feat!: add support for session secrets #545
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
leafty
force-pushed
the
build/session-secrets
branch
from
d4d85bd to
ec4cbe1
Compare
Add support for session secret slots which describe files with secret contents to be mounted in sessions. Session secret slots exist at the project level and can be managed by users with at the `WRITE` permission on the project. Session secrets can be used by all users with the `READ` permission on the project.
Add support for session secrets which connect a project's session secret slots to user secrets. Session secrets can be used by all users with the `READ` permission on the project. --------- Co-authored-by: Tasko Olevski <[email protected]>
Add support for mounting user secrets in sessions according to the project's session secret slots.
…537) Add support for multiple names in `key_mapping` when creating a kubernetes secret. This allows the same user secret to be supplied more than once in sessions. --------- Co-authored-by: Ralf Grubenmann <[email protected]>
Re-work user secrets to make them more usable in Renku 2.0. Changes: * Change the `name` field to be `default_filename`. This field is only meaningful in the context of Renku 1.0. * Add a new `name` field (which does not have constraints) to let users name their secrets, e.g. "AWS Secret Key ID for Project XYZ". * User secret objects now include back references to Session secret slots and Data connectors -> `session_secret_slot_ids` and `data_connector_ids` fields returned from the API. * The `UserSecretsRepo` class has been split into `LowLevelUserSecretsRepo` and `UserSecretsRepo`. `LowLevelUserSecretsRepo` is used internally, e.g. for key rotation and `UserSecretsRepo` is used for the `UserSecretsBP` blueprint.
leafty
force-pushed
the
build/session-secrets
branch
from
ec4cbe1 to
a566df5
Compare
Add a new field `secrets_mount_directory` to projects, which allows user to configure where secrets are mounted in sessions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Feature branch. Closes #509.
Details:
key_mappingwhen creating a kubernetes secret. This allows the same user secret to be supplied more than once in sessions.namefield to bedefault_filename. This field is only meaningful in the context of Renku 1.0.namefield (which does not have constraints) to let users name their secrets, e.g. "AWS Secret Key ID for Project XYZ".session_secret_slot_idsanddata_connector_idsfields returned from the API.UserSecretsRepoclass has been split intoLowLevelUserSecretsRepoandUserSecretsRepo.LowLevelUserSecretsRepois used internally, e.g. for key rotation andUserSecretsRepois used for theUserSecretsBPblueprintContent: