public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Remove proxy certs (#110140)

Browse Source
This commit is contained in:
Matheus Macabu
2025-08-26 16:24:26 +02:00
committed by GitHub
parent 2cba22c092
commit 60f31342c0
7 changed files with 2 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/decrypt/grpc_client.go
-10
View File
@@ -34,8 +34,6 @@ var _ contracts.DecryptService = &GRPCDecryptClient{}
type TLSConfig struct {
UseTLS bool
CertFile string
KeyFile string
CAFile string
ServerName string
InsecureSkipVerify bool
@@ -91,14 +89,6 @@ func createTLSCredentials(config TLSConfig) (credentials.TransportCredentials, e
tlsConfig.RootCAs = caCertPool
}
if config.CertFile != "" && config.KeyFile != "" {
cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile)
if err != nil {
return nil, fmt.Errorf("failed to load client certificate: %w", err)
}
tlsConfig.Certificates = []tls.Certificate{cert}
}
if config.ServerName != "" {
tlsConfig.ServerName = config.ServerName
}
pkg/registry/apis/secret/decrypt/service.go
+1 -5
View File
@@ -52,13 +52,9 @@ func readTLSFromConfig(cfg *setting.Cfg) TLSConfig {
}
}
apiServer := cfg.SectionWithEnvOverrides("grafana-apiserver")
return TLSConfig{
UseTLS: true,
CertFile: apiServer.Key("proxy_client_cert_file").MustString(""),
KeyFile: apiServer.Key("proxy_client_key_file").MustString(""),
CAFile: apiServer.Key("apiservice_ca_bundle_file").MustString(""),
CAFile: cfg.SectionWithEnvOverrides("grafana-apiserver").Key("apiservice_ca_bundle_file").MustString(""),
ServerName: cfg.SecretsManagement.GrpcServerTLSServerName,
InsecureSkipVerify: cfg.SecretsManagement.GrpcServerTLSSkipVerify,
}
pkg/registry/apis/secret/decrypt/service_test.go
-4
View File
@@ -207,10 +207,6 @@ func TestDecryptService(t *testing.T) {
require.NoError(t, err)
apiServer := cfg.Raw.Section("grafana-apiserver")
_, err = apiServer.NewKey("proxy_client_cert_file", certPaths.ClientCert)
require.NoError(t, err)
_, err = apiServer.NewKey("proxy_client_key_file", certPaths.ClientKey)
require.NoError(t, err)
_, err = apiServer.NewKey("apiservice_ca_bundle_file", certPaths.CA)
require.NoError(t, err)
pkg/registry/apis/secret/inline/grpc_client.go
-10
View File
@@ -31,8 +31,6 @@ var _ contracts.InlineSecureValueSupport = &GRPCInlineClient{}
type TLSConfig struct {
UseTLS bool
CertFile string
KeyFile string
CAFile string
ServerName string
InsecureSkipVerify bool
@@ -79,14 +77,6 @@ func createTLSCredentials(config TLSConfig) (credentials.TransportCredentials, e
tlsConfig.RootCAs = caCertPool
}
if config.CertFile != "" && config.KeyFile != "" {
cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile)
if err != nil {
return nil, fmt.Errorf("failed to load client certificate: %w", err)
}
tlsConfig.Certificates = []tls.Certificate{cert}
}
if config.ServerName != "" {
tlsConfig.ServerName = config.ServerName
}
pkg/registry/apis/secret/inline/service.go
+1 -5
View File
@@ -67,13 +67,9 @@ func readTLSFromConfig(cfg *setting.Cfg) TLSConfig {
}
}
apiServer := cfg.SectionWithEnvOverrides("grafana-apiserver")
return TLSConfig{
UseTLS: true,
CertFile: apiServer.Key("proxy_client_cert_file").MustString(""),
KeyFile: apiServer.Key("proxy_client_key_file").MustString(""),
CAFile: apiServer.Key("apiservice_ca_bundle_file").MustString(""),
CAFile: cfg.SectionWithEnvOverrides("grafana-apiserver").Key("apiservice_ca_bundle_file").MustString(""),
ServerName: cfg.SecretsManagement.GrpcServerTLSServerName,
InsecureSkipVerify: cfg.SecretsManagement.GrpcServerTLSSkipVerify,
}
pkg/registry/apis/secret/inline/service_test.go
-4
View File
@@ -128,10 +128,6 @@ func TestProvideInlineSecureValueService(t *testing.T) {
require.NoError(t, err)
apiServer := cfg.Raw.Section("grafana-apiserver")
_, err = apiServer.NewKey("proxy_client_cert_file", certPaths.ClientCert)
require.NoError(t, err)
_, err = apiServer.NewKey("proxy_client_key_file", certPaths.ClientKey)
require.NoError(t, err)
_, err = apiServer.NewKey("apiservice_ca_bundle_file", certPaths.CA)
require.NoError(t, err)
pkg/services/apiserver/options/storage.go
-4
View File
@@ -204,10 +204,6 @@ func (o *StorageOptions) ApplyTo(serverConfig *genericapiserver.RecommendedConfi
ServerName: o.SecretsManagerGrpcServerTLSServerName,
InsecureSkipVerify: o.SecretsManagerGrpcServerTLSSkipVerify,
}
if o.SecretsManagerGrpcServerUseTLS && secureServing != nil {
tlsCfg.CertFile = secureServing.ServerCert.CertKey.CertFile
tlsCfg.KeyFile = secureServing.ServerCert.CertKey.KeyFile
}
inlineSecureValueService, err := inlinesecurevalue.NewGRPCSecureValueService(
&grpcutils.GrpcClientConfig{
Token: o.GrpcClientAuthenticationToken,