* Secrets: changes to allow a 3rd party keeper / secret references
* fix test
* make gofmt
* lint
* fix tests
* assign aws secrets manager to @grafana/grafana-operator-experience-squad
* rename Keeper.Reference to Keeper.RetrieveReference
* rename ModelSecretsManager to ModelAWSSecretsManager
* validator: ensure that only one of keeper.Spec.Aws.AccessKey or keeper.Spec.Aws.AssumeRole are set
* move secrets manager dep / go mod tidy
* move secrets manager dep
* keeper validator: move 3rd party secret stores validation to their own functions
* add github.com/aws/aws-sdk-go-v2/service/secretsmanager pkg/extensions/enterprise_imports
* make update-workspace
* undo go.mod changes in /apps
* make update-workspace
* fix test
* add github.com/aws/aws-sdk-go-v2/service/secretsmanager to enterprise_imports
* make update-workspace
* gcworker: handle refs
* make update-workspace
* create toggle: FeatureStageExperimental
* allow features.IsEnabled for now
* format
* Secrets manager: create secure value using the active keeper
* SecureValueService.Update: fetch secure value from db to get the keeper
* fix keeper_store_test.go
* SecureValueService: fix bug in update where the current version keeper wasn't being passed to the createNewVersion method
* make gofmt
* remove outdated test
* update TestModel
* undo enterprise_imports changes
* use xkube.Namespace
* migrator: set secret_secure_value.keeper to 'system' when the column is null
* indent cue
* fix tests
* fix enterprise imports
* properly fix enterprise imports
* make update-workspace
* go mod tidy
---------
Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
* Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)
* everything compiles
* tests pass
* remove file included by accident
* add entry to gitignore
* some scaffolding for the migration executor
* remove file
* implement and test the migration
* use xkube.Namespace in our interfaces
* add todo
* update wire deps
* add some logs
* fix wire dependency ordering
* create tests to validate error conditions during migrations
* only run the migration as an MT api server
* formatting issues
* change detection of secrets running as MT server
* add todo
* use more specific initializer flags
* make secrets playwright tests work
* set new properties to true by default
* remove developer mode flag
* fix unit tests
* everything compiles
* tests pass
* remove file included by accident
* add entry to gitignore
* some scaffolding for the migration executor
* remove file
* implement and test the migration
* use xkube.Namespace in our interfaces
* add todo
* update wire deps
* add some logs
* fix wire dependency ordering
* create tests to validate error conditions during migrations
* TestUtils: Add helper to create certs
* InlineSecureValue: Move to its own package rather than service
* Settings: Rename decrypt server configs to grpc prefixed as it is more generic
* InlineSecureValue: Add gRPC client
* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg
* Wire: Add ProvideInlineSecureValueService to basic wireset
* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface
* Settings: Unify decrypt+inline setting into generic grpc client
* Secrets: Add service name as explicit parameter for Decrypt
* Apply suggestions from code review
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
---------
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
* list all encrypted values and count
* separate interfaces
* add time filter to global queries
* initial secrets consolidation
* Revert defaults
* More verbose description of the operation
* Add consolidation tests and tracing
* Fix lint
* Revert debug log
* Use provider in Webhooks registration
* First stab at using the new client
* Simplify mock
* Able to generate graph in OSS
* Remove line already ensured by provider
* Handle the K8s not found error as well
* Commit regenerated wire file
* Add the hack also for deletion
* Fix secrets test util
* Format file
* Secrets: delete unused FakeKeeper
* Secrets: encrypted value storage stores versions
* add version to span
* trigger build
* remove ineffectual assignment
* lint
* drop secret_encrypted_value.uid / add name and version columns
* Secrets: add state machine test for CRUDL+decrpt operations
* make update-workspace
* make update-workspace
* make enterprise-dev
* make update-workspace
* fix go.mod
* make update-workspace
* fix gomod
* make update-workspace
---------
Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
* Secrets: make operations sync
* k8s gen / update query to list secure values to include the version
* always store new version of a secret
* make update-workspace
* go mod tidy
* update queries
* update queries
* improve and use testutils in decrypt_store_test
* fix broken test
* make update-workspace
* ./hack/update-codegen.sh secret
* update Test_SecureValueMetadataStorage_CreateAndRead
* undo dependency changes
* linter: fix remaining errors
---------
Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Bruno
Matheus Macabu
Michael Mandrus
Stephanie Hingtgen
Alexander Zobnin
lean.dev
Dana Axinte
Roberto Jiménez Sánchez
