refactor(config): extract secret manager configuration

Makefile

@@ -22,10 +22,17 @@ api:
 	make -C ./app/cli api
 	make -C ./app/artifact-cas api
 
+.PHONY: config
+# generate config proto
+config:
+	cd ./internal/credentials/api && buf generate
+	make -C ./app/controlplane config
+	make -C ./app/artifact-cas config
+
 .PHONY: generate
 
 # generate
-generate:
+generate: config api
 	go generate ./...
 
 .PHONY: all

app/artifact-cas/cmd/main.go

@@ -16,16 +16,11 @@
 package main
 
 import (
-	"errors"
 	"flag"
-	"fmt"
 	"os"
 	"time"
 
-	"github.com/chainloop-dev/chainloop/internal/credentials"
-	awssecrets "github.com/chainloop-dev/chainloop/internal/credentials/aws"
-	"github.com/chainloop-dev/chainloop/internal/credentials/gcp"
-	"github.com/chainloop-dev/chainloop/internal/credentials/vault"
+	credsConfig "github.com/chainloop-dev/chainloop/internal/credentials/api/credentials/v1"
 	"github.com/getsentry/sentry-go"
 
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/conf"
@@ -108,7 +103,7 @@ func main() {
 		panic(err)
 	}
 
-	credentialsReader, err := newCredentialsReader(bc.GetCredentialsService(), logger)
+	credentialsReader, err := credsConfig.NewFromConfig(bc.GetCredentialsService(), logger)
 	if err != nil {
 		panic(err)
 	}
@@ -125,83 +120,6 @@ func main() {
 	}
 }
 
-func newCredentialsReader(conf *conf.Credentials, l log.Logger) (credentials.Reader, error) {
-	awsc, vaultc, gcpc := conf.GetAwsSecretManager(), conf.GetVault(), conf.GetGcpSecretManager()
-	if awsc == nil && vaultc == nil && gcpc == nil {
-		return nil, errors.New("no credentials manager configuration found")
-	}
-
-	if awsc != nil {
-		return newAWSCredentialsManager(awsc, l)
-	}
-
-	if gcpc != nil {
-		return newGCPCredentialsManager(gcpc, l)
-	}
-
-	return newVaultCredentialsManager(vaultc, l)
-}
-
-func newAWSCredentialsManager(conf *conf.Credentials_AWSSecretManager, l log.Logger) (*awssecrets.Manager, error) {
-	if conf == nil {
-		return nil, errors.New("incompleted configuration for AWS secret manager")
-	}
-
-	opts := &awssecrets.NewManagerOpts{
-		Region:    conf.Region,
-		AccessKey: conf.GetCreds().GetAccessKey(), SecretKey: conf.GetCreds().GetSecretKey(),
-		Logger: l,
-	}
-
-	m, err := awssecrets.NewManager(opts)
-	if err != nil {
-		return nil, fmt.Errorf("configuring the secrets manager: %w", err)
-	}
-
-	_ = l.Log(log.LevelInfo, "msg", "secrets manager configured", "backend", "AWS secret manager")
-
-	return m, nil
-}
-
-func newVaultCredentialsManager(conf *conf.Credentials_Vault, l log.Logger) (*vault.Manager, error) {
-	if conf == nil {
-		return nil, errors.New("incompleted configuration for vault credentials manager")
-	}
-
-	opts := &vault.NewManagerOpts{
-		AuthToken: conf.Token, Address: conf.Address,
-		MountPath: conf.MountPath, Logger: l,
-	}
-
-	m, err := vault.NewManager(opts)
-	if err != nil {
-		return nil, fmt.Errorf("configuring vault: %w", err)
-	}
-
-	_ = l.Log(log.LevelInfo, "msg", "secrets manager configured", "backend", "Vault")
-
-	return m, nil
-}
-
-func newGCPCredentialsManager(conf *conf.Credentials_GCPSecretManager, l log.Logger) (*gcp.Manager, error) {
-	if conf == nil {
-		return nil, errors.New("uncompleted configuration for GCP secret manager")
-	}
-
-	opts := &gcp.NewManagerOpts{
-		ProjectID:         conf.ProjectId,
-		ServiceAccountKey: conf.ServiceAccountKey,
-		Logger:            l,
-	}
-
-	m, err := gcp.NewManager(opts)
-	if err != nil {
-		return nil, fmt.Errorf("configuring the GCP secret manager: %w", err)
-	}
-
-	return m, nil
-}
-
 func initSentry(c *conf.Bootstrap, logger log.Logger) (cleanupFunc func(), err error) {
 	cleanupFunc = func() {
 		sentry.Flush(2 * time.Second)

app/artifact-cas/internal/conf/buf.lock

@@ -1,7 +1,11 @@
 # Generated by buf. DO NOT EDIT.
 version: v1
 deps:
+  - remote: buf.build
+    owner: envoyproxy
+    repository: protoc-gen-validate
+    commit: 45685e052c7e406b9fbd441fc7a568a5
   - remote: buf.build
     owner: googleapis
     repository: googleapis
-    commit: 75b4300737fb4efca0831636be94e517
+    commit: cc916c31859748a68fd229a3c8d7a2e8

app/artifact-cas/internal/conf/buf.yaml

@@ -4,6 +4,7 @@ breaking:
     - FILE
 deps:
   - buf.build/googleapis/googleapis
+  - buf.build/envoyproxy/protoc-gen-validate:45685e052c7e406b9fbd441fc7a568a5
 lint:
   use:
     - DEFAULT