SecretsManager: add secure value store (#106708)

* SecretsManager: add secure value model and sql templates

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>

* SecretsManager: secure value rest layer to use store

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>

* SecretsManager: temporary add actor prefix to decrypters

* Remove list securevalue by namefor now

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com>
Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>

pkg/storage/secret/metadata/testdata/mysql--secure_value_create-create-not-null.sql

@@ -0,0 +1,35 @@
+INSERT INTO `secret_secure_value` (
+  `guid`,
+  `name`,
+  `namespace`,
+  `annotations`,
+  `labels`,
+  `created`,
+  `created_by`,
+  `updated`,
+  `updated_by`,
+  `status_phase`,
+  `status_message`,
+  `description`,
+  `keeper`,
+  `decrypters`,
+  `ref`,
+  `external_id`
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'message_test',
+  'description',
+  'keeper_test',
+  'decrypters_test',
+  'ref_test',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/mysql--secure_value_create-create-null.sql

@@ -0,0 +1,27 @@
+INSERT INTO `secret_secure_value` (
+  `guid`,
+  `name`,
+  `namespace`,
+  `annotations`,
+  `labels`,
+  `created`,
+  `created_by`,
+  `updated`,
+  `updated_by`,
+  `status_phase`,
+  `description`,
+  `external_id`
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'description',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/mysql--secure_value_delete-delete.sql

@@ -0,0 +1,4 @@
+DELETE FROM `secret_secure_value`
+WHERE `namespace` = 'ns' AND
+  `name`      = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_list-list.sql

@@ -0,0 +1,22 @@
+SELECT
+  `guid`,
+  `name`,
+  `namespace`,
+  `annotations`,
+  `labels`,
+  `created`,
+  `created_by`,
+  `updated`,
+  `updated_by`,
+  `status_phase`,
+  `status_message`,
+  `description`,
+  `keeper`,
+  `decrypters`,
+  `ref`,
+  `external_id`
+FROM
+  `secret_secure_value`
+WHERE `namespace` = 'ns'
+ORDER BY `updated` DESC
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_read-read-for-update.sql

@@ -0,0 +1,23 @@
+SELECT
+  `guid`,
+  `name`,
+  `namespace`,
+  `annotations`,
+  `labels`,
+  `created`,
+  `created_by`,
+  `updated`,
+  `updated_by`,
+  `status_phase`,
+  `status_message`,
+  `description`,
+  `keeper`,
+  `decrypters`,
+  `ref`,
+  `external_id`
+FROM
+  `secret_secure_value`
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+FOR UPDATE
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_read-read.sql

@@ -0,0 +1,22 @@
+SELECT
+  `guid`,
+  `name`,
+  `namespace`,
+  `annotations`,
+  `labels`,
+  `created`,
+  `created_by`,
+  `updated`,
+  `updated_by`,
+  `status_phase`,
+  `status_message`,
+  `description`,
+  `keeper`,
+  `decrypters`,
+  `ref`,
+  `external_id`
+FROM
+  `secret_secure_value`
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_read_for_decrypt-read-for-decrypt.sql

@@ -0,0 +1,10 @@
+SELECT
+  `keeper`,
+  `decrypters`,
+  `ref`,
+  `external_id`
+FROM
+  `secret_secure_value`
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_update-update-not-null.sql

@@ -0,0 +1,22 @@
+UPDATE
+  `secret_secure_value`
+SET
+  `guid` = 'abc',
+  `name` = 'name',
+  `namespace` = 'ns',
+  `annotations` = '{"x":"XXXX"}',
+  `labels` = '{"a":"AAA", "b", "BBBB"}',
+  `created` = 1234,
+  `created_by` = 'user:ryan',
+  `updated` = 5678,
+  `updated_by` = 'user:cameron',
+  `status_phase` = 'creating',
+  `status_message` = 'message_test',
+  `description` = 'description',
+  `keeper` = 'keeper_test',
+  `decrypters` = 'decrypters_test',
+  `ref` = 'ref_test',
+  `external_id` = 'extId'
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_update-update-null.sql

@@ -0,0 +1,18 @@
+UPDATE
+  `secret_secure_value`
+SET
+  `guid` = 'abc',
+  `name` = 'name',
+  `namespace` = 'ns',
+  `annotations` = '{"x":"XXXX"}',
+  `labels` = '{"a":"AAA", "b", "BBBB"}',
+  `created` = 1234,
+  `created_by` = 'user:ryan',
+  `updated` = 5678,
+  `updated_by` = 'user:cameron',
+  `status_phase` = 'creating',
+  `description` = 'description',
+  `external_id` = 'extId'
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_updateExternalId-updateExternalId.sql

@@ -0,0 +1,7 @@
+UPDATE
+  `secret_secure_value`
+SET
+  `external_id` = 'extId'
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/mysql--secure_value_updateStatus-updateStatus.sql

@@ -0,0 +1,8 @@
+UPDATE
+  `secret_secure_value`
+SET
+  `status_phase` = 'Succeeded',
+  `status_message` = 'message-1'
+WHERE `namespace` = 'ns' AND
+  `name` = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_create-create-not-null.sql

@@ -0,0 +1,35 @@
+INSERT INTO "secret_secure_value" (
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'message_test',
+  'description',
+  'keeper_test',
+  'decrypters_test',
+  'ref_test',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/postgres--secure_value_create-create-null.sql

@@ -0,0 +1,27 @@
+INSERT INTO "secret_secure_value" (
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "description",
+  "external_id"
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'description',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/postgres--secure_value_delete-delete.sql

@@ -0,0 +1,4 @@
+DELETE FROM "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name"      = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_list-list.sql

@@ -0,0 +1,22 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns'
+ORDER BY "updated" DESC
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_read-read-for-update.sql

@@ -0,0 +1,23 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+FOR UPDATE
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_read-read.sql

@@ -0,0 +1,22 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_read_for_decrypt-read-for-decrypt.sql

@@ -0,0 +1,10 @@
+SELECT
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_update-update-not-null.sql

@@ -0,0 +1,22 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "guid" = 'abc',
+  "name" = 'name',
+  "namespace" = 'ns',
+  "annotations" = '{"x":"XXXX"}',
+  "labels" = '{"a":"AAA", "b", "BBBB"}',
+  "created" = 1234,
+  "created_by" = 'user:ryan',
+  "updated" = 5678,
+  "updated_by" = 'user:cameron',
+  "status_phase" = 'creating',
+  "status_message" = 'message_test',
+  "description" = 'description',
+  "keeper" = 'keeper_test',
+  "decrypters" = 'decrypters_test',
+  "ref" = 'ref_test',
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_update-update-null.sql

@@ -0,0 +1,18 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "guid" = 'abc',
+  "name" = 'name',
+  "namespace" = 'ns',
+  "annotations" = '{"x":"XXXX"}',
+  "labels" = '{"a":"AAA", "b", "BBBB"}',
+  "created" = 1234,
+  "created_by" = 'user:ryan',
+  "updated" = 5678,
+  "updated_by" = 'user:cameron',
+  "status_phase" = 'creating',
+  "description" = 'description',
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_updateExternalId-updateExternalId.sql

@@ -0,0 +1,7 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/postgres--secure_value_updateStatus-updateStatus.sql

@@ -0,0 +1,8 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "status_phase" = 'Succeeded',
+  "status_message" = 'message-1'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_create-create-not-null.sql

@@ -0,0 +1,35 @@
+INSERT INTO "secret_secure_value" (
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'message_test',
+  'description',
+  'keeper_test',
+  'decrypters_test',
+  'ref_test',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/sqlite--secure_value_create-create-null.sql

@@ -0,0 +1,27 @@
+INSERT INTO "secret_secure_value" (
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "description",
+  "external_id"
+) VALUES (
+  'abc',
+  'name',
+  'ns',
+  '{"x":"XXXX"}',
+  '{"a":"AAA", "b", "BBBB"}',
+  1234,
+  'user:ryan',
+  5678,
+  'user:cameron',
+  'creating',
+  'description',
+  'extId'
+);

pkg/storage/secret/metadata/testdata/sqlite--secure_value_delete-delete.sql

@@ -0,0 +1,4 @@
+DELETE FROM "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name"      = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_list-list.sql

@@ -0,0 +1,22 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns'
+ORDER BY "updated" DESC
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_read-read-for-update.sql

@@ -0,0 +1,22 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_read-read.sql

@@ -0,0 +1,22 @@
+SELECT
+  "guid",
+  "name",
+  "namespace",
+  "annotations",
+  "labels",
+  "created",
+  "created_by",
+  "updated",
+  "updated_by",
+  "status_phase",
+  "status_message",
+  "description",
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_read_for_decrypt-read-for-decrypt.sql

@@ -0,0 +1,10 @@
+SELECT
+  "keeper",
+  "decrypters",
+  "ref",
+  "external_id"
+FROM
+  "secret_secure_value"
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_update-update-not-null.sql

@@ -0,0 +1,22 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "guid" = 'abc',
+  "name" = 'name',
+  "namespace" = 'ns',
+  "annotations" = '{"x":"XXXX"}',
+  "labels" = '{"a":"AAA", "b", "BBBB"}',
+  "created" = 1234,
+  "created_by" = 'user:ryan',
+  "updated" = 5678,
+  "updated_by" = 'user:cameron',
+  "status_phase" = 'creating',
+  "status_message" = 'message_test',
+  "description" = 'description',
+  "keeper" = 'keeper_test',
+  "decrypters" = 'decrypters_test',
+  "ref" = 'ref_test',
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_update-update-null.sql

@@ -0,0 +1,18 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "guid" = 'abc',
+  "name" = 'name',
+  "namespace" = 'ns',
+  "annotations" = '{"x":"XXXX"}',
+  "labels" = '{"a":"AAA", "b", "BBBB"}',
+  "created" = 1234,
+  "created_by" = 'user:ryan',
+  "updated" = 5678,
+  "updated_by" = 'user:cameron',
+  "status_phase" = 'creating',
+  "description" = 'description',
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_updateExternalId-updateExternalId.sql

@@ -0,0 +1,7 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "external_id" = 'extId'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;

pkg/storage/secret/metadata/testdata/sqlite--secure_value_updateStatus-updateStatus.sql

@@ -0,0 +1,8 @@
+UPDATE
+  "secret_secure_value"
+SET
+  "status_phase" = 'Succeeded',
+  "status_message" = 'message-1'
+WHERE "namespace" = 'ns' AND
+  "name" = 'name'
+;