Adding design doc for to extend the capabilities of secretStores to a global scope #38

vishwahiremat · 2024-01-23T18:29:56Z

Doc: https://github.com/radius-project/design-notes/blob/70894efa5cfc2ba22d445da23e0d7325bc4c1883/recipe/2024-01-global-scope-secret-store.md

Signed-off-by: Vishwanath Hiremath <[email protected]>

rynowak · 2024-01-23T19:17:38Z

recipe/2024-01-global-scope-secret-store.md

+
+## Overview
+
+Today we have Application.Core/secretStores resource to securely manage secrets for the Application. However a gap exists if user wants to create a secret before application or environment is created. To address this limitation, we need to enhance the capabilities of the existing secretStores resource. The objective is to extend its support to a global scope, enabling users to store secrets prior to the creation of the application or environment.


How does the secretstore decide what Kubernetes namespace to use?

By asking the users to provide resource property in the format of / if secret stores is a global scoped.

https://github.com/radius-project/design-notes/pull/38/files#diff-89d84238f05b572cd71ded0059391247faab67f69d3d9232b31350325b946cfaR125:~:text=%2B%20%20%20resource%3A%20%3Cnamespace%3E/%3C-,secretName,-%3E

I'm not sure if we're talking about the same thing. Let me try being more specific.

If I create an Applications.Core/secretStores resource today and I don't specify the kubernetes secret name + namespace, then it will use the namespace of the application (or environment).

For the global secret case, there's no application or environment, so there's no way to look up the namespace we're going to use.

From reading more of the doc, it looks like you did try to address this feedback as part of the proposal. Let's talk about it 👍

Signed-off-by: Vishwanath Hiremath <[email protected]>

recipe/2024-01-global-scope-secret-store.md

youngbupark · 2024-01-25T21:10:13Z

recipe/2024-01-global-scope-secret-store.md

+  name: 'github'
+  properties:{
+-  	app: app.id
+   resource: <namespace>/<secretName>


Alternatively, we might be able to use UCP style resource id instead of using <namespace>/<secretName>

e.g.

/planes/kubernetes/local/namespaces/<namespace>/providers/cores/Secrets/<secretName>"

In the initial proposal of secretstore, we proposed using full resource id for Azure KeyVault in resource field when it refers to KeyVault Resource.

rynowak · 2024-01-25T21:10:40Z

recipe/2024-01-global-scope-secret-store.md

+### Goals
+
+- Enable support to extend the capabilities of secretStores to a global scope.
+


Something I am curious about is whether this type should move to UCP. Applications.Core defines it as a part of the Radius RP rather than part of UCP.

If we have usecases for this type in other parts of UCP then it would be better to rename/move than it would be to have two different secret types.

rynowak · 2024-01-25T21:12:04Z

recipe/2024-01-global-scope-secret-store.md

+## Alternatives considered
+
+#### Adding default a namespace for global scoped secretstore resource.
+Add a default namespace `global-secretStores` to store the global scoped secretStores.


Or we could use radius-system.

rynowak · 2024-01-25T21:13:21Z

recipe/2024-01-global-scope-secret-store.md

+  name: 'github'
+  properties:{
+-  	app: app.id
+   resource: <namespace>/<secretName>


Let's talk about the semantics of this field.

lakshmimsft · 2024-01-25T21:23:33Z

recipe/2024-01-global-scope-secret-store.md

+@doc("The properties of SecretStore")
+model SecretStoreProperties {
+-  ...ApplicationScopedResource;
+  ...GlobalScopedResource;


since this is new type, pls describe it in detail

Signed-off-by: Vishwanath Hiremath <[email protected]>

recipe/2024-01-global-scope-secret-store.md

Signed-off-by: Vishwanath Hiremath <[email protected]>

kachawla · 2024-02-16T22:13:53Z

recipe/2024-01-global-scope-secret-store.md

+- Enable support to extend the capabilities of secretStores to a global scope.
+
+### Non goals
+- To move secret store resource as part of UCP.


@vishwahiremat Please log an issue to revisit this when you get a chance

# Description - Adding changes to support global scope - Remove appliction as a requred property - Create namespace provided by user if not exists - Adding unit tests Design doc: radius-project/design-notes#38 ## Type of change  - This pull request adds or changes features of Radius and has an approved issue (issue link required). - This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Radius (issue link optional).  Fixes: #7030 --------- Signed-off-by: Vishwanath Hiremath <[email protected]> Signed-off-by: Karishma Chawla <[email protected]> Co-authored-by: Karishma Chawla <[email protected]>

…t#7155) # Description - Adding changes to support global scope - Remove appliction as a requred property - Create namespace provided by user if not exists - Adding unit tests Design doc: radius-project/design-notes#38 ## Type of change  - This pull request adds or changes features of Radius and has an approved issue (issue link required). - This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Radius (issue link optional).  Fixes: radius-project#7030 --------- Signed-off-by: Vishwanath Hiremath <[email protected]> Signed-off-by: Karishma Chawla <[email protected]> Co-authored-by: Karishma Chawla <[email protected]> Signed-off-by: willdavsmith <[email protected]>

…t#7155) # Description - Adding changes to support global scope - Remove appliction as a requred property - Create namespace provided by user if not exists - Adding unit tests Design doc: radius-project/design-notes#38 ## Type of change  - This pull request adds or changes features of Radius and has an approved issue (issue link required). - This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Radius (issue link optional).  Fixes: radius-project#7030 --------- Signed-off-by: Vishwanath Hiremath <[email protected]> Signed-off-by: Karishma Chawla <[email protected]> Co-authored-by: Karishma Chawla <[email protected]>

…t#7155) # Description - Adding changes to support global scope - Remove appliction as a requred property - Create namespace provided by user if not exists - Adding unit tests Design doc: radius-project/design-notes#38 ## Type of change  - This pull request adds or changes features of Radius and has an approved issue (issue link required). - This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Radius (issue link optional).  Fixes: radius-project#7030 --------- Signed-off-by: Vishwanath Hiremath <[email protected]> Signed-off-by: Karishma Chawla <[email protected]> Co-authored-by: Karishma Chawla <[email protected]> Signed-off-by: willdavsmith <[email protected]>

… global scope (radius-project#38) Doc: https://github.com/radius-project/design-notes/blob/70894efa5cfc2ba22d445da23e0d7325bc4c1883/recipe/2024-01-global-scope-secret-store.md --------- Signed-off-by: Vishwanath Hiremath <[email protected]> Signed-off-by: Reshma Abdul Rahim <[email protected]>

adding design for secret store with global scope

76c3087

Signed-off-by: Vishwanath Hiremath <[email protected]>

vishwahiremat requested review from a team as code owners January 23, 2024 18:29

rynowak reviewed Jan 23, 2024

View reviewed changes

vishwahiremat marked this pull request as draft January 24, 2024 08:51

vishwahiremat marked this pull request as ready for review January 25, 2024 02:57

update the doc

70894ef

Signed-off-by: Vishwanath Hiremath <[email protected]>

kachawla reviewed Jan 25, 2024

View reviewed changes

recipe/2024-01-global-scope-secret-store.md Show resolved Hide resolved

youngbupark reviewed Jan 25, 2024

View reviewed changes

rynowak reviewed Jan 25, 2024

View reviewed changes

lakshmimsft reviewed Jan 25, 2024

View reviewed changes

fix recipeConfig example

e47f101

Signed-off-by: Vishwanath Hiremath <[email protected]>

kachawla mentioned this pull request Feb 14, 2024

Adding changes to extend secret stores scope to global radius-project/radius#7155

Merged

kachawla reviewed Feb 15, 2024

View reviewed changes

recipe/2024-01-global-scope-secret-store.md Show resolved Hide resolved

recipe/2024-01-global-scope-secret-store.md Show resolved Hide resolved

recipe/2024-01-global-scope-secret-store.md Outdated Show resolved Hide resolved

adding non goal

dad2a57

Signed-off-by: Vishwanath Hiremath <[email protected]>

kachawla approved these changes Feb 16, 2024

View reviewed changes

kachawla reviewed Feb 16, 2024

View reviewed changes

kachawla merged commit d5f093f into radius-project:main Feb 16, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding design doc for to extend the capabilities of secretStores to a global scope #38

Adding design doc for to extend the capabilities of secretStores to a global scope #38

vishwahiremat commented Jan 23, 2024 •

edited

Loading

rynowak Jan 23, 2024

vishwahiremat Jan 23, 2024

rynowak Jan 25, 2024

rynowak Jan 25, 2024

youngbupark Jan 25, 2024

youngbupark Jan 25, 2024

rynowak Jan 25, 2024

rynowak Jan 25, 2024

rynowak Jan 25, 2024

rynowak Jan 25, 2024

lakshmimsft Jan 25, 2024

kachawla Feb 16, 2024


		## Overview

		Today we have Application.Core/secretStores resource to securely manage secrets for the Application. However a gap exists if user wants to create a secret before application or environment is created. To address this limitation, we need to enhance the capabilities of the existing secretStores resource. The objective is to extend its support to a global scope, enabling users to store secrets prior to the creation of the application or environment.

		### Goals

		- Enable support to extend the capabilities of secretStores to a global scope.

Adding design doc for to extend the capabilities of secretStores to a global scope #38

Adding design doc for to extend the capabilities of secretStores to a global scope #38

Conversation

vishwahiremat commented Jan 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vishwahiremat commented Jan 23, 2024 •

edited

Loading