Add juju secrets backend and wire up to api facade #13239

wallyworld · 2021-08-13T07:35:08Z

Add the backend secrets infrastructure for a juju secrets provider:

secrets manager API facade
juju secrets service provider
mongo secrets store
secrets URL parser

This PR provides a minimal implementation for create secret and get secret value - these now work end to end.
There's still a lot more todo but this is a start.

QA steps

export JUJU_DEV_FEATURE_FLAGS=secrets
juju bootstrap lxd 
juju deploy ubuntu

juju exec --unit ubuntu/0 "secret-create password foo=bar hello=world"
secret://v1/f96c6f1b-9f81-41bf-890e-76a4f648b0fa/3547afab-0a6a-48be-87ca-1a5e3672a417/ubuntu.password

juju exec --unit ubuntu/0 "secret-get secret://v1/f96c6f1b-9f81-41bf-890e-76a4f648b0fa/3547afab-0a6a-48be-87ca-1a5e3672a417/ubuntu.password --format yaml"
foo: bar
hello: world

Also connect to mongo and inspect the secretMetadata and secretValues collections to see the secret info.
eg

juju:PRIMARY> db.secretValues.find().pretty()
{
        "_id" : "secret://v1/f96c6f1b-9f81-41bf-890e-76a4f648b0fa/3547afab-0a6a-48be-87ca-1a5e3672a417/ubuntu.password",
        "data" : {
                "foo" : "YmFy",
                "hello" : "d29ybGQ="
        },
        "txn-revno" : NumberLong(2),
        "txn-queue" : [
                "61161e533eeee028f25688e2_153e13c2"
        ]
}

wallyworld · 2021-08-13T07:35:35Z

secrets api facade

apiserver/facades/agent/secretsmanager/package_test.go

core/secrets/secret.go

secrets/interface.go

hpidcock

Just a few things but LGTM

core/secrets/secret.go

core/secrets/secret_test.go

secrets/interface.go

wallyworld · 2021-08-16T23:20:21Z

$$merge$$

wallyworld · 2021-08-17T00:17:53Z

$$merge$$

#13266 Merge 2.9 #13242 Fix test run steps for assess_caas_deploy_kubeflow #13239 Add juju secrets backend and wire up to api facade #13247 Create a channel in a more permissive manner #13248 Use system state to construct StateControllerConfig for remote relations #13246 Add list-secrets CLI #13252 Use tox to run tests for github kubeflow action test; #13250 Simplify ec2 ConfigSuite. #13255 Secret get attribute #13256 Ensure unsubscribe on error #13257 Only update homebrew release on juju/juju #13258 Make it clearer that model-default affects new models #13261 Move snap proxy setting to cloud init runcmd rather than bootcmd #13263 Do not get address device via machine #13261 Move snap proxy setting to cloud init runcmd rather than bootcmd #13238 Apply a floor to the calculated next lease manager tick #13264 Use upstream hashicorp/raft #13267 secret-create passes through the rotate duration #13268 Remove raftleaseservice worker Conflicts mainly in deleted files and removal of restore ``` # Conflicts: # cmd/jujud/agent/machine/manifolds_test.go # mongo/internal_test.go # state/backups/backups_linux.go # state/backups/backups_nonlinux.go # state/backups/restore.go # state/backups/restore_test.go ``` ## QA steps See PRs