Commit Graph

18 Commits

Author SHA1 Message Date
Matheus Macabu 1e926a29c0 Secrets: Extract external facing decrypt types to apps (#110432) 2025-09-02 10:30:29 +02:00
Matheus Macabu 60f31342c0 Secrets: Remove proxy certs (#110140) 2025-08-26 16:24:26 +02:00
Matheus Macabu dfae5e5b4d Secrets: Add namespace matches checks to authorizer and secure value client (#109651)
* Decrypt: Add namespace matches to authorizer

* SecureValueClient: Add namespace matches when auth checking
2025-08-14 11:50:56 +02:00
Ryan McKinley ace670c6d0 Secrets: Support variadic args in decrypt service (#109280) 2025-08-07 09:54:24 +00:00
Matheus Macabu b0b1340c19 Secrets: Remove Close from decrypt client interface (#109250) 2025-08-06 14:02:13 +02:00
Matheus Macabu fc117afebc Secrets: Provide grpc and local inline secure value client (#109179)
* TestUtils: Add helper to create certs

* InlineSecureValue: Move to its own package rather than service

* Settings: Rename decrypt server configs to grpc prefixed as it is more generic

* InlineSecureValue: Add gRPC client

* InlineSecureValue: Add service provider grpc/local depending on setting.Cfg

* Wire: Add ProvideInlineSecureValueService to basic wireset

* InlineSecureValue: Re-export in root secret pkg and generate mocks for interface

* Settings: Unify decrypt+inline setting into generic grpc client
2025-08-06 09:04:55 +02:00
Matheus Macabu 94295bda23 Secrets: Move token exchange interceptor into Decrypt method (#109117) 2025-08-05 08:50:53 +02:00
Matheus Macabu 81f544e186 Secrets: Add service name as explicit parameter for Decrypt (#109054)
* Secrets: Add service name as explicit parameter for Decrypt

* Apply suggestions from code review

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>

---------

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-08-04 08:51:15 +02:00
Stephanie Hingtgen ef9f9c2d8e Secrets service: Allow decrypt through gRPC connection (#108365) 2025-07-29 07:51:37 -05:00
Matheus Macabu 0e7b041b27 Secrets: Move decrypt types to contracts and export public at root pkg (#108376)
* Secrets: Move decrypt types to contracts and export public at root pkg

* Provisioning: Replace decrypt pkg imports

* Merge wire changes
2025-07-23 12:14:28 +02:00
Matheus Macabu 3cda233468 Secrets: Remove temporary allowlist (#108118) 2025-07-16 09:39:33 +02:00
Stephanie Hingtgen d39a47a89b Provisioning: Begin using secrets store (#108044)
- Provisioning: Begin using secrets store
- Refactor integration with secrets store
- Add back the legacy service
- Separate concerns for encrypt and decrypt
- Handle update within Encrypt function
- Add interface for secure value service
- Add feature flag for using secrets service
- Add the dual service for temporary solution.

* Add first integration tests for encrypted tokens
* Add integration test for app platform secrets
* Validate it has the name or not
* Create wire provider
* Always save to the secret if provided secret

---------

Co-authored-by: Roberto Jimenez Sanchez <roberto.jimenez@grafana.com>
Co-authored-by: Roberto Jiménez Sánchez <jszroberto@gmail.com>
2025-07-15 15:43:17 +02:00
Matheus Macabu 9c1b2fb792 Secrets: Bump API version to v1beta1 (#108026) 2025-07-11 19:14:05 +02:00
Matheus Macabu cc069d301e Secrets: Skip allowlist check when decrypting if the list is empty (#107693) 2025-07-07 15:32:39 +02:00
Dana Axinte f51db112d4 SecretsManager: Add decrypt service (#107473)
* SecretsManager: Add decrypt service

Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com>

* Missed space to sync files
2025-07-03 10:41:38 +01:00
Matheus Macabu f32d944b23 Secrets: Add initial tracing instrumentation (#107513) 2025-07-02 14:43:36 +02:00
Matheus Macabu a1e71fc85f SecretsManager: Update decrypt authorization with service identity (#105668)
(cherry picked from commit 9aea342be1)
2025-05-20 16:24:51 +02:00
Dana Axinte 581d153604 SecretsManager: Introduce DecryptAuthorizer (#105459)
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
2025-05-15 17:52:14 +01:00