feat: Using global private environment to save secrets[INS-4715]#8233
Merged
Conversation
cwangsmv
marked this pull request as draft
December 5, 2024 07:08
cwangsmv
force-pushed
the
feat/vault-environment
branch
from
December 9, 2024 08:45
a546711 to
f8cb14d
Compare
cwangsmv
force-pushed
the
feat/vault-environment
branch
2 times, most recently
from
January 6, 2025 09:10
b453cd8 to
bfb3d55
Compare
cwangsmv
marked this pull request as ready for review
January 8, 2025 07:22
cwangsmv
force-pushed
the
feat/vault-environment
branch
from
January 8, 2025 07:28
9b384d8 to
3f66590
Compare
jackkav
reviewed
Jan 8, 2025
ihexxa
reviewed
Jan 9, 2025
ihexxa
reviewed
Jan 10, 2025
ihexxa
reviewed
Jan 14, 2025
cwangsmv
force-pushed
the
feat/vault-environment
branch
from
February 13, 2025 07:26
35c9a6b to
8367496
Compare
| name: vault env | ||
| data: | ||
| __insomnia_vault: | ||
| secret: eyJpdiI6ImY2NTAzYmVjMDIyYTE2YzNlNTNkMWY5MiIsInQiOiI3YzgwMGVkZGVhZGZmN2MxMjVmNmVmNzlkODY2NGM0YyIsImFkIjoiIiwiZCI6IjU2YzdlODU0NDA3MjdmOTQifQ== |
Check failure
Code scanning / Semgrep OSS
Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret
cwangsmv
force-pushed
the
feat/vault-environment
branch
3 times, most recently
from
February 17, 2025 08:46
5ed3dbd to
241dbc4
Compare
ihexxa
previously approved these changes
Feb 17, 2025
ihexxa
left a comment
Contributor
There was a problem hiding this comment.
Added some minor comments and tend to move forward as there're several rounds review before, but ideally we might still have more tests in the next as it is a relatively huge change.
| return false; | ||
| }, [selectedEnvironment]); | ||
| // Do not allowed to switch to json environment if contains secret item | ||
| const allowSwitchEnvironment = !selectedEnvironment?.kvPairData?.some(d => d.type === EnvironmentKvPairDataType.SECRET); |
Contributor
There was a problem hiding this comment.
nit: Probably need to to auto switch to kv mode for one user has been in the json mode?
Contributor
Author
There was a problem hiding this comment.
Good catch, I will add in a separate PR and add a test to cover this
ihexxa
approved these changes
Feb 17, 2025
cwangsmv
enabled auto-merge (squash)
February 17, 2025 10:00
cwangsmv
force-pushed
the
feat/vault-environment
branch
from
February 17, 2025 10:00
b4430ab to
c240e19
Compare
cwangsmv
disabled auto-merge
February 17, 2025 10:13
2.secret key-value pair ui
2.Add basic integration with AWS 3.Add vault secret cache and config UI
2.add a hook to get user plan
2.AWS secret nunjuckt tag config UI
…lobal environment 2.mask all secret items value when export
2.Modify rendering logic to expose decrypted secrets to script
cwangsmv
force-pushed
the
feat/vault-environment
branch
from
February 17, 2025 10:14
c240e19 to
c05a95d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Leverage global private environment to add built-in support secret management capabilities.
Add a new secret type environment key-value pair to store secret variables with the following features:
We also introduce a new term Vault Key.

Vault key is used to encrypt/decrypt secret environment variables, it is not synced to the cloud, so users need to save the key themselves.
User could reset the vault key, but this will remove local secret environments in all devices.
Add a new UI in Preferences page for management:
Vault secrets can be used in scripts if user set Enable vault in scripts in settings. (Only allow to get vault secret value, set/unset/clear methods are not allowd)
The pattern is
Tasks