SecretsManager: Unify KMS across OSS and Enterprise (#108085)

* everything is compiling

* tests passing

* remove used object

* write a test for secret key upgrades

* misc cleanup

* clean up some wording

* lint issues

* fix a typo

* import hashicorp dependency explicitly

* simplify oss kmsprovider package structure

* consolidate current provider and available providers

* add a new manager configuration test

* fix hashivault import

* fix import issue

* fix unit tests

* Update go.mod

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
This commit is contained in:
Michael Mandrus
2025-07-15 14:39:20 -04:00
committed by GitHub
co-authored by Matheus Macabu
parent 469f94028f
commit ab51794bdb
20 changed files with 631 additions and 242 deletions
+2 -2
View File
@@ -43,7 +43,7 @@ import (
"github.com/grafana/grafana/pkg/registry/apis/provisioning/repository/github"
secretcontracts "github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
secretdecrypt "github.com/grafana/grafana/pkg/registry/apis/secret/decrypt"
gsmEncryption "github.com/grafana/grafana/pkg/registry/apis/secret/encryption"
cipher "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/cipher/service"
encryptionManager "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/manager"
secretsecurevalueservice "github.com/grafana/grafana/pkg/registry/apis/secret/service"
secretvalidator "github.com/grafana/grafana/pkg/registry/apis/secret/validator"
@@ -437,7 +437,7 @@ var wireBasicSet = wire.NewSet(
secretdatabase.ProvideDatabase,
wire.Bind(new(secretcontracts.Database), new(*secretdatabase.Database)),
encryptionManager.ProvideEncryptionManager,
gsmEncryption.ProvideThirdPartyProviderMap,
cipher.ProvideAESGCMCipherService,
// Unified storage
resource.ProvideStorageMetrics,
resource.ProvideIndexMetrics,
+69 -54
View File
File diff suppressed because one or more lines are too long
+2
View File
@@ -14,6 +14,7 @@ import (
"github.com/grafana/grafana/pkg/registry"
apisregistry "github.com/grafana/grafana/pkg/registry/apis"
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
gsmKMSProviders "github.com/grafana/grafana/pkg/registry/apis/secret/encryption/kmsproviders"
"github.com/grafana/grafana/pkg/registry/apis/secret/secretkeeper"
"github.com/grafana/grafana/pkg/registry/backgroundsvcs"
"github.com/grafana/grafana/pkg/registry/usagestatssvcs"
@@ -130,6 +131,7 @@ var wireExtsBasicSet = wire.NewSet(
builder.ProvideDefaultBuildHandlerChainFuncFromBuilders,
aggregatorrunner.ProvideNoopAggregatorConfigurator,
apisregistry.WireSetExts,
gsmKMSProviders.ProvideOSSKMSProviders,
)
var wireExtsSet = wire.NewSet(