public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
64,295 Commits 655 Branches 650 Tags
selectable-fields
Commit Graph
92 Commits
Author SHA1 Message Date
Matheus Macabu 21c1d9aedd Secrets: Remove unused methods and dependencies from secure value service (#114467) 2025-11-26 12:58:00 +01:00
Matheus Macabu 5e949fc955 Secrets: Fix secure value creation timestamp changing when updating it (#114290) 2025-11-21 16:31:17 +01:00
BrunoandMatheus Macabu 0d67442f1a Secrets manager: create secure value using the active keeper (#114039) 
* Secrets manager: create secure value using the active keeper

* SecureValueService.Update: fetch secure value from db to get the keeper

* fix keeper_store_test.go

* SecureValueService: fix bug in update where the current version keeper wasn't being passed to the createNewVersion method

* make gofmt

* remove outdated test

* update TestModel

* undo enterprise_imports changes

* use xkube.Namespace

* migrator: set secret_secure_value.keeper to 'system' when the column is null

* indent cue

* fix tests

* fix enterprise imports

* properly fix enterprise imports

* make update-workspace

* go mod tidy

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
 2025-11-21 11:20:16 -03:00
Michael Mandrus cf242def3a Secrets: Refactor data_key_id out of the encoded secure value payload (#112077) 
* Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)

* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations

* only run the migration as an MT api server

* formatting issues

* change detection of secrets running as MT server

* add todo

* use more specific initializer flags

* make secrets playwright tests work

* set new properties to true by default

* remove developer mode flag

* fix unit tests
 2025-10-30 23:04:32 -04:00
Matheus Macabu 93af167f9c Secrets: Add config for enabling gRPC client-side load balancing (#111989) 2025-10-20 14:04:59 +02:00
Stephanie Hingtgen ce50f2cf61 Revert "Secrets: Refactor data_key_id out of the encoded secure value payload" (#112034) 
Revert "Secrets: Refactor data_key_id out of the encoded secure value payload…"

This reverts commit acad92864e.
 2025-10-05 09:53:43 +03:00
Michael Mandrus acad92864e Secrets: Refactor data_key_id out of the encoded secure value payload (#111852) 
* everything compiles

* tests pass

* remove file included by accident

* add entry to gitignore

* some scaffolding for the migration executor

* remove file

* implement and test the migration

* use xkube.Namespace in our interfaces

* add todo

* update wire deps

* add some logs

* fix wire dependency ordering

* create tests to validate error conditions during migrations
 2025-10-03 15:25:46 -04:00
Ryan McKinley 2f2289f226 Chore: Update authlib (foder as top level argument) (#111800) 2025-10-01 14:40:28 +00:00
Matheus Macabu ffa9444256 Secrets: Add more details about decryption when there is an error (#111741) 2025-09-29 18:29:52 +02:00
Daniele Stefano FerruRyan McKinleyStephanie Hingtgen
 		e69cc03ef9 Secret: add ability to configure extra owner decrypters (#111301) 
---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
 2025-09-19 07:41:56 -05:00
Alexander Zobnin 72d212c5f9 Authlib: Update authz client to use zookies (#111291) 
* Authlib: Update authz client to use zookies

* fix zookie return

* fix linter
 2025-09-18 16:24:22 +02:00
Dana Axinte 1f071f5bd7 Secrets: Adding developer mode config (#111008) 
adding developer mode and feature flags for e2e tests
 2025-09-18 10:10:24 +01:00
Peter Štibraný 7fd9ab9481 Replace check for integration tests. (#110707) 
* Replace check for integration tests.
* Revert changes in pkg/tsdb/mysql packages.
* Fix formatting of few tests.
 2025-09-08 15:49:49 +02:00
BrunoMatheus MacabuMatheus Macabu
 		f8cd7049e8 Secrets: garbage collection (#110247) 
* clean up older secret versions

* start gargbage collection worker as background service

* make gen-go

* fix typo

* make update-workspace

* undo go mod changes

* undo go work sum changes

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/registry/apis/secret/garbagecollectionworker/worker.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* default gc_worker_batch_size to 1 minute

* fix typo

* fix typo

* add test to ensure cleaning up secure values is idempotent

* make gen-go

* make update-workspace

* undo go.mod and .sum changes

* undo enterprise imports

---------

Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
 2025-09-02 11:11:01 -03:00
Matheus Macabu 1e926a29c0 Secrets: Extract external facing decrypt types to apps (#110432) 2025-09-02 10:30:29 +02:00
Matheus Macabu 60f31342c0 Secrets: Remove proxy certs (#110140) 2025-08-26 16:24:26 +02:00
Stephanie Hingtgen 1091054c25 Unistore: Wire up inline secure values (#110072) 
* Unistore: Wire up inline secure values

* add validation and test

* linter
 2025-08-25 02:48:49 -06:00
Matheus Macabu 33ca5f166f Secrets: Remove feature toggle check in dependency register (#110026) 2025-08-22 13:14:18 +02:00
Matheus Macabu 537ac8ec68 Secrets: Validate name/namespace with standard K8s validator (#109868) 
* Secrets: Validate name/namespace with standard K8s validator

* Secrets: Simplify error message for mismatched owner inline secure values
 2025-08-19 16:55:52 +02:00
Matheus Macabu 10508d0614 Secret/Keepers: Return already exists error from DB when creating keeper (#109782) 2025-08-18 14:42:55 +02:00
Matheus Macabu dfae5e5b4d Secrets: Add namespace matches checks to authorizer and secure value client (#109651) 
* Decrypt: Add namespace matches to authorizer

* SecureValueClient: Add namespace matches when auth checking
 2025-08-14 11:50:56 +02:00
lean.dev 3106abf1a6 SecretsManager: clear unused metrics and standarize labels(#109515) 2025-08-13 14:01:50 +01:00
Matheus Macabu 01c1a6ce5b SecureValues: Run mutate and validation hooks in service layer (#109379) 
* SecureValues: Run mutate and validation hooks in service layer

* add some unit tests
 2025-08-08 13:15:23 +02:00
Ryan McKinley 3c00cf11cc Secrets: Allow any valid identity to manage inline secrets (#109377) 2025-08-08 08:18:43 +00:00
Ryan McKinley ace670c6d0 Secrets: Support variadic args in decrypt service (#109280) 2025-08-07 09:54:24 +00:00
Matheus Macabu 4e1333236c InlineSecureValues: Only add decrypter if owner is different than svc identity (#109251) 2025-08-06 14:02:23 +02:00
Matheus Macabu b0b1340c19 Secrets: Remove Close from decrypt client interface (#109250) 2025-08-06 14:02:13 +02:00
Matheus Macabu 7e09f75100 InlineSecureValue: Add owner API group to decrypters list (#109241) 2025-08-06 12:00:00 +02:00
Matheus Macabu c9daccfd28 Secrets: Update inline delete when owned to take multiple names (#109227) 
* Secrets: Update proto inline secure values to take variadic names on delete

* Secrets: Update inline delete when owned to take multiple names

* trigger CI
 2025-08-06 11:45:03 +02:00
Matheus Macabu fc117afebc Secrets: Provide grpc and local inline secure value client (#109179) 
* TestUtils: Add helper to create certs

* InlineSecureValue: Move to its own package rather than service

* Settings: Rename decrypt server configs to grpc prefixed as it is more generic

* InlineSecureValue: Add gRPC client

* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg

* Wire: Add ProvideInlineSecureValueService to basic wireset

* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface

* Settings: Unify decrypt+inline setting into generic grpc client
 2025-08-06 09:04:55 +02:00
Matheus Macabu 94295bda23 Secrets: Move token exchange interceptor into Decrypt method (#109117) 2025-08-05 08:50:53 +02:00
Matheus Macabu a4ed9c4bb6 Secrets: Better error message for not matching resource owner (#109113) 2025-08-04 13:01:08 +02:00
Matheus MacabuandStephanie Hingtgen 81f544e186 Secrets: Add service name as explicit parameter for Decrypt (#109054) 
* Secrets: Add service name as explicit parameter for Decrypt

* Apply suggestions from code review

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>

---------

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
 2025-08-04 08:51:15 +02:00
Matheus Macabu 343fe4dadf Secrets: Introduce inline secure value service proto (#109029) 
* Secrets: Introduce inline secure value service proto

* Fix secure value description

* Add orgid to obo auth context for testing
 2025-08-04 08:26:07 +02:00
Matheus Macabu 491c74b688 Secrets: Add inline secure value delete when owned method (#108993) 2025-08-01 14:45:44 +02:00
Matheus Macabu 988439e0b8 Secrets: Simplify CanReference interface to only pass secure value names (#109030) 2025-08-01 14:00:01 +02:00
Matheus Macabu 7374df7945 Secrets: Add inline secure value create method (#108987) 2025-08-01 13:57:51 +02:00
Matheus Macabu cfb5f5601f Secrets: Add inline secure value can reference method (#108965) 2025-07-31 16:42:40 +02:00
Dana Axinte a3cdfce25a SecretsManager: Consolidation service and ability to run via cli (#108774) 
* list all encrypted values and count

* separate interfaces

* add time filter to global queries

* initial secrets consolidation

* Revert defaults

* More verbose description of the operation

* Add consolidation tests and tracing

* Fix lint

* Revert debug log
 2025-07-31 14:45:59 +01:00
lean.dev 6bf542889a SecretsManager: Refactor and clean metrics (#108908) 2025-07-30 20:00:30 +01:00
Stephanie Hingtgen ef9f9c2d8e Secrets service: Allow decrypt through gRPC connection (#108365) 2025-07-29 07:51:37 -05:00
Matheus Macabu 724c775bab Secret: Fix create/delete basic role configuration for secure values (#108840) 
They should be for Admins not Editors
 2025-07-29 11:19:39 +02:00
Serge ZaitsevandMatheus Macabu a95fb3a37c Chore: Omit integration tests if short test flag is passed (#108777) 
* omit integration tests if short test flag is passed

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/cmd/grafana-cli/commands/datamigrations/to_unified_storage_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* fix the rest

* false positive

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
 2025-07-28 13:38:54 +02:00
Dana Axinte 2ea77a7c05 SecretsManager: Add ability to list all encrypted values (#108512) 
* list all encrypted values and count

* separate interfaces

* add time filter to global queries

* fix lint
 2025-07-28 10:50:24 +01:00
Dana Axinte b1b9cc43a8 SecretsManager: Adding ability to disable all DEKs (#108444) 
* Adding dek deactivation and rename list dek

* disable data keys from manager

* separate interface and don't use in encryption manager
 2025-07-25 17:11:17 +01:00
Matheus Macabu 0e7b041b27 Secrets: Move decrypt types to contracts and export public at root pkg (#108376) 
* Secrets: Move decrypt types to contracts and export public at root pkg

* Provisioning: Replace decrypt pkg imports

* Merge wire changes
 2025-07-23 12:14:28 +02:00
Matheus Macabu 9402071d33 Secrets: Create more granular fixed roles for SecureValues (#108382) 2025-07-22 16:20:54 +02:00
Matheus Macabu 9e4f2cad47 Secrets: Re-export and map domain errors into K8s API errors in ST client (#108226) 2025-07-21 09:32:20 +00:00
Matheus Macabu f7e55f2c5d Secrets: Add authz checks for the single-tenant SecureValue client (#108216) 2025-07-21 11:09:07 +02:00
Matheus Macabu 47abf5f811 Secrets: Clean up unused code (#108366) 
* Secrets: Remove unused tracectx pkg

* Secrets: Remove unused assert pkg

* Secrets: Remove unused encryption interface

* Secrets: Remove unused encryption file/ref
 2025-07-21 11:08:49 +02:00