feat: avm/res/cache/redis: add support for AKV secrets export

[JeffreyCA]

Description

Closes #4137

Add support for AKV secrets export by introducing a new secretsExportConfiguration input param as per https://azure.github.io/Azure-Verified-Modules/specs/bcp/res/interfaces/#secrets-export.

In addition to the primary and secondary access key, I also added support for connection strings in the form rediss://..., which is supported by most Redis clients:

• Lettuce
• Jedis
• node-redis
• redis-py

Secret key name	Secret value
secretsExportConfiguration.primaryAccessKeyName	Primary access key
secretsExportConfiguration.primaryConnectionStringName	TLS-enabled primary connection string in Redis URI form: rediss://:<primaryaccesskey>@<hostname>:6380
secretsExportConfiguration.secondaryAccessKeyName	Secondary access key
secretsExportConfiguration.secondaryConnectionStringName	TLS-enabled secondary connection string in Redis URI form: rediss://:<secondaryaccesskey>@<hostname>:6380

Usage example:

module redis 'br/public:avm/res/cache/redis:<version>' = {
  name: 'redisDeployment'
  params: {
    // Required parameters
    name: 'kvref'
    // Non-required parameters
    location: '<location>'
    secretsExportConfiguration: {
      keyVaultResourceId: '<keyVaultResourceId>'
      primaryAccessKeyName: 'custom-primaryAccessKey-name'
      primaryConnectionStringName: 'custom-primaryConnectionString-name'
      secondaryAccessKeyName: 'custom-secondaryAccessKey-name'
      secondaryConnectionStringName: 'custom-secondaryConnectionString-name'
    }
  }
}

Pipeline Reference

Ran the kv-secrets E2E test locally and passed:

Pipeline

Type of Change

• Update to CI Environment or utilities (Non-module affecting changes)
• Azure Verified Module updates:
  • Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in version.json:
    • Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description.
    • The bug was found by the module author, and no one has opened an issue to report it yet.
  • Feature update backwards compatible feature updates, and I have bumped the MINOR version in version.json.
  • Breaking changes and I have bumped the MAJOR version in version.json.
  • Update to documentation

Checklist

• I'm sure there are no other open Pull Requests for the same update/change
• I have run Set-AVMModule locally to generate the supporting module files.
• My corresponding pipelines / checks run clean and green without any errors or warnings

[AlexanderSehr]

Great work @JeffreyCA, much appreciated 💪

[JeffreyCA]

Great work @JeffreyCA, much appreciated 💪

Thanks for the review, do I need any other approvals?

[AlexanderSehr]

Great work @JeffreyCA, much appreciated 💪

Thanks for the review, do I need any other approvals?

Now that you mention it. Actually yes - @hundredacres, could you give it a look? From where I'm standing it looks good :) Your review & approval would be much appreciated.

[hundredacres]

Looks good to me.

[hundredacres]

Approved.

[Ipifo]

Great work on add this feature to the Redis Cache resource. I was wondering if the Connection String could have the same format as what you would find in the 'Settings -> Authentication -> Access Key -> Primary connection string (StackExchange.Redis) & Secondary connection string (StackExchange.Redis)' This format looks like this;
redis-cache-DEV-aue02.redis.cache.windows.net:6380,password==,ssl=True,abortConnect=False
currently the connection string format being saved in key vault looks like this.
rediss://:*********@redis-cache-DEV-aue02.redis.cache.windows.net:6380.

[JeffreyCA]

Good point - unlike most Redis clients, the StackExchange.Redis client (for .NET) uses its own connection string format and doesn't support the redis[s]:// style connection strings: StackExchange/StackExchange.Redis#1590. I originally added the rediss:// one as it was the more universally accepted one.

@AlexanderSehr @hundredacres I was thinking maybe we could add another pair of exportable secrets, something like primaryStackExchangeRedisConnectionStringName/secondaryStackExchangeRedisConnectionStringName. Any thoughts?

[hundredacres]

Sounds good to me. Happy to take a PR, or I can whip something up tomorrow

[JeffreyCA]

Sounds good to me. Happy to take a PR, or I can whip something up tomorrow

Sure, I opened #4343