Skip to content

Commit 0e7b041

Browse files
macabumacabu
authored
Secrets: Move decrypt types to contracts and export public at root pkg (grafana#108376)
* Secrets: Move decrypt types to contracts and export public at root pkg * Provisioning: Replace decrypt pkg imports * Merge wire changes
1 parent f657044 commit 0e7b041

File tree

14 files changed

+115
-107
lines changed

14 files changed

+115
-107
lines changed

‎pkg/registry/apis/provisioning/secrets/mocks/decrypt_service_mock.go‎

Lines changed: 8 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/registry/apis/provisioning/secrets/repository.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@ import (
77

88
"github.com/grafana/grafana-app-sdk/logging"
99
provisioning "github.com/grafana/grafana/pkg/apis/provisioning/v0alpha1"
10+
"github.com/grafana/grafana/pkg/registry/apis/secret"
1011
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
11-
"github.com/grafana/grafana/pkg/registry/apis/secret/service"
1212
"github.com/grafana/grafana/pkg/services/featuremgmt"
13-
grafanasecrets "github.com/grafana/grafana/pkg/services/secrets"
13+
legacysecrets "github.com/grafana/grafana/pkg/services/secrets"
1414
)
1515

1616
func ProvideRepositorySecrets(
1717
features featuremgmt.FeatureToggles,
18-
legacySecretsSvc grafanasecrets.Service,
18+
legacySecretsSvc legacysecrets.Service,
1919
secretsSvc contracts.SecureValueClient,
20-
decryptSvc service.DecryptService,
20+
decryptSvc secret.DecryptService,
2121
) RepositorySecrets {
2222
return NewRepositorySecrets(features, NewSecretsService(secretsSvc, decryptSvc), NewSingleTenant(legacySecretsSvc))
2323
}

‎pkg/registry/apis/provisioning/secrets/secret.go‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,17 @@ import (
66

77
"github.com/grafana/authlib/types"
88
"github.com/grafana/grafana/pkg/apimachinery/identity"
9+
"github.com/grafana/grafana/pkg/registry/apis/secret"
910
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
10-
grafanasecrets "github.com/grafana/grafana/pkg/registry/apis/secret/service"
1111
apierrors "k8s.io/apimachinery/pkg/api/errors"
1212
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1313
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
14-
"k8s.io/client-go/dynamic"
1514
)
1615

1716
const svcName = "provisioning"
1817

1918
//go:generate mockery --name SecureValueClient --structname MockSecureValueClient --inpackage --filename secure_value_client_mock.go --with-expecter
20-
type SecureValueClient interface {
21-
Client(ctx context.Context, namespace string) (dynamic.ResourceInterface, error)
22-
}
19+
type SecureValueClient = secret.SecureValueClient
2320

2421
//go:generate mockery --name Service --structname MockService --inpackage --filename secret_mock.go --with-expecter
2522
type Service interface {
@@ -30,13 +27,13 @@ type Service interface {
3027

3128
var _ Service = (*secretsService)(nil)
3229

33-
//go:generate mockery --name DecryptService --structname MockDecryptService --srcpkg=github.com/grafana/grafana/pkg/registry/apis/secret/service --filename decrypt_service_mock.go --with-expecter
30+
//go:generate mockery --name DecryptService --structname MockDecryptService --srcpkg=github.com/grafana/grafana/pkg/registry/apis/secret --filename decrypt_service_mock.go --with-expecter
3431
type secretsService struct {
3532
secureValues SecureValueClient
36-
decryptSvc grafanasecrets.DecryptService
33+
decryptSvc secret.DecryptService
3734
}
3835

39-
func NewSecretsService(secretsSvc SecureValueClient, decryptSvc grafanasecrets.DecryptService) Service {
36+
func NewSecretsService(secretsSvc SecureValueClient, decryptSvc secret.DecryptService) Service {
4037
return &secretsService{
4138
secureValues: secretsSvc,
4239
decryptSvc: decryptSvc,

‎pkg/registry/apis/provisioning/secrets/secret_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ import (
77

88
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
99
"github.com/grafana/grafana/pkg/registry/apis/provisioning/secrets/mocks"
10+
"github.com/grafana/grafana/pkg/registry/apis/secret"
1011
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
11-
"github.com/grafana/grafana/pkg/registry/apis/secret/service"
1212
"github.com/stretchr/testify/assert"
1313
"github.com/stretchr/testify/mock"
1414
apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -258,7 +258,7 @@ func TestSecretsService_Decrypt(t *testing.T) {
258258
secretName: "test-secret",
259259
setupMocks: func(mockSecretsSvc *MockSecureValueClient, mockDecryptSvc *mocks.MockDecryptService) {
260260
exposedValue := secretv1beta1.NewExposedSecureValue("decrypted-data")
261-
mockResult := service.NewDecryptResultValue(&exposedValue)
261+
mockResult := secret.NewDecryptResultValue(&exposedValue)
262262

263263
mockDecryptSvc.EXPECT().Decrypt(
264264
mock.MatchedBy(func(ctx context.Context) bool {
@@ -267,7 +267,7 @@ func TestSecretsService_Decrypt(t *testing.T) {
267267
}),
268268
"test-namespace",
269269
"test-secret",
270-
).Return(map[string]service.DecryptResult{
270+
).Return(map[string]secret.DecryptResult{
271271
"test-secret": mockResult,
272272
}, nil)
273273
},
@@ -299,24 +299,24 @@ func TestSecretsService_Decrypt(t *testing.T) {
299299
}),
300300
"test-namespace",
301301
"test-secret",
302-
).Return(map[string]service.DecryptResult{}, nil)
302+
).Return(map[string]secret.DecryptResult{}, nil)
303303
},
304-
expectedError: contracts.ErrDecryptNotFound.Error(),
304+
expectedError: secret.ErrDecryptNotFound.Error(),
305305
},
306306
{
307307
name: "decrypt result has error",
308308
namespace: "test-namespace",
309309
secretName: "test-secret",
310310
setupMocks: func(mockSecretsSvc *MockSecureValueClient, mockDecryptSvc *mocks.MockDecryptService) {
311-
mockResult := service.NewDecryptResultErr(errors.New("decryption failed"))
311+
mockResult := secret.NewDecryptResultErr(errors.New("decryption failed"))
312312

313313
mockDecryptSvc.EXPECT().Decrypt(
314314
mock.MatchedBy(func(ctx context.Context) bool {
315315
return ctx != nil
316316
}),
317317
"test-namespace",
318318
"test-secret",
319-
).Return(map[string]service.DecryptResult{
319+
).Return(map[string]secret.DecryptResult{
320320
"test-secret": mockResult,
321321
}, nil)
322322
},
@@ -354,7 +354,7 @@ func TestSecretsService_Decrypt_ServiceIdentityContext(t *testing.T) {
354354
mockDecryptSvc := &mocks.MockDecryptService{}
355355

356356
exposedValue := secretv1beta1.NewExposedSecureValue("test-data")
357-
mockResult := service.NewDecryptResultValue(&exposedValue)
357+
mockResult := secret.NewDecryptResultValue(&exposedValue)
358358

359359
// Create a more detailed context matcher to verify the service identity context is created correctly
360360
mockDecryptSvc.EXPECT().Decrypt(
@@ -364,7 +364,7 @@ func TestSecretsService_Decrypt_ServiceIdentityContext(t *testing.T) {
364364
}),
365365
"test-namespace",
366366
"test-secret",
367-
).Return(map[string]service.DecryptResult{
367+
).Return(map[string]secret.DecryptResult{
368368
"test-secret": mockResult,
369369
}, nil)
370370

‎pkg/registry/apis/secret/contracts/decrypt.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,32 @@ type DecryptStorage interface {
2323
type DecryptAuthorizer interface {
2424
Authorize(ctx context.Context, secureValueName string, secureValueDecrypters []string) (identity string, allowed bool)
2525
}
26+
27+
// DecryptService is the inferface for the decrypt service.
28+
type DecryptService interface {
29+
Decrypt(ctx context.Context, namespace string, names ...string) (map[string]DecryptResult, error)
30+
}
31+
32+
// DecryptResult is the (union) result of a decryption operation.
33+
// It contains the decrypted `value` when the decryption succeeds, and the `err` when it fails.
34+
// It is not possible to construct a `DecryptResult` where both `value` and `err` are set from another package.
35+
type DecryptResult struct {
36+
value *secretv1beta1.ExposedSecureValue
37+
err error
38+
}
39+
40+
func (d DecryptResult) Error() error {
41+
return d.err
42+
}
43+
44+
func (d DecryptResult) Value() *secretv1beta1.ExposedSecureValue {
45+
return d.value
46+
}
47+
48+
func NewDecryptResultErr(err error) DecryptResult {
49+
return DecryptResult{err: err}
50+
}
51+
52+
func NewDecryptResultValue(value *secretv1beta1.ExposedSecureValue) DecryptResult {
53+
return DecryptResult{value: value}
54+
}

‎pkg/registry/apis/secret/decrypt/service.go‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,28 @@ import (
44
"context"
55

66
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
7-
"github.com/grafana/grafana/pkg/registry/apis/secret/service"
87
"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
98
)
109

1110
type OSSDecryptService struct {
1211
decryptStore contracts.DecryptStorage
1312
}
1413

15-
var _ service.DecryptService = &OSSDecryptService{}
16-
17-
func ProvideDecryptService(decryptStore contracts.DecryptStorage) service.DecryptService {
14+
func ProvideDecryptService(decryptStore contracts.DecryptStorage) contracts.DecryptService {
1815
return &OSSDecryptService{
1916
decryptStore: decryptStore,
2017
}
2118
}
2219

23-
func (d *OSSDecryptService) Decrypt(ctx context.Context, namespace string, names ...string) (map[string]service.DecryptResult, error) {
24-
results := make(map[string]service.DecryptResult, len(names))
20+
func (d *OSSDecryptService) Decrypt(ctx context.Context, namespace string, names ...string) (map[string]contracts.DecryptResult, error) {
21+
results := make(map[string]contracts.DecryptResult, len(names))
2522

2623
for _, name := range names {
2724
exposedSecureValue, err := d.decryptStore.Decrypt(ctx, xkube.Namespace(namespace), name)
2825
if err != nil {
29-
results[name] = service.NewDecryptResultErr(err)
26+
results[name] = contracts.NewDecryptResultErr(err)
3027
} else {
31-
results[name] = service.NewDecryptResultValue(&exposedSecureValue)
28+
results[name] = contracts.NewDecryptResultValue(&exposedSecureValue)
3229
}
3330
}
3431

‎pkg/registry/apis/secret/decrypt/service_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"testing"
77

88
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
9-
"github.com/grafana/grafana/pkg/registry/apis/secret/service"
9+
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
1010
"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
1111
"github.com/stretchr/testify/mock"
1212
"github.com/stretchr/testify/require"
@@ -23,8 +23,8 @@ func TestDecryptService(t *testing.T) {
2323
mockErr := errors.New("mock error")
2424
mockStorage := &MockDecryptStorage{}
2525
mockStorage.On("Decrypt", mock.Anything, mock.Anything, mock.Anything).Return(secretv1beta1.ExposedSecureValue(""), mockErr)
26-
decryptedValuesResp := map[string]service.DecryptResult{
27-
"secure-value-1": service.NewDecryptResultErr(mockErr),
26+
decryptedValuesResp := map[string]contracts.DecryptResult{
27+
"secure-value-1": contracts.NewDecryptResultErr(mockErr),
2828
}
2929

3030
decryptService := &OSSDecryptService{
@@ -49,9 +49,9 @@ func TestDecryptService(t *testing.T) {
4949
mockStorage.On("Decrypt", mock.Anything, xkube.Namespace("default"), "secure-value-2").
5050
Return(exposedSecureValue2, nil)
5151

52-
decryptedValuesResp := map[string]service.DecryptResult{
53-
"secure-value-1": service.NewDecryptResultValue(&exposedSecureValue1),
54-
"secure-value-2": service.NewDecryptResultValue(&exposedSecureValue2),
52+
decryptedValuesResp := map[string]contracts.DecryptResult{
53+
"secure-value-1": contracts.NewDecryptResultValue(&exposedSecureValue1),
54+
"secure-value-2": contracts.NewDecryptResultValue(&exposedSecureValue2),
5555
}
5656

5757
decryptService := &OSSDecryptService{
@@ -75,9 +75,9 @@ func TestDecryptService(t *testing.T) {
7575
mockStorage.On("Decrypt", mock.Anything, xkube.Namespace("default"), "secure-value-2").
7676
Return(secretv1beta1.ExposedSecureValue(""), mockErr)
7777

78-
decryptedValuesResp := map[string]service.DecryptResult{
79-
"secure-value-1": service.NewDecryptResultValue(&exposedSecureValue),
80-
"secure-value-2": service.NewDecryptResultErr(mockErr),
78+
decryptedValuesResp := map[string]contracts.DecryptResult{
79+
"secure-value-1": contracts.NewDecryptResultValue(&exposedSecureValue),
80+
"secure-value-2": contracts.NewDecryptResultErr(mockErr),
8181
}
8282

8383
decryptService := &OSSDecryptService{

‎pkg/registry/apis/secret/decrypt_client.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package secret
2+
3+
import (
4+
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
5+
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
6+
)
7+
8+
// DecryptService is a decrypt client for secure value secrets.
9+
type DecryptService = contracts.DecryptService
10+
11+
var (
12+
ErrDecryptNotFound = contracts.ErrDecryptNotFound
13+
ErrDecryptNotAuthorized = contracts.ErrDecryptNotAuthorized
14+
ErrDecryptFailed = contracts.ErrDecryptFailed
15+
)
16+
17+
type DecryptResult = contracts.DecryptResult
18+
19+
func NewDecryptResultErr(err error) DecryptResult {
20+
return contracts.NewDecryptResultErr(err)
21+
}
22+
23+
func NewDecryptResultValue(value *secretv1beta1.ExposedSecureValue) DecryptResult {
24+
return contracts.NewDecryptResultValue(value)
25+
}

‎pkg/registry/apis/secret/errors.go‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎pkg/registry/apis/secret/secure_value_client.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ import (
2323
authsvc "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
2424
)
2525

26+
var (
27+
ErrSecureValueNotFound = contracts.ErrSecureValueNotFound
28+
ErrSecureValueAlreadyExists = contracts.ErrSecureValueAlreadyExists
29+
)
30+
2631
// SecureValueClient is a CRUD client for the secure value API.
2732
type SecureValueClient = contracts.SecureValueClient
2833

0 commit comments

Comments
 (0)