I have a working app in ASP.NET Core 6 RC2. It stores data protection keys in Azure Blob Storage, and protects them with Key Vault:

builder.Services.AddDataProtection()
  .PersistKeysToAzureBlobStorage(new Uri(config["DataProtectionBlobUri"]))
  .ProtectKeysWithAzureKeyVault(
    new Uri(config["DataProtectionKey"]),
    new ClientSecretCredential(config["MicrosoftTenantId"], config["MicrosoftClientId"], config["MicrosoftClientSecret"])
  );

In the Dockerfile, if I change these lines:

FROM mcr.microsoft.com/dotnet/aspnet:6.0.0-rc.2 AS base
...
FROM mcr.microsoft.com/dotnet/sdk:6.0.100-rc.2 AS build

to

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
...
FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build

Then the app still runs, but it seems not to be picking up the keys from Azure correctly. All existing cookies and encrypted strings are rejected (which possibly suggests that the existing keys are not found, and it's generating new random keys at runtime). Reverting to RC2 makes everything work again.

An example error message is, when trying to decrypt a string: The payload was invalid. For more information go to http://aka.ms/dataprotectionwarning

The package versions are:

• Azure.Extensions.AspNetCore.DataProtection.Blobs v1.2.1
• Azure.Extensions.AspNetCore.DataProtection.Keys v1.1.0
• Azure.Storage.Blobs v12.10.0