public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SecretsManager: add secure value store (#106708)

Browse Source 
* SecretsManager: add secure value model and sql templates

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>

* SecretsManager: secure value rest layer to use store

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>

* SecretsManager: temporary add actor prefix to decrypters

* Remove list securevalue by namefor now

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>
This commit is contained in:
Dana Axinte
2025-06-16 10:19:44 +01:00
committed by GitHub
co-authored by Matheus Macabu Leandro Deveikis PoorlyDefinedBehaviour
parent ffc16ee072
commit 6097841e67
52 changed files with 1909 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/secret/metadata/data/secure_value_create.sql
+51
View File
@@ -0,0 +1,51 @@
INSERT INTO {{ .Ident "secret_secure_value" }} (
{{ .Ident "guid" }},
{{ .Ident "name" }},
{{ .Ident "namespace" }},
{{ .Ident "annotations" }},
{{ .Ident "labels" }},
{{ .Ident "created" }},
{{ .Ident "created_by" }},
{{ .Ident "updated" }},
{{ .Ident "updated_by" }},
{{ .Ident "status_phase" }},
{{ if .Row.Message.Valid }}
{{ .Ident "status_message" }},
{{ end }}
{{ .Ident "description" }},
{{ if .Row.Keeper.Valid }}
{{ .Ident "keeper" }},
{{ end }}
{{ if .Row.Decrypters.Valid }}
{{ .Ident "decrypters" }},
{{ end }}
{{ if .Row.Ref.Valid }}
{{ .Ident "ref" }},
{{ end }}
{{ .Ident "external_id" }}
) VALUES (
{{ .Arg .Row.GUID }},
{{ .Arg .Row.Name }},
{{ .Arg .Row.Namespace }},
{{ .Arg .Row.Annotations }},
{{ .Arg .Row.Labels }},
{{ .Arg .Row.Created }},
{{ .Arg .Row.CreatedBy }},
{{ .Arg .Row.Updated }},
{{ .Arg .Row.UpdatedBy }},
{{ .Arg .Row.Phase }},
{{ if .Row.Message.Valid }}
{{ .Arg .Row.Message.String }},
{{ end }}
{{ .Arg .Row.Description }},
{{ if .Row.Keeper.Valid }}
{{ .Arg .Row.Keeper.String }},
{{ end }}
{{ if .Row.Decrypters.Valid }}
{{ .Arg .Row.Decrypters.String }},
{{ end }}
{{ if .Row.Ref.Valid }}
{{ .Arg .Row.Ref.String }},
{{ end }}
{{ .Arg .Row.ExternalID }}
);
pkg/storage/secret/metadata/data/secure_value_delete.sql
+4
View File
@@ -0,0 +1,4 @@
DELETE FROM {{ .Ident "secret_secure_value" }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Name }}
;
pkg/storage/secret/metadata/data/secure_value_list.sql
+22
View File
@@ -0,0 +1,22 @@
SELECT
{{ .Ident "guid" }},
{{ .Ident "name" }},
{{ .Ident "namespace" }},
{{ .Ident "annotations" }},
{{ .Ident "labels" }},
{{ .Ident "created" }},
{{ .Ident "created_by" }},
{{ .Ident "updated" }},
{{ .Ident "updated_by" }},
{{ .Ident "status_phase" }},
{{ .Ident "status_message" }},
{{ .Ident "description" }},
{{ .Ident "keeper" }},
{{ .Ident "decrypters" }},
{{ .Ident "ref" }},
{{ .Ident "external_id" }}
FROM
{{ .Ident "secret_secure_value" }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }}
ORDER BY {{ .Ident "updated" }} DESC
;
pkg/storage/secret/metadata/data/secure_value_listByName.sql
+11
View File
@@ -0,0 +1,11 @@
{{/* this query is used to validate the keeper update or creation */}}
SELECT
{{ .Ident "name" }},
{{ .Ident "keeper" }}
FROM
{{ .Ident "secret_secure_value" }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} IN ({{ .ArgList .UsedSecureValues }})
{{ .SelectFor "UPDATE" }}
;
pkg/storage/secret/metadata/data/secure_value_read.sql
+25
View File
@@ -0,0 +1,25 @@
SELECT
{{ .Ident "guid" }},
{{ .Ident "name" }},
{{ .Ident "namespace" }},
{{ .Ident "annotations" }},
{{ .Ident "labels" }},
{{ .Ident "created" }},
{{ .Ident "created_by" }},
{{ .Ident "updated" }},
{{ .Ident "updated_by" }},
{{ .Ident "status_phase" }},
{{ .Ident "status_message" }},
{{ .Ident "description" }},
{{ .Ident "keeper" }},
{{ .Ident "decrypters" }},
{{ .Ident "ref" }},
{{ .Ident "external_id" }}
FROM
{{ .Ident "secret_secure_value" }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Name }}
{{ if .IsForUpdate }}
{{ .SelectFor "UPDATE" }}
{{ end }}
;
pkg/storage/secret/metadata/data/secure_value_read_for_decrypt.sql
+10
View File
@@ -0,0 +1,10 @@
SELECT
{{ .Ident "keeper" }},
{{ .Ident "decrypters" }},
{{ .Ident "ref" }},
{{ .Ident "external_id" }}
FROM
{{ .Ident "secret_secure_value" }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Name }}
;
pkg/storage/secret/metadata/data/secure_value_update.sql
+30
View File
@@ -0,0 +1,30 @@
UPDATE
{{ .Ident "secret_secure_value" }}
SET
{{ .Ident "guid" }} = {{ .Arg .Row.GUID }},
{{ .Ident "name" }} = {{ .Arg .Row.Name }},
{{ .Ident "namespace" }} = {{ .Arg .Row.Namespace }},
{{ .Ident "annotations" }} = {{ .Arg .Row.Annotations }},
{{ .Ident "labels" }} = {{ .Arg .Row.Labels }},
{{ .Ident "created" }} = {{ .Arg .Row.Created }},
{{ .Ident "created_by" }} = {{ .Arg .Row.CreatedBy }},
{{ .Ident "updated" }} = {{ .Arg .Row.Updated }},
{{ .Ident "updated_by" }} = {{ .Arg .Row.UpdatedBy }},
{{ .Ident "status_phase" }} = {{ .Arg .Row.Phase }},
{{ if .Row.Message.Valid }}
{{ .Ident "status_message" }} = {{ .Arg .Row.Message.String }},
{{ end }}
{{ .Ident "description" }} = {{ .Arg .Row.Description }},
{{ if .Row.Keeper.Valid }}
{{ .Ident "keeper" }} = {{ .Arg .Row.Keeper.String }},
{{ end }}
{{ if .Row.Decrypters.Valid }}
{{ .Ident "decrypters" }} = {{ .Arg .Row.Decrypters.String }},
{{ end }}
{{ if .Row.Ref.Valid }}
{{ .Ident "ref" }} = {{ .Arg .Row.Ref.String }},
{{ end }}
{{ .Ident "external_id" }} = {{ .Arg .Row.ExternalID }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Row.Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Row.Name }}
;
pkg/storage/secret/metadata/data/secure_value_updateExternalId.sql
+7
View File
@@ -0,0 +1,7 @@
UPDATE
{{ .Ident "secret_secure_value" }}
SET
{{ .Ident "external_id" }} = {{ .Arg .ExternalID }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Name }}
;
pkg/storage/secret/metadata/data/secure_value_updateStatus.sql
+8
View File
@@ -0,0 +1,8 @@
UPDATE
{{ .Ident "secret_secure_value" }}
SET
{{ .Ident "status_phase" }} = {{ .Arg .Phase }},
{{ .Ident "status_message" }} = {{ .Arg .Message }}
WHERE {{ .Ident "namespace" }} = {{ .Arg .Namespace }} AND
{{ .Ident "name" }} = {{ .Arg .Name }}
;