refactor(ibmsm): Support v2 API and KV secret types #513
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
IBM Cloud SM API v1 is going out of support in a few months and clients must migrate to v2: https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v1. This implements the migration for AVP. It also adds support for KV secret types along with logging to indicate when "new" types, that are added by IBM Cloud SM that AVP might not support, are found and skipped. Finally, test for data races since
ibmsm
uses goroutines to speed things up.Notable changes in the v2 API/SDK:
SecretResource
structSecretData
key that allowed AVP to access the metadata and payload for (almost) any secret type. Instead structs specific to each type are returned (example: https://github.com/IBM/secrets-manager-go-sdk/blob/v2.0.0/secretsmanagerv2/secrets_manager_v2.go#L7211). While they all implement a common interface, it has 0 useful methods. This means AVP must handle each possible type explicitly. For this reason, the SDK return values are wrapped in new typesIBMSecretData
,IBMVersionedSecretData
,IBMSecretMetadata
; each type implements a genericGetMetadata
orGetSecret
method, so that the type-by-type code can be in 1 place and not each functionSecretData
in the v1 API) for each secret type are available for replacing a placeholder. This isn't configurable outside the codebaseChecklist
Please make sure that your PR fulfills the following requirements:
go mod tidy -compat=1.17
to ensure only the minimum is pulled in.Type of Change
Other information