Secrets manager: create secure value using the active keeper (#114039)

* Secrets manager: create secure value using the active keeper

* SecureValueService.Update: fetch secure value from db to get the keeper

* fix keeper_store_test.go

* SecureValueService: fix bug in update where the current version keeper wasn't being passed to the createNewVersion method

* make gofmt

* remove outdated test

* update TestModel

* undo enterprise_imports changes

* use xkube.Namespace

* migrator: set secret_secure_value.keeper to 'system' when the column is null

* indent cue

* fix tests

* fix enterprise imports

* properly fix enterprise imports

* make update-workspace

* go mod tidy

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>

apps/secret/kinds/v1beta1/securevalue.cue

@@ -29,13 +29,6 @@ SecureValueSpec: {
 	// +optional
 	ref?: string & strings.MinRunes(1) & strings.MaxRunes(1024)
 
-	// Name of the keeper, being the actual storage of the secure value.
-	// If not specified, the default keeper for the namespace will be used.
-	// +k8s:validation:minLength=1
-	// +k8s:validation:maxLength=253
-	// +optional
-	keeper?: string & strings.MinRunes(1) & strings.MaxRunes(253)
-
 	// The Decrypters that are allowed to decrypt this secret.
 	// An empty list means no service can decrypt it.
 	// +k8s:validation:maxItems=64
@@ -53,4 +46,7 @@ SecureValueStatus: {
 	// External ID where the secret is stored. Cannot be set.
 	// +optional
 	externalID: string
+
+	// The name of the keeper used to create the secure value. Cannot be set.
+	keeper: string
 }

apps/secret/pkg/apis/secret/v1beta1/register.go

@@ -28,7 +28,7 @@ var SecureValuesResourceInfo = utils.NewResourceInfo(
 		},
 		Reader: func(obj any) ([]any, error) {
 			if r, ok := obj.(*SecureValue); ok {
-				return []any{r.Name, r.Spec.Description, r.Spec.Keeper, r.Spec.Ref}, nil
+				return []any{r.Name, r.Spec.Description, r.Status.Keeper, r.Spec.Ref}, nil
 			}
 
 			return nil, fmt.Errorf("expected SecureValue but got %T", obj)

apps/secret/pkg/apis/secret/v1beta1/securevalue_spec_gen.go

@@ -25,12 +25,6 @@ type SecureValueSpec struct {
 	// +k8s:validation:maxLength=1024
 	// +optional
 	Ref *string `json:"ref,omitempty"`
-	// Name of the keeper, being the actual storage of the secure value.
-	// If not specified, the default keeper for the namespace will be used.
-	// +k8s:validation:minLength=1
-	// +k8s:validation:maxLength=253
-	// +optional
-	Keeper *string `json:"keeper,omitempty"`
 	// The Decrypters that are allowed to decrypt this secret.
 	// An empty list means no service can decrypt it.
 	// +k8s:validation:maxItems=64

apps/secret/pkg/apis/secret/v1beta1/securevalue_status_gen.go

@@ -25,12 +25,14 @@ type SecureValueStatus struct {
 	// Version of the secure value. Cannot be set.
 	// +optional
 	Version int64 `json:"version"`
-	// operatorStates is a map of operator ID to operator state evaluations.
-	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
-	OperatorStates map[string]SecureValuestatusOperatorState `json:"operatorStates,omitempty"`
 	// External ID where the secret is stored. Cannot be set.
 	// +optional
 	ExternalID string `json:"externalID"`
+	// operatorStates is a map of operator ID to operator state evaluations.
+	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
+	OperatorStates map[string]SecureValuestatusOperatorState `json:"operatorStates,omitempty"`
+	// The name of the keeper used to create the secure value. Cannot be set.
+	Keeper string `json:"keeper"`
 	// additionalFields is reserved for future use
 	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
 }

apps/secret/pkg/apis/secret/v1beta1/zz_openapi_gen.go

@@ -587,15 +587,6 @@ func schema_pkg_apis_secret_v1beta1_SecureValueSpec(ref common.ReferenceCallback
 							Format:      "",
 						},
 					},
-					"keeper": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Name of the keeper, being the actual storage of the secure value. If not specified, the default keeper for the namespace will be used.",
-							MinLength:   ptr.To[int64](1),
-							MaxLength:   ptr.To[int64](253),
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
 					"decrypters": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -639,6 +630,14 @@ func schema_pkg_apis_secret_v1beta1_SecureValueStatus(ref common.ReferenceCallba
 							Format:      "int64",
 						},
 					},
+					"externalID": {
+						SchemaProps: spec.SchemaProps{
+							Description: "External ID where the secret is stored. Cannot be set.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"operatorStates": {
 						SchemaProps: spec.SchemaProps{
 							Description: "operatorStates is a map of operator ID to operator state evaluations. Any operator which consumes this kind SHOULD add its state evaluation information to this field.",
@@ -654,9 +653,9 @@ func schema_pkg_apis_secret_v1beta1_SecureValueStatus(ref common.ReferenceCallba
 							},
 						},
 					},
-					"externalID": {
+					"keeper": {
 						SchemaProps: spec.SchemaProps{
-							Description: "External ID where the secret is stored. Cannot be set.",
+							Description: "The name of the keeper used to create the secure value. Cannot be set.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -678,6 +677,7 @@ func schema_pkg_apis_secret_v1beta1_SecureValueStatus(ref common.ReferenceCallba
 						},
 					},
 				},
+				Required: []string{"keeper"},
 			},
 		},
 		Dependencies: []string{