public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Reduce amount of feature toggle checks to only app entrypoint (#108110)

Browse Source 
* Secrets: Reduce amount of feature toggle checks to only app entrypoint

* Wire: Fix merge conflict

* Wire: Fix merge conflict
This commit is contained in:
Matheus Macabu
2025-07-16 10:56:59 +02:00
committed by GitHub
parent 4cc4c6c666
commit 2c4bbf8b1d
14 changed files with 56 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/encryption/manager/manager_test.go
+5 -11
View File
@@ -17,7 +17,6 @@ import (
"github.com/grafana/grafana/pkg/registry/apis/secret/encryption"
"github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher/service"
osskmsproviders "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/storage/secret/database"
@@ -78,9 +77,8 @@ func TestEncryptionService_EnvelopeEncryption(t *testing.T) {
func TestEncryptionService_DataKeys(t *testing.T) {
// Initialize data key storage with a fake db
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
tracer := noop.NewTracerProvider().Tracer("test")
store, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, features, nil)
store, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, nil)
require.NoError(t, err)
ctx := context.Background()
@@ -183,10 +181,9 @@ func TestEncryptionService_UseCurrentProvider(t *testing.T) {
},
}
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
tracer := noop.NewTracerProvider().Tracer("test")
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, features, nil)
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, nil)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
@@ -259,9 +256,8 @@ func TestEncryptionService_SecretKeyVersionUpgrade(t *testing.T) {
}
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
features := featuremgmt.WithFeatures(featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs, featuremgmt.FlagSecretsManagementAppPlatform)
tracer := noop.NewTracerProvider().Tracer("test")
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, features, nil)
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, nil)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
@@ -345,8 +341,7 @@ func TestEncryptionService_SecretKeyVersionUpgrade(t *testing.T) {
t.Run("encrypting with v1 then removing the v1 config should cause decryption to fail", func(t *testing.T) {
tracer := noop.NewTracerProvider().Tracer("test")
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
features := featuremgmt.WithFeatures(featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs, featuremgmt.FlagSecretsManagementAppPlatform)
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, features, nil)
encryptionStore, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, nil)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
@@ -540,7 +535,6 @@ func TestIntegration_SecretsService(t *testing.T) {
t.Run(name, func(t *testing.T) {
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
tracer := noop.NewTracerProvider().Tracer("test")
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
cfg := &setting.Cfg{
SecretsManagement: setting.SecretsManagerSettings{
@@ -548,7 +542,7 @@ func TestIntegration_SecretsService(t *testing.T) {
ConfiguredKMSProviders: map[string]map[string]string{"secret_key.v1": {"secret_key": "SW2YcwTIb9zpOOhoPsMm"}},
},
}
store, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, features, nil)
store, err := encryptionstorage.ProvideDataKeyStorage(database.ProvideDatabase(testDB, tracer), tracer, nil)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
pkg/registry/apis/secret/encryption/manager/test_helpers.go
+1 -3
View File
@@ -9,7 +9,6 @@ import (
"github.com/grafana/grafana/pkg/infra/usagestats"
"github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher/service"
osskmsproviders "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/storage/secret/database"
@@ -24,7 +23,6 @@ func setupTestService(tb testing.TB) *EncryptionManager {
tracer := noop.NewTracerProvider().Tracer("test")
database := database.ProvideDatabase(testDB, tracer)
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
defaultKey := "SdlklWklckeLS"
cfg := &setting.Cfg{
SecretsManagement: setting.SecretsManagerSettings{
@@ -32,7 +30,7 @@ func setupTestService(tb testing.TB) *EncryptionManager {
ConfiguredKMSProviders: map[string]map[string]string{"secret_key.v1": {"secret_key": defaultKey}},
},
}
store, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, features, nil)
store, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, nil)
require.NoError(tb, err)
usageStats := &usagestats.UsageStatsMock{T: tb}
pkg/registry/apis/secret/register.go
+5 -4
View File
@@ -19,15 +19,16 @@ func RegisterDependencies(
secretDBMigrator contracts.SecretDBMigrator,
accessControlService accesscontrol.Service,
) (*DependencyRegisterer, error) {
if !features.IsEnabledGlobally(featuremgmt.FlagSecretsManagementAppPlatform) {
return nil, nil
}
// Permissions for requests in multi-tenant mode will come from HG.
if err := registerAccessControlRoles(accessControlService); err != nil {
return nil, fmt.Errorf("registering access control roles: %w", err)
}
// TODO: Remove once the DB schema is more stable.
if !features.IsEnabledGlobally(featuremgmt.FlagSecretsManagementAppPlatform) {
return nil, nil
}
// We shouldn't need to create the DB in HG, as that will use the MT api server.
if cfg.StackID == "" {
// Some DBs that claim to be MySQL/Postgres-compatible might not support table locking.
pkg/registry/apis/secret/secretkeeper/secretkeeper_test.go
+2 -4
View File
@@ -12,7 +12,6 @@ import (
osskmsproviders "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders"
"github.com/grafana/grafana/pkg/registry/apis/secret/encryption/manager"
"github.com/grafana/grafana/pkg/registry/apis/secret/secretkeeper/sqlkeeper"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/storage/secret/database"
@@ -49,12 +48,11 @@ func setupTestService(t *testing.T, cfg *setting.Cfg) (*OSSKeeperService, error)
testDB := sqlstore.NewTestStore(t, sqlstore.WithMigrator(migrator.New()))
tracer := noop.NewTracerProvider().Tracer("test")
database := database.ProvideDatabase(testDB, tracer)
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
dataKeyStore, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, features, nil)
dataKeyStore, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, nil)
require.NoError(t, err)
encValueStore, err := encryptionstorage.ProvideEncryptedValueStorage(database, tracer, features)
encValueStore, err := encryptionstorage.ProvideEncryptedValueStorage(database, tracer)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
pkg/registry/apis/secret/testutils/testutils.go
+5 -8
View File
@@ -24,7 +24,6 @@ import (
"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/storage/secret/database"
@@ -64,12 +63,10 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
database := database.ProvideDatabase(testDB, tracer)
features := featuremgmt.WithFeatures(featuremgmt.FlagSecretsManagementAppPlatform)
keeperMetadataStorage, err := metadata.ProvideKeeperMetadataStorage(database, tracer, features, nil)
keeperMetadataStorage, err := metadata.ProvideKeeperMetadataStorage(database, tracer, nil)
require.NoError(t, err)
secureValueMetadataStorage, err := metadata.ProvideSecureValueMetadataStorage(database, tracer, features, nil)
secureValueMetadataStorage, err := metadata.ProvideSecureValueMetadataStorage(database, tracer, nil)
require.NoError(t, err)
// Initialize access client + access control
@@ -86,7 +83,7 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
ConfiguredKMSProviders: map[string]map[string]string{"secret_key.v1": {"secret_key": defaultKey}},
},
}
store, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, features, nil)
store, err := encryptionstorage.ProvideDataKeyStorage(database, tracer, nil)
require.NoError(t, err)
usageStats := &usagestats.UsageStatsMock{T: t}
@@ -107,7 +104,7 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
require.NoError(t, err)
// Initialize encrypted value storage with a fake db
encryptedValueStorage, err := encryptionstorage.ProvideEncryptedValueStorage(database, tracer, features)
encryptedValueStorage, err := encryptionstorage.ProvideEncryptedValueStorage(database, tracer)
require.NoError(t, err)
sqlKeeper := sqlkeeper.NewSQLKeeper(tracer, encryptionManager, encryptedValueStorage, nil)
@@ -122,7 +119,7 @@ func Setup(t *testing.T, opts ...func(*SetupConfig)) Sut {
decryptAuthorizer := decrypt.ProvideDecryptAuthorizer(tracer)
decryptStorage, err := metadata.ProvideDecryptStorage(features, tracer, keeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, nil)
decryptStorage, err := metadata.ProvideDecryptStorage(tracer, keeperService, keeperMetadataStorage, secureValueMetadataStorage, decryptAuthorizer, nil)
require.NoError(t, err)
decryptService := decrypt.ProvideDecryptService(decryptStorage)