From 60f31342c0d2ea1ea1c471192ae2f067f6f41336 Mon Sep 17 00:00:00 2001 From: Matheus Macabu Date: Tue, 26 Aug 2025 16:24:26 +0200 Subject: [PATCH] Secrets: Remove proxy certs (#110140) --- pkg/registry/apis/secret/decrypt/grpc_client.go | 10 ---------- pkg/registry/apis/secret/decrypt/service.go | 6 +----- pkg/registry/apis/secret/decrypt/service_test.go | 4 ---- pkg/registry/apis/secret/inline/grpc_client.go | 10 ---------- pkg/registry/apis/secret/inline/service.go | 6 +----- pkg/registry/apis/secret/inline/service_test.go | 4 ---- pkg/services/apiserver/options/storage.go | 4 ---- 7 files changed, 2 insertions(+), 42 deletions(-) diff --git a/pkg/registry/apis/secret/decrypt/grpc_client.go b/pkg/registry/apis/secret/decrypt/grpc_client.go index 9919ec67f9b..2f3a2faa919 100644 --- a/pkg/registry/apis/secret/decrypt/grpc_client.go +++ b/pkg/registry/apis/secret/decrypt/grpc_client.go @@ -34,8 +34,6 @@ var _ contracts.DecryptService = &GRPCDecryptClient{} type TLSConfig struct { UseTLS bool - CertFile string - KeyFile string CAFile string ServerName string InsecureSkipVerify bool @@ -91,14 +89,6 @@ func createTLSCredentials(config TLSConfig) (credentials.TransportCredentials, e tlsConfig.RootCAs = caCertPool } - if config.CertFile != "" && config.KeyFile != "" { - cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile) - if err != nil { - return nil, fmt.Errorf("failed to load client certificate: %w", err) - } - tlsConfig.Certificates = []tls.Certificate{cert} - } - if config.ServerName != "" { tlsConfig.ServerName = config.ServerName } diff --git a/pkg/registry/apis/secret/decrypt/service.go b/pkg/registry/apis/secret/decrypt/service.go index 28a247ae103..983c06f542f 100644 --- a/pkg/registry/apis/secret/decrypt/service.go +++ b/pkg/registry/apis/secret/decrypt/service.go @@ -52,13 +52,9 @@ func readTLSFromConfig(cfg *setting.Cfg) TLSConfig { } } - apiServer := cfg.SectionWithEnvOverrides("grafana-apiserver") - return TLSConfig{ UseTLS: true, - CertFile: apiServer.Key("proxy_client_cert_file").MustString(""), - KeyFile: apiServer.Key("proxy_client_key_file").MustString(""), - CAFile: apiServer.Key("apiservice_ca_bundle_file").MustString(""), + CAFile: cfg.SectionWithEnvOverrides("grafana-apiserver").Key("apiservice_ca_bundle_file").MustString(""), ServerName: cfg.SecretsManagement.GrpcServerTLSServerName, InsecureSkipVerify: cfg.SecretsManagement.GrpcServerTLSSkipVerify, } diff --git a/pkg/registry/apis/secret/decrypt/service_test.go b/pkg/registry/apis/secret/decrypt/service_test.go index e1fd85a6fe3..077e481e112 100644 --- a/pkg/registry/apis/secret/decrypt/service_test.go +++ b/pkg/registry/apis/secret/decrypt/service_test.go @@ -207,10 +207,6 @@ func TestDecryptService(t *testing.T) { require.NoError(t, err) apiServer := cfg.Raw.Section("grafana-apiserver") - _, err = apiServer.NewKey("proxy_client_cert_file", certPaths.ClientCert) - require.NoError(t, err) - _, err = apiServer.NewKey("proxy_client_key_file", certPaths.ClientKey) - require.NoError(t, err) _, err = apiServer.NewKey("apiservice_ca_bundle_file", certPaths.CA) require.NoError(t, err) diff --git a/pkg/registry/apis/secret/inline/grpc_client.go b/pkg/registry/apis/secret/inline/grpc_client.go index 9ca027e2c00..7b9157aef80 100644 --- a/pkg/registry/apis/secret/inline/grpc_client.go +++ b/pkg/registry/apis/secret/inline/grpc_client.go @@ -31,8 +31,6 @@ var _ contracts.InlineSecureValueSupport = &GRPCInlineClient{} type TLSConfig struct { UseTLS bool - CertFile string - KeyFile string CAFile string ServerName string InsecureSkipVerify bool @@ -79,14 +77,6 @@ func createTLSCredentials(config TLSConfig) (credentials.TransportCredentials, e tlsConfig.RootCAs = caCertPool } - if config.CertFile != "" && config.KeyFile != "" { - cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile) - if err != nil { - return nil, fmt.Errorf("failed to load client certificate: %w", err) - } - tlsConfig.Certificates = []tls.Certificate{cert} - } - if config.ServerName != "" { tlsConfig.ServerName = config.ServerName } diff --git a/pkg/registry/apis/secret/inline/service.go b/pkg/registry/apis/secret/inline/service.go index 8d48dfa8fb9..73b6798a7de 100644 --- a/pkg/registry/apis/secret/inline/service.go +++ b/pkg/registry/apis/secret/inline/service.go @@ -67,13 +67,9 @@ func readTLSFromConfig(cfg *setting.Cfg) TLSConfig { } } - apiServer := cfg.SectionWithEnvOverrides("grafana-apiserver") - return TLSConfig{ UseTLS: true, - CertFile: apiServer.Key("proxy_client_cert_file").MustString(""), - KeyFile: apiServer.Key("proxy_client_key_file").MustString(""), - CAFile: apiServer.Key("apiservice_ca_bundle_file").MustString(""), + CAFile: cfg.SectionWithEnvOverrides("grafana-apiserver").Key("apiservice_ca_bundle_file").MustString(""), ServerName: cfg.SecretsManagement.GrpcServerTLSServerName, InsecureSkipVerify: cfg.SecretsManagement.GrpcServerTLSSkipVerify, } diff --git a/pkg/registry/apis/secret/inline/service_test.go b/pkg/registry/apis/secret/inline/service_test.go index 9fc7679c2ad..aad28e6c973 100644 --- a/pkg/registry/apis/secret/inline/service_test.go +++ b/pkg/registry/apis/secret/inline/service_test.go @@ -128,10 +128,6 @@ func TestProvideInlineSecureValueService(t *testing.T) { require.NoError(t, err) apiServer := cfg.Raw.Section("grafana-apiserver") - _, err = apiServer.NewKey("proxy_client_cert_file", certPaths.ClientCert) - require.NoError(t, err) - _, err = apiServer.NewKey("proxy_client_key_file", certPaths.ClientKey) - require.NoError(t, err) _, err = apiServer.NewKey("apiservice_ca_bundle_file", certPaths.CA) require.NoError(t, err) diff --git a/pkg/services/apiserver/options/storage.go b/pkg/services/apiserver/options/storage.go index db4a0fe891d..f692c40b293 100644 --- a/pkg/services/apiserver/options/storage.go +++ b/pkg/services/apiserver/options/storage.go @@ -204,10 +204,6 @@ func (o *StorageOptions) ApplyTo(serverConfig *genericapiserver.RecommendedConfi ServerName: o.SecretsManagerGrpcServerTLSServerName, InsecureSkipVerify: o.SecretsManagerGrpcServerTLSSkipVerify, } - if o.SecretsManagerGrpcServerUseTLS && secureServing != nil { - tlsCfg.CertFile = secureServing.ServerCert.CertKey.CertFile - tlsCfg.KeyFile = secureServing.ServerCert.CertKey.KeyFile - } inlineSecureValueService, err := inlinesecurevalue.NewGRPCSecureValueService( &grpcutils.GrpcClientConfig{ Token: o.GrpcClientAuthenticationToken,