From 343fe4dadf51bdf927b629ae1c3f68a5a44a946c Mon Sep 17 00:00:00 2001 From: Matheus Macabu Date: Mon, 4 Aug 2025 08:26:07 +0200 Subject: [PATCH] Secrets: Introduce inline secure value service proto (#109029) * Secrets: Introduce inline secure value service proto * Fix secure value description * Add orgid to obo auth context for testing --- apps/secret/inline/v1beta1/inline.pb.go | 515 ++++++++++++++++++ apps/secret/inline/v1beta1/inline.proto | 67 +++ apps/secret/inline/v1beta1/inline_grpc.pb.go | 190 +++++++ .../secret/service/inline_secure_value.go | 2 +- .../apis/secret/testutils/testutils.go | 1 + 5 files changed, 774 insertions(+), 1 deletion(-) create mode 100644 apps/secret/inline/v1beta1/inline.pb.go create mode 100644 apps/secret/inline/v1beta1/inline.proto create mode 100644 apps/secret/inline/v1beta1/inline_grpc.pb.go diff --git a/apps/secret/inline/v1beta1/inline.pb.go b/apps/secret/inline/v1beta1/inline.pb.go new file mode 100644 index 00000000000..d759693f4e0 --- /dev/null +++ b/apps/secret/inline/v1beta1/inline.pb.go @@ -0,0 +1,515 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.5 +// protoc (unknown) +// source: inline/v1beta1/inline.proto + +package inlinev1beta1 + +import ( + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + reflect "reflect" + sync "sync" + unsafe "unsafe" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type ObjectReference struct { + state protoimpl.MessageState `protogen:"open.v1"` + // APIGroup is the name of the API group that contains the referred object. + // The empty string represents the core API group. + ApiGroup string `protobuf:"bytes,1,opt,name=api_group,json=apiGroup,proto3" json:"api_group,omitempty"` + // APIVersion is the version of the API group that contains the referred object. + ApiVersion string `protobuf:"bytes,2,opt,name=api_version,json=apiVersion,proto3" json:"api_version,omitempty"` + // See https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds + Kind string `protobuf:"bytes,3,opt,name=kind,proto3" json:"kind,omitempty"` + // Tenant isolation + Namespace string `protobuf:"bytes,4,opt,name=namespace,proto3" json:"namespace,omitempty"` + // Explicit resource identifier + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ObjectReference) Reset() { + *x = ObjectReference{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ObjectReference) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ObjectReference) ProtoMessage() {} + +func (x *ObjectReference) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ObjectReference.ProtoReflect.Descriptor instead. +func (*ObjectReference) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{0} +} + +func (x *ObjectReference) GetApiGroup() string { + if x != nil { + return x.ApiGroup + } + return "" +} + +func (x *ObjectReference) GetApiVersion() string { + if x != nil { + return x.ApiVersion + } + return "" +} + +func (x *ObjectReference) GetKind() string { + if x != nil { + return x.Kind + } + return "" +} + +func (x *ObjectReference) GetNamespace() string { + if x != nil { + return x.Namespace + } + return "" +} + +func (x *ObjectReference) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +type CanReferenceRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Owner reference. + Owner *ObjectReference `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"` + // Secure value names to check. + Names []string `protobuf:"bytes,2,rep,name=names,proto3" json:"names,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CanReferenceRequest) Reset() { + *x = CanReferenceRequest{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CanReferenceRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CanReferenceRequest) ProtoMessage() {} + +func (x *CanReferenceRequest) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CanReferenceRequest.ProtoReflect.Descriptor instead. +func (*CanReferenceRequest) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{1} +} + +func (x *CanReferenceRequest) GetOwner() *ObjectReference { + if x != nil { + return x.Owner + } + return nil +} + +func (x *CanReferenceRequest) GetNames() []string { + if x != nil { + return x.Names + } + return nil +} + +type CanReferenceResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CanReferenceResponse) Reset() { + *x = CanReferenceResponse{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CanReferenceResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CanReferenceResponse) ProtoMessage() {} + +func (x *CanReferenceResponse) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CanReferenceResponse.ProtoReflect.Descriptor instead. +func (*CanReferenceResponse) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{2} +} + +type CreateInlineRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Owner reference. + Owner *ObjectReference `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"` + // Raw secret value. + Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CreateInlineRequest) Reset() { + *x = CreateInlineRequest{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CreateInlineRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CreateInlineRequest) ProtoMessage() {} + +func (x *CreateInlineRequest) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[3] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CreateInlineRequest.ProtoReflect.Descriptor instead. +func (*CreateInlineRequest) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{3} +} + +func (x *CreateInlineRequest) GetOwner() *ObjectReference { + if x != nil { + return x.Owner + } + return nil +} + +func (x *CreateInlineRequest) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type CreateInlineResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The name of the created secure value. + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CreateInlineResponse) Reset() { + *x = CreateInlineResponse{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[4] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CreateInlineResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CreateInlineResponse) ProtoMessage() {} + +func (x *CreateInlineResponse) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[4] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CreateInlineResponse.ProtoReflect.Descriptor instead. +func (*CreateInlineResponse) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{4} +} + +func (x *CreateInlineResponse) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +type DeleteWhenOwnedByResourceRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Owner reference. + Owner *ObjectReference `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"` + // Name of the secure value to delete. + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeleteWhenOwnedByResourceRequest) Reset() { + *x = DeleteWhenOwnedByResourceRequest{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[5] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DeleteWhenOwnedByResourceRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DeleteWhenOwnedByResourceRequest) ProtoMessage() {} + +func (x *DeleteWhenOwnedByResourceRequest) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[5] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DeleteWhenOwnedByResourceRequest.ProtoReflect.Descriptor instead. +func (*DeleteWhenOwnedByResourceRequest) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{5} +} + +func (x *DeleteWhenOwnedByResourceRequest) GetOwner() *ObjectReference { + if x != nil { + return x.Owner + } + return nil +} + +func (x *DeleteWhenOwnedByResourceRequest) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +type DeleteWhenOwnedByResourceResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeleteWhenOwnedByResourceResponse) Reset() { + *x = DeleteWhenOwnedByResourceResponse{} + mi := &file_inline_v1beta1_inline_proto_msgTypes[6] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DeleteWhenOwnedByResourceResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DeleteWhenOwnedByResourceResponse) ProtoMessage() {} + +func (x *DeleteWhenOwnedByResourceResponse) ProtoReflect() protoreflect.Message { + mi := &file_inline_v1beta1_inline_proto_msgTypes[6] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DeleteWhenOwnedByResourceResponse.ProtoReflect.Descriptor instead. +func (*DeleteWhenOwnedByResourceResponse) Descriptor() ([]byte, []int) { + return file_inline_v1beta1_inline_proto_rawDescGZIP(), []int{6} +} + +var File_inline_v1beta1_inline_proto protoreflect.FileDescriptor + +var file_inline_v1beta1_inline_proto_rawDesc = string([]byte{ + 0x0a, 0x1b, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x2f, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, + 0x2f, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x69, + 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x22, 0x95, 0x01, 0x0a, + 0x0f, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, + 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x70, 0x69, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x01, 0x20, + 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x70, 0x69, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x1f, 0x0a, + 0x0b, 0x61, 0x70, 0x69, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, + 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x69, + 0x6e, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, + 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, + 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x61, 0x0a, 0x13, 0x43, 0x61, 0x6e, 0x52, 0x65, 0x66, 0x65, 0x72, + 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x34, 0x0a, 0x05, 0x6f, + 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x69, 0x6e, 0x6c, + 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x4f, 0x62, 0x6a, 0x65, 0x63, + 0x74, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, + 0x72, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, + 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x16, 0x0a, 0x14, 0x43, 0x61, 0x6e, 0x52, 0x65, + 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, + 0x61, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x52, + 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x34, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, + 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, + 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x52, 0x65, 0x66, 0x65, + 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, + 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, + 0x75, 0x65, 0x22, 0x2a, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x6c, 0x69, + 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, + 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x6c, + 0x0a, 0x20, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x68, 0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, + 0x64, 0x42, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, + 0x73, 0x74, 0x12, 0x34, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, + 0x0b, 0x32, 0x1e, 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, + 0x31, 0x2e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, + 0x65, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, + 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x23, 0x0a, 0x21, + 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x68, 0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x64, 0x42, + 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, + 0x65, 0x32, 0xcc, 0x02, 0x0a, 0x18, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x63, 0x75, + 0x72, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x57, + 0x0a, 0x0c, 0x43, 0x61, 0x6e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x22, + 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x43, + 0x61, 0x6e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, + 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, + 0x61, 0x31, 0x2e, 0x43, 0x61, 0x6e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x52, + 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, + 0x65, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x12, 0x22, 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, + 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, + 0x6c, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x69, 0x6e, + 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, + 0x74, 0x65, 0x49, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, + 0x12, 0x7e, 0x0a, 0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x68, 0x65, 0x6e, 0x4f, 0x77, + 0x6e, 0x65, 0x64, 0x42, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x2f, 0x2e, + 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x44, 0x65, + 0x6c, 0x65, 0x74, 0x65, 0x57, 0x68, 0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x64, 0x42, 0x79, 0x52, + 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, + 0x2e, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x44, + 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x68, 0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x64, 0x42, 0x79, + 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, + 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, + 0x72, 0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x67, 0x72, 0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x61, + 0x70, 0x70, 0x73, 0x2f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x2f, 0x69, 0x6e, 0x6c, 0x69, 0x6e, + 0x65, 0x2f, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x3b, 0x69, 0x6e, 0x6c, 0x69, 0x6e, 0x65, + 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, +}) + +var ( + file_inline_v1beta1_inline_proto_rawDescOnce sync.Once + file_inline_v1beta1_inline_proto_rawDescData []byte +) + +func file_inline_v1beta1_inline_proto_rawDescGZIP() []byte { + file_inline_v1beta1_inline_proto_rawDescOnce.Do(func() { + file_inline_v1beta1_inline_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_inline_v1beta1_inline_proto_rawDesc), len(file_inline_v1beta1_inline_proto_rawDesc))) + }) + return file_inline_v1beta1_inline_proto_rawDescData +} + +var file_inline_v1beta1_inline_proto_msgTypes = make([]protoimpl.MessageInfo, 7) +var file_inline_v1beta1_inline_proto_goTypes = []any{ + (*ObjectReference)(nil), // 0: inlinev1beta1.ObjectReference + (*CanReferenceRequest)(nil), // 1: inlinev1beta1.CanReferenceRequest + (*CanReferenceResponse)(nil), // 2: inlinev1beta1.CanReferenceResponse + (*CreateInlineRequest)(nil), // 3: inlinev1beta1.CreateInlineRequest + (*CreateInlineResponse)(nil), // 4: inlinev1beta1.CreateInlineResponse + (*DeleteWhenOwnedByResourceRequest)(nil), // 5: inlinev1beta1.DeleteWhenOwnedByResourceRequest + (*DeleteWhenOwnedByResourceResponse)(nil), // 6: inlinev1beta1.DeleteWhenOwnedByResourceResponse +} +var file_inline_v1beta1_inline_proto_depIdxs = []int32{ + 0, // 0: inlinev1beta1.CanReferenceRequest.owner:type_name -> inlinev1beta1.ObjectReference + 0, // 1: inlinev1beta1.CreateInlineRequest.owner:type_name -> inlinev1beta1.ObjectReference + 0, // 2: inlinev1beta1.DeleteWhenOwnedByResourceRequest.owner:type_name -> inlinev1beta1.ObjectReference + 1, // 3: inlinev1beta1.InlineSecureValueService.CanReference:input_type -> inlinev1beta1.CanReferenceRequest + 3, // 4: inlinev1beta1.InlineSecureValueService.CreateInline:input_type -> inlinev1beta1.CreateInlineRequest + 5, // 5: inlinev1beta1.InlineSecureValueService.DeleteWhenOwnedByResource:input_type -> inlinev1beta1.DeleteWhenOwnedByResourceRequest + 2, // 6: inlinev1beta1.InlineSecureValueService.CanReference:output_type -> inlinev1beta1.CanReferenceResponse + 4, // 7: inlinev1beta1.InlineSecureValueService.CreateInline:output_type -> inlinev1beta1.CreateInlineResponse + 6, // 8: inlinev1beta1.InlineSecureValueService.DeleteWhenOwnedByResource:output_type -> inlinev1beta1.DeleteWhenOwnedByResourceResponse + 6, // [6:9] is the sub-list for method output_type + 3, // [3:6] is the sub-list for method input_type + 3, // [3:3] is the sub-list for extension type_name + 3, // [3:3] is the sub-list for extension extendee + 0, // [0:3] is the sub-list for field type_name +} + +func init() { file_inline_v1beta1_inline_proto_init() } +func file_inline_v1beta1_inline_proto_init() { + if File_inline_v1beta1_inline_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_inline_v1beta1_inline_proto_rawDesc), len(file_inline_v1beta1_inline_proto_rawDesc)), + NumEnums: 0, + NumMessages: 7, + NumExtensions: 0, + NumServices: 1, + }, + GoTypes: file_inline_v1beta1_inline_proto_goTypes, + DependencyIndexes: file_inline_v1beta1_inline_proto_depIdxs, + MessageInfos: file_inline_v1beta1_inline_proto_msgTypes, + }.Build() + File_inline_v1beta1_inline_proto = out.File + file_inline_v1beta1_inline_proto_goTypes = nil + file_inline_v1beta1_inline_proto_depIdxs = nil +} diff --git a/apps/secret/inline/v1beta1/inline.proto b/apps/secret/inline/v1beta1/inline.proto new file mode 100644 index 00000000000..493b855c517 --- /dev/null +++ b/apps/secret/inline/v1beta1/inline.proto @@ -0,0 +1,67 @@ +syntax = "proto3"; + +package inlinev1beta1; + +option go_package = "github.com/grafana/grafana/apps/secret/inline/v1beta1;inlinev1beta1"; + +message ObjectReference { + // APIGroup is the name of the API group that contains the referred object. + // The empty string represents the core API group. + string api_group = 1; + + // APIVersion is the version of the API group that contains the referred object. + string api_version = 2; + + // See https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds + string kind = 3; + + // Tenant isolation + string namespace = 4; + + // Explicit resource identifier + string name = 5; +} + +message CanReferenceRequest { + // Owner reference. + ObjectReference owner = 1; + + // Secure value names to check. + repeated string names = 2; +} + +message CanReferenceResponse {} + +message CreateInlineRequest { + // Owner reference. + ObjectReference owner = 1; + + // Raw secret value. + string value = 2; +} + +message CreateInlineResponse { + // The name of the created secure value. + string name = 1; +} + +message DeleteWhenOwnedByResourceRequest { + // Owner reference. + ObjectReference owner = 1; + + // Name of the secure value to delete. + string name = 2; +} + +message DeleteWhenOwnedByResourceResponse {} + +service InlineSecureValueService { + // Check that the request user can reference a secret in the context of a given resource (owner) + rpc CanReference(CanReferenceRequest) returns (CanReferenceResponse); + + // CreateInline creates a secret that is owned by the referenced object. Returns the name of the created secret or an error + rpc CreateInline(CreateInlineRequest) returns (CreateInlineResponse); + + // DeleteWhenOwnedByResource removes secrets if and only if they are owned by a referenced object + rpc DeleteWhenOwnedByResource(DeleteWhenOwnedByResourceRequest) returns (DeleteWhenOwnedByResourceResponse); +} diff --git a/apps/secret/inline/v1beta1/inline_grpc.pb.go b/apps/secret/inline/v1beta1/inline_grpc.pb.go new file mode 100644 index 00000000000..2ce117adb7d --- /dev/null +++ b/apps/secret/inline/v1beta1/inline_grpc.pb.go @@ -0,0 +1,190 @@ +// Code generated by protoc-gen-go-grpc. DO NOT EDIT. +// versions: +// - protoc-gen-go-grpc v1.4.0 +// - protoc (unknown) +// source: inline/v1beta1/inline.proto + +package inlinev1beta1 + +import ( + context "context" + grpc "google.golang.org/grpc" + codes "google.golang.org/grpc/codes" + status "google.golang.org/grpc/status" +) + +// This is a compile-time assertion to ensure that this generated file +// is compatible with the grpc package it is being compiled against. +// Requires gRPC-Go v1.62.0 or later. +const _ = grpc.SupportPackageIsVersion8 + +const ( + InlineSecureValueService_CanReference_FullMethodName = "/inlinev1beta1.InlineSecureValueService/CanReference" + InlineSecureValueService_CreateInline_FullMethodName = "/inlinev1beta1.InlineSecureValueService/CreateInline" + InlineSecureValueService_DeleteWhenOwnedByResource_FullMethodName = "/inlinev1beta1.InlineSecureValueService/DeleteWhenOwnedByResource" +) + +// InlineSecureValueServiceClient is the client API for InlineSecureValueService service. +// +// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. +type InlineSecureValueServiceClient interface { + // Check that the request user can reference a secret in the context of a given resource (owner) + CanReference(ctx context.Context, in *CanReferenceRequest, opts ...grpc.CallOption) (*CanReferenceResponse, error) + // CreateInline creates a secret that is owned by the referenced object. Returns the name of the created secret or an error + CreateInline(ctx context.Context, in *CreateInlineRequest, opts ...grpc.CallOption) (*CreateInlineResponse, error) + // DeleteWhenOwnedByResource removes secrets if and only if they are owned by a referenced object + DeleteWhenOwnedByResource(ctx context.Context, in *DeleteWhenOwnedByResourceRequest, opts ...grpc.CallOption) (*DeleteWhenOwnedByResourceResponse, error) +} + +type inlineSecureValueServiceClient struct { + cc grpc.ClientConnInterface +} + +func NewInlineSecureValueServiceClient(cc grpc.ClientConnInterface) InlineSecureValueServiceClient { + return &inlineSecureValueServiceClient{cc} +} + +func (c *inlineSecureValueServiceClient) CanReference(ctx context.Context, in *CanReferenceRequest, opts ...grpc.CallOption) (*CanReferenceResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(CanReferenceResponse) + err := c.cc.Invoke(ctx, InlineSecureValueService_CanReference_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *inlineSecureValueServiceClient) CreateInline(ctx context.Context, in *CreateInlineRequest, opts ...grpc.CallOption) (*CreateInlineResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(CreateInlineResponse) + err := c.cc.Invoke(ctx, InlineSecureValueService_CreateInline_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *inlineSecureValueServiceClient) DeleteWhenOwnedByResource(ctx context.Context, in *DeleteWhenOwnedByResourceRequest, opts ...grpc.CallOption) (*DeleteWhenOwnedByResourceResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(DeleteWhenOwnedByResourceResponse) + err := c.cc.Invoke(ctx, InlineSecureValueService_DeleteWhenOwnedByResource_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +// InlineSecureValueServiceServer is the server API for InlineSecureValueService service. +// All implementations should embed UnimplementedInlineSecureValueServiceServer +// for forward compatibility +type InlineSecureValueServiceServer interface { + // Check that the request user can reference a secret in the context of a given resource (owner) + CanReference(context.Context, *CanReferenceRequest) (*CanReferenceResponse, error) + // CreateInline creates a secret that is owned by the referenced object. Returns the name of the created secret or an error + CreateInline(context.Context, *CreateInlineRequest) (*CreateInlineResponse, error) + // DeleteWhenOwnedByResource removes secrets if and only if they are owned by a referenced object + DeleteWhenOwnedByResource(context.Context, *DeleteWhenOwnedByResourceRequest) (*DeleteWhenOwnedByResourceResponse, error) +} + +// UnimplementedInlineSecureValueServiceServer should be embedded to have forward compatible implementations. +type UnimplementedInlineSecureValueServiceServer struct { +} + +func (UnimplementedInlineSecureValueServiceServer) CanReference(context.Context, *CanReferenceRequest) (*CanReferenceResponse, error) { + return nil, status.Errorf(codes.Unimplemented, "method CanReference not implemented") +} +func (UnimplementedInlineSecureValueServiceServer) CreateInline(context.Context, *CreateInlineRequest) (*CreateInlineResponse, error) { + return nil, status.Errorf(codes.Unimplemented, "method CreateInline not implemented") +} +func (UnimplementedInlineSecureValueServiceServer) DeleteWhenOwnedByResource(context.Context, *DeleteWhenOwnedByResourceRequest) (*DeleteWhenOwnedByResourceResponse, error) { + return nil, status.Errorf(codes.Unimplemented, "method DeleteWhenOwnedByResource not implemented") +} + +// UnsafeInlineSecureValueServiceServer may be embedded to opt out of forward compatibility for this service. +// Use of this interface is not recommended, as added methods to InlineSecureValueServiceServer will +// result in compilation errors. +type UnsafeInlineSecureValueServiceServer interface { + mustEmbedUnimplementedInlineSecureValueServiceServer() +} + +func RegisterInlineSecureValueServiceServer(s grpc.ServiceRegistrar, srv InlineSecureValueServiceServer) { + s.RegisterService(&InlineSecureValueService_ServiceDesc, srv) +} + +func _InlineSecureValueService_CanReference_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(CanReferenceRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(InlineSecureValueServiceServer).CanReference(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: InlineSecureValueService_CanReference_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(InlineSecureValueServiceServer).CanReference(ctx, req.(*CanReferenceRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _InlineSecureValueService_CreateInline_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(CreateInlineRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(InlineSecureValueServiceServer).CreateInline(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: InlineSecureValueService_CreateInline_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(InlineSecureValueServiceServer).CreateInline(ctx, req.(*CreateInlineRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _InlineSecureValueService_DeleteWhenOwnedByResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(DeleteWhenOwnedByResourceRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(InlineSecureValueServiceServer).DeleteWhenOwnedByResource(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: InlineSecureValueService_DeleteWhenOwnedByResource_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(InlineSecureValueServiceServer).DeleteWhenOwnedByResource(ctx, req.(*DeleteWhenOwnedByResourceRequest)) + } + return interceptor(ctx, in, info, handler) +} + +// InlineSecureValueService_ServiceDesc is the grpc.ServiceDesc for InlineSecureValueService service. +// It's only intended for direct use with grpc.RegisterService, +// and not to be introspected or modified (even as a copy) +var InlineSecureValueService_ServiceDesc = grpc.ServiceDesc{ + ServiceName: "inlinev1beta1.InlineSecureValueService", + HandlerType: (*InlineSecureValueServiceServer)(nil), + Methods: []grpc.MethodDesc{ + { + MethodName: "CanReference", + Handler: _InlineSecureValueService_CanReference_Handler, + }, + { + MethodName: "CreateInline", + Handler: _InlineSecureValueService_CreateInline_Handler, + }, + { + MethodName: "DeleteWhenOwnedByResource", + Handler: _InlineSecureValueService_DeleteWhenOwnedByResource_Handler, + }, + }, + Streams: []grpc.StreamDesc{}, + Metadata: "inline/v1beta1/inline.proto", +} diff --git a/pkg/registry/apis/secret/service/inline_secure_value.go b/pkg/registry/apis/secret/service/inline_secure_value.go index 665bc622f54..365ff00cd6e 100644 --- a/pkg/registry/apis/secret/service/inline_secure_value.go +++ b/pkg/registry/apis/secret/service/inline_secure_value.go @@ -200,7 +200,7 @@ func (s *inlineSecureValueService) CreateInline(ctx context.Context, owner commo OwnerReferences: []metav1.OwnerReference{owner.ToOwnerReference()}, }, Spec: secretv1beta1.SecureValueSpec{ - Description: fmt.Sprintf("Inline secure value for %s/%s in %s/%s", owner.Kind, owner.Name, owner.APIVersion, owner.APIVersion), + Description: fmt.Sprintf("Inline secure value for %s/%s in %s/%s", owner.Kind, owner.Name, owner.APIGroup, owner.APIVersion), Value: &secret, Decrypters: []string{ serviceIdentity, diff --git a/pkg/registry/apis/secret/testutils/testutils.go b/pkg/registry/apis/secret/testutils/testutils.go index 3e742439bb0..4c000e76908 100644 --- a/pkg/registry/apis/secret/testutils/testutils.go +++ b/pkg/registry/apis/secret/testutils/testutils.go @@ -269,6 +269,7 @@ func CreateOBOAuthContext( requester := &identity.StaticRequester{ Namespace: namespace, Type: types.TypeUser, + OrgID: 1, UserID: 1, Permissions: map[int64]map[string][]string{ 1: userPermissions,