version to 0.6.21 + +### Added +- Added class `KeyVaultSecretIdentifier` that parses out a full ID returned by Key Vault, + so users can easily access the secret's `name`, `vault_url`, and `version`. + +## 4.2.0 (2020-08-11) +### Fixed +- Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers + are no longer redacted in logging output + +### Changed +- Key Vault API version 7.1 is now the default +- Updated minimum `azure-core` version to 1.7.0 + +### Added +- At construction, clients accept a `CustomHookPolicy` through the optional + keyword argument `custom_hook_policy` +- All client requests include a unique ID in the header `x-ms-client-request-id` +- Dependency on `azure-common` for multiapi support + +## 4.2.0b1 (2020-03-10) +- Support for Key Vault API version 7.1-preview +([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124)) + - Added `recoverable_days` to `CertificateProperties` + - Added `ApiVersion` enum identifying Key Vault versions supported by this package + +## 4.1.0 (2020-03-10) +- `SecretClient` instances have a `close` method which closes opened sockets. +Used as a context manager, a `SecretClient` closes opened sockets on exit. +([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906)) +- Pollers no longer sleep after operation completion +([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991)) + +## 4.0.1 (2020-02-11) +- `azure.keyvault.secrets` defines `__version__` +- Challenge authentication policy preserves request options +([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999)) +- Updated `msrest` requirement to >=0.6.0 +- Challenge authentication policy requires TLS +([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457)) +- Methods no longer raise the internal error `KeyVaultErrorException` +([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690)) + +## 4.0.0 (2019-10-31) +### Breaking changes: +- Moved optional parameters of two methods into kwargs ( +[docs](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-keyvault-secrets/4.0.0/azure.keyvault.secrets.html) +detail the new keyword arguments): + - `set_secret` now has positional parameters `name` and `value` + - `update_secret_properties` now has positional parameters `name` and + (optional) `version` +- Renamed `list_secrets` to `list_properties_of_secrets` +- Renamed `list_secret_versions` to `list_properties_of_secret_versions` +- Renamed sync method `delete_secret` to `begin_delete_secret` +- The sync method `begin_delete_secret` and async `delete_secret` now return pollers that return a `DeletedSecret` +- Renamed `Secret` to `KeyVaultSecret` +- `KeyVaultSecret` properties `created`, `expires`, and `updated` renamed to `created_on`, +`expires_on`, and `updated_on` +- The `vault_endpoint` parameter of `SecretClient` has been renamed to `vault_url` +- The property `vault_endpoint` has been renamed to `vault_url` in all models + + +## 4.0.0b4 (2019-10-08) +### Breaking changes: +- `Secret` now has attribute `properties`, which holds certain properties of the +secret, such as `version`. This changes the shape of the returned `Secret` type, +as certain properties of `Secret` (such as `version`) have to be accessed +through the `properties` property. + +- `update_secret` has been renamed to `update_secret_properties` +- The `vault_url` parameter of `SecretClient` has been renamed to `vault_endpoint` +- The property `vault_url` has been renamed to `vault_endpoint` in all models + +### Fixes and improvements +- `list_secrets` and `list_secret_versions` return the correct type + +## 4.0.0b3 (2019-09-11) +This release includes only internal changes. + +## 4.0.0b2 (2019-08-06) +### Breaking changes: +- Removed `azure.core.Configuration` from the public API in preparation for a +revamped configuration API. Static `create_config` methods have been renamed +`_create_config`, and will be removed in a future release. +- This version of the library requires `azure-core` 1.0.0b2 + - If you later want to revert to a version requiring azure-core 1.0.0b1, + of this or another Azure SDK library, you must explicitly install azure-core + 1.0.0b1 as well. For example: + `pip install azure-core==1.0.0b1 azure-keyvault-secrets==4.0.0b1` + +### New features: +- Distributed tracing framework OpenCensus is now supported +- Added support for HTTP challenge based authentication, allowing clients to +interact with vaults in sovereign clouds. + +## 4.0.0b1 (2019-06-28) +Version 4.0.0b1 is the first preview of our efforts to create a user-friendly +and Pythonic client library for Azure Key Vault. For more information about +preview releases of other Azure SDK libraries, please visit +https://aka.ms/azure-sdk-preview1-python. + +This library is not a direct replacement for `azure-keyvault`. Applications +using that library would require code changes to use `azure-keyvault-secrets`. +This package's +[documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) +and +[samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples) +demonstrate the new API. + +### Major changes from `azure-keyvault` +- Packages scoped by functionality + - `azure-keyvault-secrets` contains a client for secret operations, + `azure-keyvault-keys` contains a client for key operations +- Client instances are scoped to vaults (an instance interacts with one vault +only) +- Asynchronous API supported on Python 3.5.3+ + - the `azure.keyvault.secrets.aio` namespace contains an async equivalent of + the synchronous client in `azure.keyvault.secrets` +- Authentication using `azure-identity` credentials + - see this package's + [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) + , and the + [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md) + for more information + +### `azure-keyvault` features not implemented in this library +- Certificate management APIs +- National cloud support. This release supports public global cloud vaults, + e.g. https://{vault-name}.vault.azure.net + + +%package help +Summary: Development documents and examples for azure-keyvault-secrets +Provides: python3-azure-keyvault-secrets-doc +%description help +# Azure Key Vault Secrets client library for Python +Azure Key Vault helps solve the following problems: + +- Secrets management (this library) - +securely store and control access to tokens, passwords, certificates, API keys, +and other secrets +- Cryptographic key management +([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - +create, store, and control access to the keys used to encrypt your data +- Certificate management +([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) - +create, manage, and deploy public and private SSL/TLS certificates +- Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options + +[Source code][library_src] +| [Package (PyPI)][pypi_package_secrets] +| [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/) +| [API reference documentation][reference_docs] +| [Product documentation][azure_keyvault] +| [Samples][secret_samples] + +## _Disclaimer_ + +_Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_. +_Python 3.7 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._ + +## Getting started +### Install packages +Install [azure-keyvault-secrets][pypi_package_secrets] and +[azure-identity][azure_identity_pypi] with [pip][pip]: +```Bash +pip install azure-keyvault-secrets azure-identity +``` +[azure-identity][azure_identity] is used for Azure Active Directory +authentication as demonstrated below. + +### Prerequisites +* An [Azure subscription][azure_sub] +* Python 3.7 or later +* An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli]. + +### Authenticate the client +In order to interact with the Azure Key Vault service, you will need an instance of a [SecretClient][secret_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments. + +See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types. + +#### Create a client +After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a secret client (replacing the value of `VAULT_URL` with your vault's URL): + +<!-- SNIPPET:hello_world.create_secret_client --> + +```python +VAULT_URL = os.environ["VAULT_URL"] +credential = DefaultAzureCredential() +client = SecretClient(vault_url=VAULT_URL, credential=credential) +``` + +<!-- END SNIPPET --> + +> **NOTE:** For an asynchronous client, import `azure.keyvault.secrets.aio`'s `SecretClient` instead. + +## Key concepts +### Secret +A secret consists of a secret value and its associated metadata and management +information. This library handles secret values as strings, but Azure Key Vault +doesn't store them as such. For more information about secrets and how Key +Vault stores and manages them, see the +[Key Vault documentation](https://docs.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates). + +[SecretClient][secret_client_docs] can set secret values in the vault, update +secret metadata, and delete secrets, as shown in the +[examples](#examples) below. + +## Examples +This section contains code snippets covering common tasks: +* [Set a secret](#set-a-secret) +* [Retrieve a secret](#retrieve-a-secret) +* [Update secret metadata](#update-secret-metadata) +* [Delete a secret](#delete-a-secret) +* [List secrets](#list-secrets) +* [Async API](#async-api) +* [Asynchronously create a secret](#asynchronously-create-a-secret) +* [Asynchronously list secrets](#asynchronously-list-secrets) + +### Set a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.set_secret) +creates new secrets and changes the values of existing secrets. If no secret with the +given name exists, `set_secret` creates a new secret with that name and the +given value. If the given name is in use, `set_secret` creates a new version +of that secret, with the given value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Retrieve a secret +[get_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.get_secret) +retrieves a secret previously stored in the Key Vault. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret = secret_client.get_secret("secret-name") + +print(secret.name) +print(secret.value) +``` + +### Update secret metadata +[update_secret_properties](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.update_secret_properties) +updates a secret's metadata. It cannot change the secret's value; use [set_secret](#set-a-secret) to set a secret's +value. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +# Clients may specify the content type of a secret to assist in interpreting the secret data when it's retrieved +content_type = "text/plain" + +# We will also disable the secret for further use + +updated_secret_properties = secret_client.update_secret_properties("secret-name", content_type=content_type, enabled=False) + +print(updated_secret_properties.updated_on) +print(updated_secret_properties.content_type) +print(updated_secret_properties.enabled) +``` + +### Delete a secret +[begin_delete_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.begin_delete_secret) +requests Key Vault delete a secret, returning a poller which allows you to wait for the deletion to finish. Waiting is +helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge (permanently delete) the secret as +soon as possible. When [soft-delete][soft_delete] is disabled, `begin_delete_secret` itself is permanent. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +deleted_secret = secret_client.begin_delete_secret("secret-name").result() + +print(deleted_secret.name) +print(deleted_secret.deleted_date) +``` + +### List secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. This list doesn't include the secret's values. + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient + +credential = DefaultAzureCredential() + +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +### Async API +This library includes a complete set of async APIs. To use them, you must +first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). +See +[azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport) +for more information. + +Async clients and credentials should be closed when they're no longer needed. These +objects are async context managers and define async `close` methods. For +example: + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() + +# call close when the client and credential are no longer needed +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +... +await client.close() +await credential.close() + +# alternatively, use them as async context managers (contextlib.AsyncExitStack can help) +client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +async with client: + async with credential: + ... +``` + +### Asynchronously create a secret +[set_secret](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.set_secret) +creates a secret in the Key Vault with the specified optional arguments. +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +secret = await secret_client.set_secret("secret-name", "secret-value") + +print(secret.name) +print(secret.value) +print(secret.properties.version) +``` + +### Asynchronously list secrets +[list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.list_properties_of_secrets) +lists the properties of all of the secrets in the client's vault. + +```python +from azure.identity.aio import DefaultAzureCredential +from azure.keyvault.secrets.aio import SecretClient + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) +secret_properties = secret_client.list_properties_of_secrets() + +async for secret_property in secret_properties: + # the list doesn't include values or versions of the secrets + print(secret_property.name) +``` + +## Troubleshooting + +See the `azure-keyvault-secrets` +[troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/TROUBLESHOOTING.md) +for details on how to diagnose various failure scenarios. + +### General +Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions]. +For example, if you try to get a key that doesn't exist in the vault, +[SecretClient][secret_client_docs] raises +[ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error): + +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +from azure.core.exceptions import ResourceNotFoundError + +credential = DefaultAzureCredential() +secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential) + +try: + secret_client.get_secret("which-does-not-exist") +except ResourceNotFoundError as e: + print(e.message) +``` + +### Logging +This library uses the standard +[logging](https://docs.python.org/3.5/library/logging.html) library for logging. +Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO +level. + +Detailed DEBUG level logging, including request/response bodies and unredacted +headers, can be enabled on a client with the `logging_enable` argument: +```python +from azure.identity import DefaultAzureCredential +from azure.keyvault.secrets import SecretClient +import sys +import logging + +# Create a logger for the 'azure' SDK +logger = logging.getLogger('azure') +logger.setLevel(logging.DEBUG) + +# Configure a console output +handler = logging.StreamHandler(stream=sys.stdout) +logger.addHandler(handler) + +credential = DefaultAzureCredential() + +# This client will log detailed information about its HTTP sessions, at DEBUG level +secret_client = SecretClient( + vault_url="https://my-key-vault.vault.azure.net/", + credential=credential, + logging_enable=True +) +``` + +Similarly, `logging_enable` can enable detailed logging for a single operation, +even when it isn't enabled for the client: +```python +secret_client.get_secret("my-secret", logging_enable=True) +``` + +## Next steps +Several samples are available in the Azure SDK for Python GitHub repository. +These provide example code for additional Key Vault scenarios: +| File | Description | +|-------------|-------------| +| [hello_world.py][hello_world_sample] ([async version][hello_world_async_sample]) | create/get/update/delete secrets | +| [list_operations.py][list_operations_sample] ([async version][list_operations_async_sample]) | basic list operations for secrets | +| [backup_restore_operations.py][backup_operations_sample] ([async version][backup_operations_async_sample]) | back up and restore secrets | +| [recover_purge_operations.py][recover_purge_sample] ([async version][recover_purge_async_sample]) | recover and purge secrets | + +### Additional Documentation +For more extensive documentation on Azure Key Vault, see the +[API reference documentation][reference_docs]. + +## Contributing +This project welcomes contributions and suggestions. Most contributions require +you to agree to a Contributor License Agreement (CLA) declaring that you have +the right to, and actually do, grant us the rights to use your contribution. +For details, visit https://cla.microsoft.com. + +When you submit a pull request, a CLA-bot will automatically determine whether +you need to provide a CLA and decorate the PR appropriately (e.g., label, +comment). Simply follow the instructions provided by the bot. You will only +need to do this once across all repos using our CLA. + +This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct]. +For more information, see the +[Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or +contact opencode@microsoft.com with any additional questions or comments. + + +<!-- LINKS --> +[azure_cloud_shell]: https://shell.azure.com/bash +[azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions +[azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity +[azure_identity_pypi]: https://pypi.org/project/azure-identity/ +[azure_keyvault]: https://docs.microsoft.com/azure/key-vault/general/overview +[azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli +[azure_sub]: https://azure.microsoft.com/free/ + +[backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations.py +[backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations_async.py + +[code_of_conduct]: https://opensource.microsoft.com/codeofconduct/ + +[default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential + +[hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world.py +[hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world_async.py + +[library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets +[list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations.py +[list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations_async.py + +[managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview + +[pip]: https://pypi.org/project/pip/ +[pypi_package_secrets]: https://pypi.org/project/azure-keyvault-secrets/ + +[recover_purge_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations.py +[recover_purge_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations_async.py +[reference_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs + +[secret_client_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient +[secret_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples +[soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview + + + + +# Release History + +## 4.7.0 (2023-03-16) + +### Features Added +- Added support for service API version `7.4` +- Clients each have a `send_request` method that can be used to send custom requests using the + client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172)) + +### Other Changes +- Python 3.6 is no longer supported. Please use Python version 3.7 or later. +- Key Vault API version `7.4` is now the default +- Updated minimum `azure-core` version to 1.24.0 +- Dropped `msrest` requirement +- Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`) +- Added requirement for `typing-extensions>=4.0.1` + +## 4.6.0 (2022-09-19) + +### Breaking Changes +- Clients verify the challenge resource matches the vault domain. This should affect few customers, + who can provide `verify_challenge_resource=False` to client constructors to disable. + See https://aka.ms/azsdk/blog/vault-uri for more information. + +## 4.5.1 (2022-08-11) + +### Other Changes +- Documentation improvements + ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039)) + +## 4.5.0b1 (2022-06-07) + +### Bugs Fixed +- Port numbers are now preserved in the `vault_url` property of a `KeyVaultSecretIdentifier` + ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446)) + +## 4.4.0 (2022-03-28) + +### Features Added +- Key Vault API version 7.3 is now the default +- Added support for multi-tenant authentication when using `azure-identity` + 1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) +- (From 4.4.0b3) Added `managed` property to SecretProperties + +### Other Changes +- (From 4.4.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- Updated minimum `azure-core` version to 1.20.0 +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See + https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate + this parameter if `get_token` is implemented by a custom credential. + +## 4.4.0b3 (2022-02-08) + +### Features Added +- Added `managed` property to SecretProperties + +### Other Changes +- Python 2.7 is no longer supported. Please use Python version 3.6 or later. +- (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge + authentication requests now pass in a `tenant_id` keyword argument + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +## 4.4.0b2 (2021-11-11) + +### Features Added +- Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer + ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)) + +### Other Changes +- Updated minimum `azure-core` version to 1.15.0 + +## 4.4.0b1 (2021-09-09) + +### Features Added +- Key Vault API version 7.3-preview is now the default + +### Other Changes +- Updated type hints to fix mypy errors + ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158)) + +## 4.3.0 (2021-06-22) +This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+. +### Fixed +- Correct typing for async paging methods + +### Changed +- Key Vault API version 7.2 is now the default +- Updated minimum `msrest` version to 0.6.21 + +### Added +- Added class `KeyVaultSecretIdentifier` that parses out a full ID returned by Key Vault, + so users can easily access the secret's `name`, `vault_url`, and `version`. + +## 4.2.0 (2020-08-11) +### Fixed +- Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers + are no longer redacted in logging output + +### Changed +- Key Vault API version 7.1 is now the default +- Updated minimum `azure-core` version to 1.7.0 + +### Added +- At construction, clients accept a `CustomHookPolicy` through the optional + keyword argument `custom_hook_policy` +- All client requests include a unique ID in the header `x-ms-client-request-id` +- Dependency on `azure-common` for multiapi support + +## 4.2.0b1 (2020-03-10) +- Support for Key Vault API version 7.1-preview +([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124)) + - Added `recoverable_days` to `CertificateProperties` + - Added `ApiVersion` enum identifying Key Vault versions supported by this package + +## 4.1.0 (2020-03-10) +- `SecretClient` instances have a `close` method which closes opened sockets. +Used as a context manager, a `SecretClient` closes opened sockets on exit. +([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906)) +- Pollers no longer sleep after operation completion +([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991)) + +## 4.0.1 (2020-02-11) +- `azure.keyvault.secrets` defines `__version__` +- Challenge authentication policy preserves request options +([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999)) +- Updated `msrest` requirement to >=0.6.0 +- Challenge authentication policy requires TLS +([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457)) +- Methods no longer raise the internal error `KeyVaultErrorException` +([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690)) + +## 4.0.0 (2019-10-31) +### Breaking changes: +- Moved optional parameters of two methods into kwargs ( +[docs](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-keyvault-secrets/4.0.0/azure.keyvault.secrets.html) +detail the new keyword arguments): + - `set_secret` now has positional parameters `name` and `value` + - `update_secret_properties` now has positional parameters `name` and + (optional) `version` +- Renamed `list_secrets` to `list_properties_of_secrets` +- Renamed `list_secret_versions` to `list_properties_of_secret_versions` +- Renamed sync method `delete_secret` to `begin_delete_secret` +- The sync method `begin_delete_secret` and async `delete_secret` now return pollers that return a `DeletedSecret` +- Renamed `Secret` to `KeyVaultSecret` +- `KeyVaultSecret` properties `created`, `expires`, and `updated` renamed to `created_on`, +`expires_on`, and `updated_on` +- The `vault_endpoint` parameter of `SecretClient` has been renamed to `vault_url` +- The property `vault_endpoint` has been renamed to `vault_url` in all models + + +## 4.0.0b4 (2019-10-08) +### Breaking changes: +- `Secret` now has attribute `properties`, which holds certain properties of the +secret, such as `version`. This changes the shape of the returned `Secret` type, +as certain properties of `Secret` (such as `version`) have to be accessed +through the `properties` property. + +- `update_secret` has been renamed to `update_secret_properties` +- The `vault_url` parameter of `SecretClient` has been renamed to `vault_endpoint` +- The property `vault_url` has been renamed to `vault_endpoint` in all models + +### Fixes and improvements +- `list_secrets` and `list_secret_versions` return the correct type + +## 4.0.0b3 (2019-09-11) +This release includes only internal changes. + +## 4.0.0b2 (2019-08-06) +### Breaking changes: +- Removed `azure.core.Configuration` from the public API in preparation for a +revamped configuration API. Static `create_config` methods have been renamed +`_create_config`, and will be removed in a future release. +- This version of the library requires `azure-core` 1.0.0b2 + - If you later want to revert to a version requiring azure-core 1.0.0b1, + of this or another Azure SDK library, you must explicitly install azure-core + 1.0.0b1 as well. For example: + `pip install azure-core==1.0.0b1 azure-keyvault-secrets==4.0.0b1` + +### New features: +- Distributed tracing framework OpenCensus is now supported +- Added support for HTTP challenge based authentication, allowing clients to +interact with vaults in sovereign clouds. + +## 4.0.0b1 (2019-06-28) +Version 4.0.0b1 is the first preview of our efforts to create a user-friendly +and Pythonic client library for Azure Key Vault. For more information about +preview releases of other Azure SDK libraries, please visit +https://aka.ms/azure-sdk-preview1-python. + +This library is not a direct replacement for `azure-keyvault`. Applications +using that library would require code changes to use `azure-keyvault-secrets`. +This package's +[documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) +and +[samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples) +demonstrate the new API. + +### Major changes from `azure-keyvault` +- Packages scoped by functionality + - `azure-keyvault-secrets` contains a client for secret operations, + `azure-keyvault-keys` contains a client for key operations +- Client instances are scoped to vaults (an instance interacts with one vault +only) +- Asynchronous API supported on Python 3.5.3+ + - the `azure.keyvault.secrets.aio` namespace contains an async equivalent of + the synchronous client in `azure.keyvault.secrets` +- Authentication using `azure-identity` credentials + - see this package's + [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md) + , and the + [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md) + for more information + +### `azure-keyvault` features not implemented in this library +- Certificate management APIs +- National cloud support. This release supports public global cloud vaults, + e.g. https://{vault-name}.vault.azure.net + + +%prep +%autosetup -n azure-keyvault-secrets-4.7.0 + +%build +%py3_build + +%install +%py3_install +install -d -m755 %{buildroot}/%{_pkgdocdir} +if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi +if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi +if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi +if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi +pushd %{buildroot} +if [ -d usr/lib ]; then + find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/lib64 ]; then + find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/bin ]; then + find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/sbin ]; then + find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst +fi +touch doclist.lst +if [ -d usr/share/man ]; then + find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst +fi +popd +mv %{buildroot}/filelist.lst . +mv %{buildroot}/doclist.lst . + +%files -n python3-azure-keyvault-secrets -f filelist.lst +%dir %{python3_sitelib}/* + +%files help -f doclist.lst +%{_docdir}/* + +%changelog +* Mon Apr 10 2023 Python_Bot <Python_Bot@openeuler.org> - 4.7.0-1 +- Package Spec generated |