public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SecretsManager: add data key store (#107396)

Browse Source 
* SecretsManager: Add data key store

Co-authored-by: Michael Mandrus <michael.mandrus@grafana.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>

* SecretsManager: Add wiring of data key store

Co-authored-by: Michael Mandrus <michael.mandrus@grafana.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>

---------

Co-authored-by: Michael Mandrus <michael.mandrus@grafana.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
This commit is contained in:
Dana Axinte
2025-06-30 17:17:07 +01:00
committed by GitHub
co-authored by Michael Mandrus Matheus Macabu
parent 2d634639a2
commit 0fccc01ebe
39 changed files with 1097 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/secret/migrator/migrator.go
+43 -25
View File
@@ -15,6 +15,7 @@ const (
TableNameKeeper = "secret_keeper"
TableNameSecureValue = "secret_secure_value"
TableNameSecureValueOutbox = "secret_secure_value_outbox"
TableNameDataKey = "secret_data_key"
TableNameEncryptedValue = "secret_encrypted_value"
)
@@ -45,31 +46,6 @@ func (*SecretDB) AddMigration(mg *migrator.Migrator) {
tables := []migrator.Table{}
tables = append(tables, migrator.Table{
Name: TableNameKeeper,
Columns: []*migrator.Column{
// Kubernetes Metadata
{Name: "guid", Type: migrator.DB_NVarchar, Length: 36, IsPrimaryKey: true}, // Fixed size of a UUID.
{Name: "name", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Limit enforced by K8s.
{Name: "namespace", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Limit enforced by K8s.
{Name: "annotations", Type: migrator.DB_Text, Nullable: true},
{Name: "labels", Type: migrator.DB_Text, Nullable: true},
{Name: "created", Type: migrator.DB_BigInt, Nullable: false},
{Name: "created_by", Type: migrator.DB_Text, Nullable: false},
{Name: "updated", Type: migrator.DB_BigInt, Nullable: false}, // Used as RV (ResourceVersion)
{Name: "updated_by", Type: migrator.DB_Text, Nullable: false},
// Spec
{Name: "description", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Chosen arbitrarily, but should be enough.
{Name: "type", Type: migrator.DB_Text, Nullable: false},
// Each keeper has a different payload so we store the whole thing as a blob.
{Name: "payload", Type: migrator.DB_Text, Nullable: true},
},
Indices: []*migrator.Index{
{Cols: []string{"namespace", "name"}, Type: migrator.UniqueIndex},
},
})
tables = append(tables, migrator.Table{
Name: TableNameSecureValue,
Columns: []*migrator.Column{
@@ -100,6 +76,48 @@ func (*SecretDB) AddMigration(mg *migrator.Migrator) {
},
})
tables = append(tables, migrator.Table{
Name: TableNameKeeper,
Columns: []*migrator.Column{
// Kubernetes Metadata
{Name: "guid", Type: migrator.DB_NVarchar, Length: 36, IsPrimaryKey: true}, // Fixed size of a UUID.
{Name: "name", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Limit enforced by K8s.
{Name: "namespace", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Limit enforced by K8s.
{Name: "annotations", Type: migrator.DB_Text, Nullable: true},
{Name: "labels", Type: migrator.DB_Text, Nullable: true},
{Name: "created", Type: migrator.DB_BigInt, Nullable: false},
{Name: "created_by", Type: migrator.DB_Text, Nullable: false},
{Name: "updated", Type: migrator.DB_BigInt, Nullable: false}, // Used as RV (ResourceVersion)
{Name: "updated_by", Type: migrator.DB_Text, Nullable: false},
// Spec
{Name: "description", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Chosen arbitrarily, but should be enough.
{Name: "type", Type: migrator.DB_Text, Nullable: false},
// Each keeper has a different payload so we store the whole thing as a blob.
{Name: "payload", Type: migrator.DB_Text, Nullable: true},
},
Indices: []*migrator.Index{
{Cols: []string{"namespace", "name"}, Type: migrator.UniqueIndex},
},
})
// TODO -- document how the seemingly arbitrary column lengths were chosen
// The answer for now is that they come from the legacy secrets service, but it would be good to know that they will still work in the new service
tables = append(tables, migrator.Table{
Name: TableNameDataKey,
Columns: []*migrator.Column{
{Name: "uid", Type: migrator.DB_NVarchar, Length: 100, IsPrimaryKey: true},
{Name: "namespace", Type: migrator.DB_NVarchar, Length: 253, Nullable: false}, // Limit enforced by K8s.
{Name: "label", Type: migrator.DB_NVarchar, Length: 100, IsPrimaryKey: false},
{Name: "active", Type: migrator.DB_Bool, Nullable: false},
{Name: "provider", Type: migrator.DB_NVarchar, Length: 50, Nullable: false},
{Name: "encrypted_data", Type: migrator.DB_Blob, Nullable: false},
{Name: "created", Type: migrator.DB_DateTime, Nullable: false},
{Name: "updated", Type: migrator.DB_DateTime, Nullable: false},
},
Indices: []*migrator.Index{}, // TODO: add indexes based on the queries we make.
})
tables = append(tables, migrator.Table{
Name: TableNameEncryptedValue,
Columns: []*migrator.Column{