public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Provide grpc and local inline secure value client (#109179)

Browse Source 
* TestUtils: Add helper to create certs

* InlineSecureValue: Move to its own package rather than service

* Settings: Rename decrypt server configs to grpc prefixed as it is more generic

* InlineSecureValue: Add gRPC client

* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg

* Wire: Add ProvideInlineSecureValueService to basic wireset

* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface

* Settings: Unify decrypt+inline setting into generic grpc client
This commit is contained in:
Matheus Macabu
2025-08-06 09:04:55 +02:00
committed by GitHub
parent f3b8a891af
commit fc117afebc
14 changed files with 802 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/setting/setting_secrets_manager.go
+12 -12
View File
@@ -16,24 +16,24 @@ type SecretsManagerSettings struct {
// In OSS, the provider type can only be "secret_key". In Enterprise, it can additionally be one of: "aws_kms", "azure_keyvault", "google_kms", "hashicorp_vault"
ConfiguredKMSProviders map[string]map[string]string
DecryptServerType string // "local" or "grpc"
DecryptServerUseTLS bool // Applicable for decrypt_server_type=grpc. Whether to use TLS for the decrypt server
DecryptServerTLSSkipVerify bool // Applicable for decrypt_server_type=grpc. Whether to skip TLS verification for the decrypt server
DecryptServerTLSServerName string // Applicable for decrypt_server_type=grpc. Server name to use for TLS verification
DecryptServerAddress string // Applicable for decrypt_server_type=grpc. Address for external secrets server
DecryptGrafanaServiceName string // Service name to use for background grafana decryption
GrpcClientEnable bool // Whether to enable the gRPC client. If disabled, it will use the in-process services implementations.
GrpcServerUseTLS bool // Whether to use TLS when communicating with the gRPC server
GrpcServerTLSSkipVerify bool // Whether to skip TLS verification when communicating with the gRPC server
GrpcServerTLSServerName string // Server name to use for TLS verification
GrpcServerAddress string // Address for gRPC secrets server
GrpcGrafanaServiceName string // Service name to use for background grafana decryption/inline
}
func (cfg *Cfg) readSecretsManagerSettings() {
secretsMgmt := cfg.Raw.Section("secrets_manager")
cfg.SecretsManagement.CurrentEncryptionProvider = secretsMgmt.Key("encryption_provider").MustString(MisconfiguredProvider)
cfg.SecretsManagement.DecryptServerType = valueAsString(secretsMgmt, "decrypt_server_type", "local")
cfg.SecretsManagement.DecryptServerUseTLS = secretsMgmt.Key("decrypt_server_use_tls").MustBool(false)
cfg.SecretsManagement.DecryptServerTLSSkipVerify = secretsMgmt.Key("decrypt_server_tls_skip_verify").MustBool(false)
cfg.SecretsManagement.DecryptServerTLSServerName = valueAsString(secretsMgmt, "decrypt_server_tls_server_name", "")
cfg.SecretsManagement.DecryptServerAddress = valueAsString(secretsMgmt, "decrypt_server_address", "")
cfg.SecretsManagement.DecryptGrafanaServiceName = valueAsString(secretsMgmt, "decrypt_grafana_service_name", "")
cfg.SecretsManagement.GrpcClientEnable = secretsMgmt.Key("grpc_client_enable").MustBool(false)
cfg.SecretsManagement.GrpcServerUseTLS = secretsMgmt.Key("grpc_server_use_tls").MustBool(false)
cfg.SecretsManagement.GrpcServerTLSSkipVerify = secretsMgmt.Key("grpc_server_tls_skip_verify").MustBool(false)
cfg.SecretsManagement.GrpcServerTLSServerName = valueAsString(secretsMgmt, "grpc_server_tls_server_name", "")
cfg.SecretsManagement.GrpcServerAddress = valueAsString(secretsMgmt, "grpc_server_address", "")
cfg.SecretsManagement.GrpcGrafanaServiceName = valueAsString(secretsMgmt, "grpc_grafana_service_name", "")
// Extract available KMS providers from configuration sections
providers := make(map[string]map[string]string)