Support managed identity for Event Grid

[bachuv]

This PR adds support for managed identity for publishing events to Event Grid.

I tested this by publishing Durable Functions events to Event Grid and then sent those events to an Azure Storage Queue.

For context, customers currently specify the event grid topic key through host.json and local.settings.json (https://learn.microsoft.com/en-us/azure/azure-functions/durable/durable-functions-event-publishing?tabs=csharp-script):

• host.json

{
  "version": "2.0",
  "extensions": {
    "durableTask": {
      "notifications": {
        "eventGrid": {
          "topicEndpoint": "https://<topic_name>.westus2-1.eventgrid.azure.net/api/events",
          "keySettingName": "EventGridKey"
        }
      }
    }
  }
}

• local.settings.json

{
    "IsEncrypted": false,
    "Values": {
        "AzureWebJobsStorage": "UseDevelopmentStorage=true",
        "EventGridKey": "<topic_key>"
    }
}

This PR adds the following configuration support.

System Assigned Managed identity configuration:

App Settings

• Add EventGrid__topicEndpoint app setting with the value as the Event Grid topic endpoint

Configuration

• Turn on system assigned identity for the function app
• In the event grid topic resource, give the function app the EventGrid Data Sender role.

User Assigned Managed identity configuration:

App Settings

• Add EventGrid__topicEndpoint app setting with the value as the Event Grid topic endpoint
• Add EventGrid__credential app setting with the value managedidentity
• Add EventGrid__clientId app setting with the value of the user assigned managed identity client ID.

Configuration

• Create a user assigned managed identity (uami)
• Attach the uami to the function app resource (in the Identity section)
• Attach the uami to the event grid topic resource (in the Identity section)
• Create an event grid subscription and enable managed identity with the uami
• In the event grid topic resource, assign the EventGrid Data Sender role to the uami
• (If publishing events from the event grid to an Azure Storage queue) In the Azure Storage resource, assign the Storage Queue Data Message Sender role to the uami

Resolves #2924

Pull request checklist

• My changes do not require documentation changes
  • Otherwise: Documentation PR is ready to merge and referenced in pending_docs.md
• My changes should not be added to the release notes for the next release
  • Otherwise: I've added my notes to release_notes.md
• My changes do not need to be backported to a previous version
  • Otherwise: Backport tracked by issue/PR #issue_or_pr
• I have added all required tests (Unit tests, E2E tests)
• My changes do not require any extra work to be leveraged by OutOfProc SDKs
  • Otherwise: That work is being tracked here: #issue_or_pr_in_each_sdk
• My changes do not change the version of the WebJobs.Extensions.DurableTask package
  • Otherwise: major or minor version updates are reflected in /src/Worker.Extensions.DurableTask/AssemblyInfo.cs
• My changes do not add EventIds to our EventSource logs
  • Otherwise: Ensure the EventIds are within the supported range in our existing Windows infrastructure. You may validate this with a deployed app's telemetry. You may also extend the range by completing a PR such as this one.
• My changes should be added to v2.x branch.
  • Otherwise: This change applies exclusively to WebJobs.Extensions.DurableTask v3.x. It will be retained only in the dev and main branches and will not be merged into the v2.x branch.

[nytian]

Thanks for the PR! Left a comment. Also, can you remove those alerts about the PR? And have we done any e2e testing on Azure about msi?

[cgillum]

I'm concerned about the large code churn in the latest iteration. I'm also concerned about the potential complexities and dangers of caching tasks, which have caused major outages for customers in other contexts.

Can we explore a simpler solution, such as keeping initialization as it was before, but calling SetUpAuthenticationAsync() inside an existing async method that we always run, such as inside the StartTaskHubWorkerIfNotStartedAsync() method?

[cgillum]

One change we should consider in the future is the ability to choose a credential type other than DefaultAzureCredential. This credential type is convenient but can cause problems or unexpected behavior in some setups because it may not always choose to use managed identity, even if managed identity is available.