Azure Cosmos SDK upgrade for kv store

[ChihweiLHBird]

Closes #3021.

Summary

Migrates spin-key-value-azure from the legacy Azure Cosmos SDK to the current azure_data_cosmos 0.37 (driver 0.6.0) / azure_core 1.0 / azure_identity 1.0 stack. Reworks client construction and the item/query APIs, keeps account-key auth, and replaces the old ambient-auth path with explicit Azure AD credential selection.

What Changed

• Reworked Cosmos client creation to use AccountReference, async container-client init, and SDK-managed routing (RoutingStrategy::ProximityTo); moved CRUD/batch/increment/CAS to the new APIs (get is now a read_item point read) and dropped the old custom connection pooling and reqwest transport setup.
• Built with default-features = false + key_auth/native_tls/hmac_rust so the Azure stack uses OpenSSL instead of pulling reqwest's aws-lc-rs rustls provider alongside Spin's workspace-pinned ring.
• Replaced ambient auth with explicit AAD credential selection via auth_type, including user-assigned managed identity by client_id; account-key auth is unchanged.
• Added optional region runtime config (defaults to East US) used as the routing proximity anchor, and account validation at spin up.
• Compare-and-swap now maps only optimistic-concurrency failures — 412 (stale etag), 409 (raced create), and 404 (item deleted between current and swap) — to retryable CAS failures, and everything else to hard errors.
• get-many now returns (key, none) for missing keys per the wasi:keyvalue batch contract instead of dropping them.

Runtime Config

Existing account-key configuration works unchanged. When key is omitted, auth_type selects the AAD credential: developer_tools (default), managed_identity (optionally with client_id), workload_identity, or service_principal (reads AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET). There is no fallback between types. Optionally set region to bias routing toward the closest replica.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Modernizes the Azure Cosmos-backed key-value store to use newer Azure SDK APIs and adds explicit Azure AD authentication options plus region-aware routing.

Changes:

• Migrates Cosmos DB interactions from older CollectionClient/document APIs to ContainerClient item APIs with lazy client initialization.
• Adds explicit Azure AD credential selection (auth_type + optional client_id) and optional region configuration for proximity-based routing.
• Updates Azure SDK dependency versions and removes the old connection-pooling feature wiring.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 6 comments.

File	Description
crates/key-value-azure/src/store.rs	Refactors Cosmos client initialization + CRUD/CAS operations to new SDK APIs; adds auth parsing/utilities and unit tests.
crates/key-value-azure/src/lib.rs	Extends runtime config with region, auth_type, and client_id; wires them into store construction and exports AzureCredentialKind.
crates/key-value-azure/Cargo.toml	Updates Azure SDK dependencies to newer major versions; removes old connection-pooling feature block.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 5 comments.