Secrets: Save owner reference fields in secure value db table (#108905)

* Secrets: Save owner reference fields in secure value db table * Save api group and version separately
2025-07-31 10:42:19 +02:00
parent 66bebe94e0
commit 80d7892d6a
19 changed files with 243 additions and 67 deletions
@@ -10,22 +10,26 @@ import (
 	secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
-	"github.com/grafana/grafana/pkg/storage/secret/migrator"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 )

 type secureValueDB struct {
 	// Kubernetes Metadata
-	GUID        string
-	Name        string
-	Namespace   string
-	Annotations string // map[string]string
-	Labels      string // map[string]string
-	Created     int64
-	CreatedBy   string
-	Updated     int64
-	UpdatedBy   string
+	GUID                     string
+	Name                     string
+	Namespace                string
+	Annotations              string // map[string]string
+	Labels                   string // map[string]string
+	Created                  int64
+	CreatedBy                string
+	Updated                  int64
+	UpdatedBy                string
+	OwnerReferenceAPIGroup   sql.NullString
+	OwnerReferenceAPIVersion sql.NullString
+	OwnerReferenceKind       sql.NullString
+	OwnerReferenceName       sql.NullString

 	// Kubernetes Status
 	Active  bool
@@ -39,10 +43,6 @@ type secureValueDB struct {
 	ExternalID  string
 }

-func (*secureValueDB) TableName() string {
-	return migrator.TableNameSecureValue
-}
-
 // toKubernetes maps a DB row into a Kubernetes resource (metadata + spec).
 func (sv *secureValueDB) toKubernetes() (*secretv1beta1.SecureValue, error) {
 	annotations := make(map[string]string, 0)
@@ -85,8 +85,6 @@ func (sv *secureValueDB) toKubernetes() (*secretv1beta1.SecureValue, error) {
 		resource.Spec.Ref = &sv.Ref.String
 	}

-	resource.Status.ExternalID = sv.ExternalID
-
 	// Set all meta fields here for consistency.
 	meta, err := utils.MetaAccessor(resource)
 	if err != nil {
@@ -106,6 +104,20 @@ func (sv *secureValueDB) toKubernetes() (*secretv1beta1.SecureValue, error) {
 	meta.SetUpdatedTimestamp(&updated)
 	meta.SetResourceVersionInt64(sv.Updated)

+	hasOwnerReference := sv.OwnerReferenceAPIGroup.Valid && sv.OwnerReferenceAPIGroup.String != "" &&
+		sv.OwnerReferenceAPIVersion.Valid && sv.OwnerReferenceAPIVersion.String != "" &&
+		sv.OwnerReferenceKind.Valid && sv.OwnerReferenceKind.String != "" &&
+		sv.OwnerReferenceName.Valid && sv.OwnerReferenceName.String != ""
+	if hasOwnerReference {
+		meta.SetOwnerReferences([]metav1.OwnerReference{
+			{
+				APIVersion: schema.GroupVersion{Group: sv.OwnerReferenceAPIGroup.String, Version: sv.OwnerReferenceAPIVersion.String}.String(),
+				Kind:       sv.OwnerReferenceKind.String,
+				Name:       sv.OwnerReferenceName.String,
+			},
+		})
+	}
+
 	return resource, nil
 }

@@ -179,16 +191,48 @@ func toRow(sv *secretv1beta1.SecureValue, externalID string) (*secureValueDB, er
 		return nil, fmt.Errorf("failed to get resource version: %w", err)
 	}

+	var (
+		ownerReferenceAPIGroup   sql.NullString
+		ownerReferenceAPIVersion sql.NullString
+		ownerReferenceKind       sql.NullString
+		ownerReferenceName       sql.NullString
+	)
+
+	ownerReferences := meta.GetOwnerReferences()
+	if len(ownerReferences) > 1 {
+		return nil, fmt.Errorf("only one owner reference is supported, found %d", len(ownerReferences))
+	}
+	if len(ownerReferences) == 1 {
+		ownerReference := ownerReferences[0]
+
+		gv, err := schema.ParseGroupVersion(ownerReference.APIVersion)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse owner reference API version %s: %w", ownerReference.APIVersion, err)
+		}
+		if gv.Group == "" {
+			return nil, fmt.Errorf("malformed api version %s requires <group>/<version> format", ownerReference.APIVersion)
+		}
+
+		ownerReferenceAPIGroup = toNullString(&gv.Group)
+		ownerReferenceAPIVersion = toNullString(&gv.Version)
+		ownerReferenceKind = toNullString(&ownerReference.Kind)
+		ownerReferenceName = toNullString(&ownerReference.Name)
+	}
+
 	return &secureValueDB{
-		GUID:        string(sv.UID),
-		Name:        sv.Name,
-		Namespace:   sv.Namespace,
-		Annotations: annotations,
-		Labels:      labels,
-		Created:     meta.GetCreationTimestamp().UnixMilli(),
-		CreatedBy:   meta.GetCreatedBy(),
-		Updated:     updatedTimestamp,
-		UpdatedBy:   meta.GetUpdatedBy(),
+		GUID:                     string(sv.UID),
+		Name:                     sv.Name,
+		Namespace:                sv.Namespace,
+		Annotations:              annotations,
+		Labels:                   labels,
+		Created:                  meta.GetCreationTimestamp().UnixMilli(),
+		CreatedBy:                meta.GetCreatedBy(),
+		Updated:                  updatedTimestamp,
+		UpdatedBy:                meta.GetUpdatedBy(),
+		OwnerReferenceAPIGroup:   ownerReferenceAPIGroup,
+		OwnerReferenceAPIVersion: ownerReferenceAPIVersion,
+		OwnerReferenceKind:       ownerReferenceKind,
+		OwnerReferenceName:       ownerReferenceName,

 		Version: sv.Status.Version,