CH-284 secrets managers base support implementation

.github/workflows/test.yml

@@ -1,17 +1,29 @@
 name: Test
 
 on:
+  # develop itself, so the state after a merge is tested
   push:
     branches: [ develop ]
+  # Pull requests targeting develop. This also covers every push to the branch of an open
+  # pull request, through the `synchronize` event, so branches without one are not tested.
   pull_request:
     branches: [ develop ]
 
+# Supersede in-flight runs of the same branch or pull request
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
+      # On a pull request, check out the branch as it was pushed. The default is the merge
+      # commit with the base branch, which tests a tree that exists nowhere else.
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - uses: actions/setup-python@v5
         with:

applications/accounts/deploy/templates/_identity_providers.tpl

@@ -14,8 +14,8 @@
         "firstBrokerLoginFlowAlias": "first broker login",
         "config": {
             "syncMode": "IMPORT",
-            "clientSecret": {{ .app.harness.secrets.github_clientSecret | default "<github_clientSecret>" | quote }},
-            "clientId": {{ .app.harness.secrets.github_clientId | default "<github_clientId>" | quote }},
+            "clientSecret": {{ include "deploy_utils.secretValue" (dict "spec" .app.harness.secrets.github_clientSecret) | default "<github_clientSecret>" | quote }},
+            "clientId": {{ include "deploy_utils.secretValue" (dict "spec" .app.harness.secrets.github_clientId) | default "<github_clientId>" | quote }},
             "useJwksUrl": "true"
             }
     }
@@ -36,8 +36,8 @@
         "firstBrokerLoginFlowAlias": "first broker login",
         "config": {
             "syncMode": "IMPORT",
-            "clientSecret": {{ .app.harness.secrets.google_clientSecret | default "<google_clientSecret>" | quote }},
-            "clientId": {{ .app.harness.secrets.google_clientId | default "<google_clientId>" | quote }},
+            "clientSecret": {{ include "deploy_utils.secretValue" (dict "spec" .app.harness.secrets.google_clientSecret) | default "<google_clientSecret>" | quote }},
+            "clientId": {{ include "deploy_utils.secretValue" (dict "spec" .app.harness.secrets.google_clientId) | default "<google_clientId>" | quote }},
             "useJwksUrl": "true"
         }
     }

deployment-configuration/compose/templates/_secrets.yaml

@@ -0,0 +1,51 @@
+{{/*
+Secret definition helpers, shared with the helm chart.
+
+Secret managers do not exist in a local docker compose deployment: only the plain value of
+a secret definition is resolved here. Keep in sync with the reference implementation in
+`deployment-configuration/helm/templates/_secrets.tpl`, which also documents the rich form.
+*/}}
+
+{{/*
+Resolve the manager of a secret definition.
+Outputs `cloudharness`, `unmanaged` or the manager name.
+Usage: {{ include "deploy_utils.secretManager" (dict "spec" $secretDefinition) }}
+*/}}
+{{- define "deploy_utils.secretManager" -}}
+{{- $manager := "cloudharness" -}}
+{{- if kindIs "map" .spec -}}
+  {{- if hasKey .spec "manager" -}}
+    {{- $declared := get .spec "manager" -}}
+    {{- if kindIs "invalid" $declared -}}
+      {{- $manager = "unmanaged" -}}
+    {{- else -}}
+      {{- if eq (toString $declared) "" -}}
+        {{- $manager = "unmanaged" -}}
+      {{- else -}}
+        {{- $manager = toString $declared -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- $manager -}}
+{{- end -}}
+
+{{/*
+Resolve the value of a secret definition: the definition itself in the simple form,
+the `default` entry in the rich form. Empty when not defined.
+Usage: {{ include "deploy_utils.secretValue" (dict "spec" $secretDefinition) }}
+*/}}
+{{- define "deploy_utils.secretValue" -}}
+{{- if kindIs "map" .spec -}}
+  {{- if hasKey .spec "default" -}}
+    {{- $default := get .spec "default" -}}
+    {{- if not (kindIs "invalid" $default) -}}
+      {{- $default -}}
+    {{- end -}}
+  {{- end -}}
+{{- else -}}
+  {{- if not (kindIs "invalid" .spec) -}}
+    {{- .spec -}}
+  {{- end -}}
+{{- end -}}
+{{- end -}}

deployment-configuration/compose/templates/auto-secrets.yaml

@@ -1,11 +1,17 @@
 {{- define "deploy_utils.secret" }}
 {{- if .app.harness.secrets }}
+{{/* Secret managers are not available locally: every secret is resolved to its literal
+     value, or to the `default` entry when defined in the rich form. */}}
+{{- $resolved := dict }}
+{{- range $k, $v := .app.harness.secrets }}
+  {{- $_ := set $resolved $k (include "deploy_utils.secretValue" (dict "spec" $v)) }}
+{{- end }}
 
 {{- $secret_name := printf "%s" .app.harness.deployment.name }}
   {{- $secret := (lookup "v1" "Secret" .root.Values.namespace $secret_name) }}
   {{- if $secret }}
 # secret already exists
-    {{- if not (compact (values .app.harness.secrets)) }}
+    {{- if not (compact (values $resolved)) }}
 # secret values are null, copy from the existing secret
       {{- range $k, $v := $secret.data }}
 cloudharness-metadata:
@@ -17,7 +23,7 @@ data: {{ $v }}
     {{- else }}
 # there are non default values in values.yaml, use these
 stringData:
-      {{- range $k, $v := .app.harness.secrets }}
+      {{- range $k, $v := $resolved }}
 cloudharness-metadata:
   path: resources/generated/auth/{{ $k }}
 
@@ -28,7 +34,7 @@ data: {{ $v | default (randAlphaNum 20) }}
   {{- else }}
 # secret doesn't exist
 stringData:
-    {{- range $k, $v := .app.harness.secrets }}
+    {{- range $k, $v := $resolved }}
 cloudharness-metadata:
   path: resources/generated/auth/{{ $k }}
 data: {{ $v | default (randAlphaNum 20) }}
@@ -46,4 +52,4 @@ data: {{ $v | default (randAlphaNum 20) }}
     {{- end }}
   {{- end }}
   {{- end }}
-{{- end }}
+{{- end }}