public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Provisioning: Use inline secrets for gitsync (#109908)

Browse Source 
Co-authored-by: Clarity-89 <homes89@ukr.net>
Co-authored-by: Roberto Jimenez Sanchez <roberto.jimenez@grafana.com>
This commit is contained in:
Ryan McKinley
2025-08-22 18:38:28 +02:00
committed by GitHub
co-authored by Clarity-89 Roberto Jimenez Sanchez
parent 04f392d37b
commit ce65391067
69 changed files with 694 additions and 4255 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/provisioning/pkg/apis/provisioning/v0alpha1/types.go
+1 -24
View File
@@ -21,12 +21,11 @@ type Repository struct {
Status RepositoryStatus `json:"status,omitempty"`
}
// NOT YET USED FOR REAL -- testing secure value workflow
type SecureValues struct {
// Token used to connect the configured repository
Token common.InlineSecureValue `json:"token,omitzero,omitempty"`
// Some webhooks (github) require a secret key value
// Some webhooks (including github) require a secret key value
WebhookSecret common.InlineSecureValue `json:"webhookSecret,omitzero,omitempty"`
}
@@ -55,11 +54,6 @@ type GitHubRepositoryConfig struct {
// The branch to use in the repository.
Branch string `json:"branch"`
// Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.
Token string `json:"token,omitempty"`
// Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.
// +listType=atomic
EncryptedToken []byte `json:"encryptedToken,omitempty"`
// Whether we should show dashboard previews for pull requests.
// By default, this is false (i.e. we will not create previews).
@@ -80,11 +74,6 @@ type GitRepositoryConfig struct {
Branch string `json:"branch"`
// TokenUser is the user that will be used to access the repository if it's a personal access token.
TokenUser string `json:"tokenUser,omitempty"`
// Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.
Token string `json:"token,omitempty"`
// Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.
// +listType=atomic
EncryptedToken []byte `json:"encryptedToken,omitempty"`
// Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository.
// This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed.
// The path is relative to the root of the repository, regardless of the leading slash.
@@ -100,11 +89,6 @@ type BitbucketRepositoryConfig struct {
Branch string `json:"branch"`
// TokenUser is the user that will be used to access the repository if it's a personal access token.
TokenUser string `json:"tokenUser,omitempty"`
// Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.
Token string `json:"token,omitempty"`
// Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.
// +listType=atomic
EncryptedToken []byte `json:"encryptedToken,omitempty"`
// Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository.
// This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed.
// The path is relative to the root of the repository, regardless of the leading slash.
@@ -118,11 +102,6 @@ type GitLabRepositoryConfig struct {
URL string `json:"url,omitempty"`
// The branch to use in the repository.
Branch string `json:"branch"`
// Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.
Token string `json:"token,omitempty"`
// Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.
// +listType=atomic
EncryptedToken []byte `json:"encryptedToken,omitempty"`
// Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository.
// This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed.
// The path is relative to the root of the repository, regardless of the leading slash.
@@ -297,8 +276,6 @@ type SyncStatus struct {
type WebhookStatus struct {
ID int64 `json:"id,omitempty"`
URL string `json:"url,omitempty"`
Secret string `json:"secret,omitempty"`
EncryptedSecret []byte `json:"encryptedSecret,omitempty"`
SubscribedEvents []string `json:"subscribedEvents,omitempty"`
LastEvent int64 `json:"lastEvent,omitempty"`
}
apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.deepcopy.go
+4 -29
View File
@@ -30,11 +30,6 @@ func (in *Author) DeepCopy() *Author {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *BitbucketRepositoryConfig) DeepCopyInto(out *BitbucketRepositoryConfig) {
*out = *in
if in.EncryptedToken != nil {
in, out := &in.EncryptedToken, &out.EncryptedToken
*out = make([]byte, len(*in))
copy(*out, *in)
}
return
}
@@ -156,11 +151,6 @@ func (in *FileList) DeepCopyObject() runtime.Object {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *GitHubRepositoryConfig) DeepCopyInto(out *GitHubRepositoryConfig) {
*out = *in
if in.EncryptedToken != nil {
in, out := &in.EncryptedToken, &out.EncryptedToken
*out = make([]byte, len(*in))
copy(*out, *in)
}
return
}
@@ -177,11 +167,6 @@ func (in *GitHubRepositoryConfig) DeepCopy() *GitHubRepositoryConfig {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *GitLabRepositoryConfig) DeepCopyInto(out *GitLabRepositoryConfig) {
*out = *in
if in.EncryptedToken != nil {
in, out := &in.EncryptedToken, &out.EncryptedToken
*out = make([]byte, len(*in))
copy(*out, *in)
}
return
}
@@ -198,11 +183,6 @@ func (in *GitLabRepositoryConfig) DeepCopy() *GitLabRepositoryConfig {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *GitRepositoryConfig) DeepCopyInto(out *GitRepositoryConfig) {
*out = *in
if in.EncryptedToken != nil {
in, out := &in.EncryptedToken, &out.EncryptedToken
*out = make([]byte, len(*in))
copy(*out, *in)
}
return
}
@@ -738,22 +718,22 @@ func (in *RepositorySpec) DeepCopyInto(out *RepositorySpec) {
if in.GitHub != nil {
in, out := &in.GitHub, &out.GitHub
*out = new(GitHubRepositoryConfig)
(*in).DeepCopyInto(*out)
**out = **in
}
if in.Git != nil {
in, out := &in.Git, &out.Git
*out = new(GitRepositoryConfig)
(*in).DeepCopyInto(*out)
**out = **in
}
if in.Bitbucket != nil {
in, out := &in.Bitbucket, &out.Bitbucket
*out = new(BitbucketRepositoryConfig)
(*in).DeepCopyInto(*out)
**out = **in
}
if in.GitLab != nil {
in, out := &in.GitLab, &out.GitLab
*out = new(GitLabRepositoryConfig)
(*in).DeepCopyInto(*out)
**out = **in
}
return
}
@@ -1220,11 +1200,6 @@ func (in *WebhookResponse) DeepCopyObject() runtime.Object {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *WebhookStatus) DeepCopyInto(out *WebhookStatus) {
*out = *in
if in.EncryptedSecret != nil {
in, out := &in.EncryptedSecret, &out.EncryptedSecret
*out = make([]byte, len(*in))
copy(*out, *in)
}
if in.SubscribedEvents != nil {
in, out := &in.SubscribedEvents, &out.SubscribedEvents
*out = make([]string, len(*in))
apps/provisioning/pkg/apis/provisioning/v0alpha1/zz_generated.openapi.go
+2 -91
View File
@@ -128,25 +128,6 @@ func schema_pkg_apis_provisioning_v0alpha1_BitbucketRepositoryConfig(ref common.
Format: "",
},
},
"token": {
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.",
Type: []string{"string"},
Format: "",
},
},
"encryptedToken": {
VendorExtensible: spec.VendorExtensible{
Extensions: spec.Extensions{
"x-kubernetes-list-type": "atomic",
},
},
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.",
Type: []string{"string"},
Format: "byte",
},
},
"path": {
SchemaProps: spec.SchemaProps{
Description: "Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository. This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed. The path is relative to the root of the repository, regardless of the leading slash.\n\nWhen specifying something like `grafana-`, we will not look for `grafana-*`; we will only look for files under the directory `/grafana-/`. That means `/grafana-example.json` would not be found.",
@@ -402,25 +383,6 @@ func schema_pkg_apis_provisioning_v0alpha1_GitHubRepositoryConfig(ref common.Ref
Format: "",
},
},
"token": {
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.",
Type: []string{"string"},
Format: "",
},
},
"encryptedToken": {
VendorExtensible: spec.VendorExtensible{
Extensions: spec.Extensions{
"x-kubernetes-list-type": "atomic",
},
},
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.",
Type: []string{"string"},
Format: "byte",
},
},
"generateDashboardPreviews": {
SchemaProps: spec.SchemaProps{
Description: "Whether we should show dashboard previews for pull requests. By default, this is false (i.e. we will not create previews).",
@@ -463,25 +425,6 @@ func schema_pkg_apis_provisioning_v0alpha1_GitLabRepositoryConfig(ref common.Ref
Format: "",
},
},
"token": {
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.",
Type: []string{"string"},
Format: "",
},
},
"encryptedToken": {
VendorExtensible: spec.VendorExtensible{
Extensions: spec.Extensions{
"x-kubernetes-list-type": "atomic",
},
},
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.",
Type: []string{"string"},
Format: "byte",
},
},
"path": {
SchemaProps: spec.SchemaProps{
Description: "Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository. This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed. The path is relative to the root of the repository, regardless of the leading slash.\n\nWhen specifying something like `grafana-`, we will not look for `grafana-*`; we will only look for files under the directory `/grafana-/`. That means `/grafana-example.json` would not be found.",
@@ -524,25 +467,6 @@ func schema_pkg_apis_provisioning_v0alpha1_GitRepositoryConfig(ref common.Refere
Format: "",
},
},
"token": {
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository. If set, it will be encrypted into encryptedToken, then set to an empty string again.",
Type: []string{"string"},
Format: "",
},
},
"encryptedToken": {
VendorExtensible: spec.VendorExtensible{
Extensions: spec.Extensions{
"x-kubernetes-list-type": "atomic",
},
},
SchemaProps: spec.SchemaProps{
Description: "Token for accessing the repository, but encrypted. This is not possible to read back to a user decrypted.",
Type: []string{"string"},
Format: "byte",
},
},
"path": {
SchemaProps: spec.SchemaProps{
Description: "Path is the subdirectory for the Grafana data. If specified, Grafana will ignore anything that is outside this directory in the repository. This is usually something like `grafana/`. Trailing and leading slash are not required. They are always added when needed. The path is relative to the root of the repository, regardless of the leading slash.\n\nWhen specifying something like `grafana-`, we will not look for `grafana-*`; we will only look for files under the directory `/grafana-/`. That means `/grafana-example.json` would not be found.",
@@ -2378,8 +2302,7 @@ func schema_pkg_apis_provisioning_v0alpha1_SecureValues(ref common.ReferenceCall
return common.OpenAPIDefinition{
Schema: spec.Schema{
SchemaProps: spec.SchemaProps{
Description: "NOT YET USED FOR REAL -- testing secure value workflow",
Type: []string{"object"},
Type: []string{"object"},
Properties: map[string]spec.Schema{
"token": {
SchemaProps: spec.SchemaProps{
@@ -2390,7 +2313,7 @@ func schema_pkg_apis_provisioning_v0alpha1_SecureValues(ref common.ReferenceCall
},
"webhookSecret": {
SchemaProps: spec.SchemaProps{
Description: "Some webhooks (github) require a secret key value",
Description: "Some webhooks (including github) require a secret key value",
Default: map[string]interface{}{},
Ref: ref("github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1.InlineSecureValue"),
},
@@ -2671,18 +2594,6 @@ func schema_pkg_apis_provisioning_v0alpha1_WebhookStatus(ref common.ReferenceCal
Format: "",
},
},
"secret": {
SchemaProps: spec.SchemaProps{
Type: []string{"string"},
Format: "",
},
},
"encryptedSecret": {
SchemaProps: spec.SchemaProps{
Type: []string{"string"},
Format: "byte",
},
},
"subscribedEvents": {
SchemaProps: spec.SchemaProps{
Type: []string{"array"},
apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/bitbucketrepositoryconfig.go
+4 -24
View File
@@ -7,12 +7,10 @@ package v0alpha1
// BitbucketRepositoryConfigApplyConfiguration represents a declarative configuration of the BitbucketRepositoryConfig type for use
// with apply.
type BitbucketRepositoryConfigApplyConfiguration struct {
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
TokenUser *string `json:"tokenUser,omitempty"`
Token *string `json:"token,omitempty"`
EncryptedToken []byte `json:"encryptedToken,omitempty"`
Path *string `json:"path,omitempty"`
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
TokenUser *string `json:"tokenUser,omitempty"`
Path *string `json:"path,omitempty"`
}
// BitbucketRepositoryConfigApplyConfiguration constructs a declarative configuration of the BitbucketRepositoryConfig type for use with
@@ -45,24 +43,6 @@ func (b *BitbucketRepositoryConfigApplyConfiguration) WithTokenUser(value string
return b
}
// WithToken sets the Token field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Token field is set to the value of the last call.
func (b *BitbucketRepositoryConfigApplyConfiguration) WithToken(value string) *BitbucketRepositoryConfigApplyConfiguration {
b.Token = &value
return b
}
// WithEncryptedToken adds the given value to the EncryptedToken field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the EncryptedToken field.
func (b *BitbucketRepositoryConfigApplyConfiguration) WithEncryptedToken(values ...byte) *BitbucketRepositoryConfigApplyConfiguration {
for i := range values {
b.EncryptedToken = append(b.EncryptedToken, values[i])
}
return b
}
// WithPath sets the Path field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Path field is set to the value of the last call.
apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/githubrepositoryconfig.go
-20
View File
@@ -9,8 +9,6 @@ package v0alpha1
type GitHubRepositoryConfigApplyConfiguration struct {
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
Token *string `json:"token,omitempty"`
EncryptedToken []byte `json:"encryptedToken,omitempty"`
GenerateDashboardPreviews *bool `json:"generateDashboardPreviews,omitempty"`
Path *string `json:"path,omitempty"`
}
@@ -37,24 +35,6 @@ func (b *GitHubRepositoryConfigApplyConfiguration) WithBranch(value string) *Git
return b
}
// WithToken sets the Token field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Token field is set to the value of the last call.
func (b *GitHubRepositoryConfigApplyConfiguration) WithToken(value string) *GitHubRepositoryConfigApplyConfiguration {
b.Token = &value
return b
}
// WithEncryptedToken adds the given value to the EncryptedToken field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the EncryptedToken field.
func (b *GitHubRepositoryConfigApplyConfiguration) WithEncryptedToken(values ...byte) *GitHubRepositoryConfigApplyConfiguration {
for i := range values {
b.EncryptedToken = append(b.EncryptedToken, values[i])
}
return b
}
// WithGenerateDashboardPreviews sets the GenerateDashboardPreviews field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the GenerateDashboardPreviews field is set to the value of the last call.
apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/gitlabrepositoryconfig.go
+3 -23
View File
@@ -7,11 +7,9 @@ package v0alpha1
// GitLabRepositoryConfigApplyConfiguration represents a declarative configuration of the GitLabRepositoryConfig type for use
// with apply.
type GitLabRepositoryConfigApplyConfiguration struct {
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
Token *string `json:"token,omitempty"`
EncryptedToken []byte `json:"encryptedToken,omitempty"`
Path *string `json:"path,omitempty"`
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
Path *string `json:"path,omitempty"`
}
// GitLabRepositoryConfigApplyConfiguration constructs a declarative configuration of the GitLabRepositoryConfig type for use with
@@ -36,24 +34,6 @@ func (b *GitLabRepositoryConfigApplyConfiguration) WithBranch(value string) *Git
return b
}
// WithToken sets the Token field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Token field is set to the value of the last call.
func (b *GitLabRepositoryConfigApplyConfiguration) WithToken(value string) *GitLabRepositoryConfigApplyConfiguration {
b.Token = &value
return b
}
// WithEncryptedToken adds the given value to the EncryptedToken field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the EncryptedToken field.
func (b *GitLabRepositoryConfigApplyConfiguration) WithEncryptedToken(values ...byte) *GitLabRepositoryConfigApplyConfiguration {
for i := range values {
b.EncryptedToken = append(b.EncryptedToken, values[i])
}
return b
}
// WithPath sets the Path field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Path field is set to the value of the last call.
apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/gitrepositoryconfig.go
+4 -24
View File
@@ -7,12 +7,10 @@ package v0alpha1
// GitRepositoryConfigApplyConfiguration represents a declarative configuration of the GitRepositoryConfig type for use
// with apply.
type GitRepositoryConfigApplyConfiguration struct {
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
TokenUser *string `json:"tokenUser,omitempty"`
Token *string `json:"token,omitempty"`
EncryptedToken []byte `json:"encryptedToken,omitempty"`
Path *string `json:"path,omitempty"`
URL *string `json:"url,omitempty"`
Branch *string `json:"branch,omitempty"`
TokenUser *string `json:"tokenUser,omitempty"`
Path *string `json:"path,omitempty"`
}
// GitRepositoryConfigApplyConfiguration constructs a declarative configuration of the GitRepositoryConfig type for use with
@@ -45,24 +43,6 @@ func (b *GitRepositoryConfigApplyConfiguration) WithTokenUser(value string) *Git
return b
}
// WithToken sets the Token field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Token field is set to the value of the last call.
func (b *GitRepositoryConfigApplyConfiguration) WithToken(value string) *GitRepositoryConfigApplyConfiguration {
b.Token = &value
return b
}
// WithEncryptedToken adds the given value to the EncryptedToken field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the EncryptedToken field.
func (b *GitRepositoryConfigApplyConfiguration) WithEncryptedToken(values ...byte) *GitRepositoryConfigApplyConfiguration {
for i := range values {
b.EncryptedToken = append(b.EncryptedToken, values[i])
}
return b
}
// WithPath sets the Path field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Path field is set to the value of the last call.
apps/provisioning/pkg/generated/applyconfiguration/provisioning/v0alpha1/webhookstatus.go
-20
View File
@@ -9,8 +9,6 @@ package v0alpha1
type WebhookStatusApplyConfiguration struct {
ID *int64 `json:"id,omitempty"`
URL *string `json:"url,omitempty"`
Secret *string `json:"secret,omitempty"`
EncryptedSecret []byte `json:"encryptedSecret,omitempty"`
SubscribedEvents []string `json:"subscribedEvents,omitempty"`
LastEvent *int64 `json:"lastEvent,omitempty"`
}
@@ -37,24 +35,6 @@ func (b *WebhookStatusApplyConfiguration) WithURL(value string) *WebhookStatusAp
return b
}
// WithSecret sets the Secret field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Secret field is set to the value of the last call.
func (b *WebhookStatusApplyConfiguration) WithSecret(value string) *WebhookStatusApplyConfiguration {
b.Secret = &value
return b
}
// WithEncryptedSecret adds the given value to the EncryptedSecret field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the EncryptedSecret field.
func (b *WebhookStatusApplyConfiguration) WithEncryptedSecret(values ...byte) *WebhookStatusApplyConfiguration {
for i := range values {
b.EncryptedSecret = append(b.EncryptedSecret, values[i])
}
return b
}
// WithSubscribedEvents adds the given value to the SubscribedEvents field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the SubscribedEvents field.