public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
64,847 Commits 655 Branches 650 Tags
ash/react-19-ref-changes
Commit Graph
28 Commits
Author SHA1 Message Date
Bruno 7698970f22 Secrets: changes to allow a 3rd party keeper / secret references (#115156) 
* Secrets: changes to allow a 3rd party keeper / secret references

* fix test

* make gofmt

* lint

* fix tests

* assign aws secrets manager to @grafana/grafana-operator-experience-squad

* rename Keeper.Reference to Keeper.RetrieveReference

* rename ModelSecretsManager to ModelAWSSecretsManager

* validator: ensure that only one of keeper.Spec.Aws.AccessKey or keeper.Spec.Aws.AssumeRole are set

* move secrets manager dep / go mod tidy

* move secrets manager dep

* keeper validator: move 3rd party secret stores validation to their own functions

* add github.com/aws/aws-sdk-go-v2/service/secretsmanager pkg/extensions/enterprise_imports

* make update-workspace

* undo go.mod changes in /apps

* make update-workspace

* fix test

* add github.com/aws/aws-sdk-go-v2/service/secretsmanager to enterprise_imports

* make update-workspace

* gcworker: handle refs

* make update-workspace

* create toggle: FeatureStageExperimental

* allow features.IsEnabled for now

* format
 2026-01-06 11:30:04 -03:00
Matheus Macabu 21c1d9aedd Secrets: Remove unused methods and dependencies from secure value service (#114467) 2025-11-26 12:58:00 +01:00
Michael Mandrus cf242def3a Secrets: Refactor data_key_id out of the encoded secure value payload (#112077) 
* Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)

* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations

* only run the migration as an MT api server

* formatting issues

* change detection of secrets running as MT server

* add todo

* use more specific initializer flags

* make secrets playwright tests work

* set new properties to true by default

* remove developer mode flag

* fix unit tests
 2025-10-30 23:04:32 -04:00
Stephanie Hingtgen ce50f2cf61 Revert "Secrets: Refactor data_key_id out of the encoded secure value payload" (#112034) 
Revert "Secrets: Refactor data_key_id out of the encoded secure value payload…"

This reverts commit acad92864e.
 2025-10-05 09:53:43 +03:00
Michael Mandrus acad92864e Secrets: Refactor data_key_id out of the encoded secure value payload (#111852) 
* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations
 2025-10-03 15:25:46 -04:00
Daniele Stefano FerruRyan McKinleyStephanie Hingtgen
 		e69cc03ef9 Secret: add ability to configure extra owner decrypters (#111301) 
---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
 2025-09-19 07:41:56 -05:00
BrunoMatheus MacabuMatheus Macabu
 		f8cd7049e8 Secrets: garbage collection (#110247) 
* clean up older secret versions

* start gargbage collection worker as background service

* make gen-go

* fix typo

* make update-workspace

* undo go mod changes

* undo go work sum changes

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* default gc_worker_batch_size to 1 minute

* fix typo

* fix typo

* add test to ensure cleaning up secure values is idempotent

* make gen-go

* make update-workspace

* undo go.mod and .sum changes

* undo enterprise imports

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
 2025-09-02 11:11:01 -03:00
Matheus Macabu 1e926a29c0 Secrets: Extract external facing decrypt types to apps (#110432) 2025-09-02 10:30:29 +02:00
Matheus Macabu 01c1a6ce5b SecureValues: Run mutate and validation hooks in service layer (#109379) 
* SecureValues: Run mutate and validation hooks in service layer

* add some unit tests
 2025-08-08 13:15:23 +02:00
Matheus Macabu fc117afebc Secrets: Provide grpc and local inline secure value client (#109179) 
* TestUtils: Add helper to create certs

* InlineSecureValue: Move to its own package rather than service

* Settings: Rename decrypt server configs to grpc prefixed as it is more generic

* InlineSecureValue: Add gRPC client

* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg

* Wire: Add ProvideInlineSecureValueService to basic wireset

* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface

* Settings: Unify decrypt+inline setting into generic grpc client
 2025-08-06 09:04:55 +02:00
Matheus Macabu 343fe4dadf Secrets: Introduce inline secure value service proto (#109029) 
* Secrets: Introduce inline secure value service proto

* Fix secure value description

* Add orgid to obo auth context for testing
 2025-08-04 08:26:07 +02:00
Matheus Macabu 7374df7945 Secrets: Add inline secure value create method (#108987) 2025-08-01 13:57:51 +02:00
Dana Axinte a3cdfce25a SecretsManager: Consolidation service and ability to run via cli (#108774) 
* list all encrypted values and count

* separate interfaces

* add time filter to global queries

* initial secrets consolidation

* Revert defaults

* More verbose description of the operation

* Add consolidation tests and tracing

* Fix lint

* Revert debug log
 2025-07-31 14:45:59 +01:00
lean.dev 6bf542889a SecretsManager: Refactor and clean metrics (#108908) 2025-07-30 20:00:30 +01:00
Stephanie Hingtgen ef9f9c2d8e Secrets service: Allow decrypt through gRPC connection (#108365) 2025-07-29 07:51:37 -05:00
Dana Axinte 2ea77a7c05 SecretsManager: Add ability to list all encrypted values (#108512) 
* list all encrypted values and count

* separate interfaces

* add time filter to global queries

* fix lint
 2025-07-28 10:50:24 +01:00
Matheus Macabu 0e7b041b27 Secrets: Move decrypt types to contracts and export public at root pkg (#108376) 
* Secrets: Move decrypt types to contracts and export public at root pkg

* Provisioning: Replace decrypt pkg imports

* Merge wire changes
 2025-07-23 12:14:28 +02:00
Matheus Macabu f7e55f2c5d Secrets: Add authz checks for the single-tenant SecureValue client (#108216) 2025-07-21 11:09:07 +02:00
Roberto Jiménez Sánchez 810868c156 Provisioning: use new secure value client (#108227) 
* Use provider in Webhooks registration

* First stab at using the new client

* Simplify mock

* Able to generate graph in OSS

* Remove line already ensured by provider

* Handle the K8s not found error as well

* Commit regenerated wire file

* Add the hack also for deletion

* Fix secrets test util

* Format file
 2025-07-17 15:17:14 +02:00
Matheus Macabu 2c4bbf8b1d Secrets: Reduce amount of feature toggle checks to only app entrypoint (#108110) 
* Secrets: Reduce amount of feature toggle checks to only app entrypoint

* Wire: Fix merge conflict

* Wire: Fix merge conflict
 2025-07-16 10:56:59 +02:00
Matheus Macabu 3cda233468 Secrets: Remove temporary allowlist (#108118) 2025-07-16 09:39:33 +02:00
Michael MandrusandMatheus Macabu ab51794bdb SecretsManager: Unify KMS across OSS and Enterprise (#108085) 
* everything is compiling

* tests passing

* remove used object

* write a test for secret key upgrades

* misc cleanup

* clean up some wording

* lint issues

* fix a typo

* import hashicorp dependency explicitly

* simplify oss kmsprovider package structure

* consolidate current provider and available providers

* add a new manager configuration test

* fix hashivault import

* fix import issue

* fix unit tests

* Update go.mod

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
 2025-07-15 14:39:20 -04:00
Matheus Macabu 403d6380fa Secrets: Remove gating with experimental APIs feature toggle (#108058) 2025-07-14 17:46:17 +02:00
Bruno baa89f3eac Secrets: encryption encryption storage uses versioning (#108036) 
* Secrets: delete unused FakeKeeper

* Secrets: encrypted value storage stores versions

* add version to span

* trigger build

* remove ineffectual assignment

* lint

* drop secret_encrypted_value.uid / add name and version columns
 2025-07-14 09:28:07 -03:00
Matheus Macabu 9c1b2fb792 Secrets: Bump API version to v1beta1 (#108026) 2025-07-11 19:14:05 +02:00
BrunoandMatheus Macabu 9d0a23e1f5 Secrets: add crudl+decrypt state machine test (#107971) 
* Secrets: add state machine test for CRUDL+decrpt operations

* make update-workspace

* make update-workspace

* make enterprise-dev

* make update-workspace

* fix go.mod

* make update-workspace

* fix gomod

* make update-workspace

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
 2025-07-11 09:40:50 -03:00
BrunoMatheus MacabuMatheus Macabu
 		8283d35e56 Secrets: make operations sync (#107732) 
* Secrets: make operations sync

* k8s gen / update query to list secure values to include the version

* always store new version of a secret

* make update-workspace

* go mod tidy

* update queries

* update queries

* improve and use testutils in decrypt_store_test

* fix broken test

* make update-workspace

* ./hack/update-codegen.sh secret

* update Test_SecureValueMetadataStorage_CreateAndRead

* undo dependency changes

* linter: fix remaining errors

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
 2025-07-09 10:43:34 -03:00
Dana AxintePoorlyDefinedBehaviourMatheus MacabuMichael Mandrus
 		46c38fdbb7 SecretsManager: Introduce worker and secret async service (#107614) 
SecretsManager: Introduce worker and secret aysnc service

Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Co-authored-by: Michael Mandrus <michael.mandrus@grafana.com>
 2025-07-04 13:13:48 +01:00