Skip to content

Commit c44ba5c

Browse files
adityathebeadityathebe
committed
feat(Playbook): Secret parameter
* KMS connections
1 parent d307c3e commit c44ba5c

File tree

16 files changed

+281
-90
lines changed

16 files changed

+281
-90
lines changed

‎common/src/components/Fields.jsx‎

Lines changed: 113 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,89 @@ export default function Fields({ common = [], rows = [], oneOf, anyOf, connectio
118118
return a.field.localeCompare(b.field)
119119
}
120120

121+
// Common AWS connection fields
122+
const awsFields = [
123+
{
124+
field: oss ? null : "connection",
125+
description: "The connection url to use, mutually exclusive with `accessKey` and `secretKey`",
126+
scheme: "Connection",
127+
},
128+
{
129+
field: "accessKey",
130+
description: "Access Key ID",
131+
scheme: "EnvVar"
132+
},
133+
{
134+
field: "secretKey",
135+
description: "Secret Access Key",
136+
scheme: "EnvVar"
137+
},
138+
{
139+
field: "region",
140+
description: "The AWS region",
141+
scheme: "string"
142+
},
143+
{
144+
field: "endpoint",
145+
scheme: "string",
146+
description: "Custom AWS Endpoint to use",
147+
},
148+
{
149+
field: "skipTLSVerify",
150+
description: "Skip TLS verify when connecting to AWS",
151+
scheme: 'bool'
152+
}
153+
]
154+
155+
// Common GCP connection fields
156+
const gcpFields = [
157+
{
158+
field: oss ? null : 'connection',
159+
description:
160+
'The connection url to use, mutually exclusive with `credentials`',
161+
scheme: 'Connection'
162+
},
163+
{
164+
field: 'credentials',
165+
description: 'The credentials to use for authentication',
166+
scheme: 'EnvVar'
167+
},
168+
{
169+
field: 'endpoint',
170+
description: 'Custom GCP Endpoint to use',
171+
scheme: 'string'
172+
},
173+
{
174+
field: 'skipTLSVerify',
175+
description: 'Skip TLS verification when connecting to GCP',
176+
scheme: 'bool'
177+
}
178+
]
179+
180+
// Common Azure connection fields
181+
const azureFields = [
182+
{
183+
field: oss ? null : "connection",
184+
description: "The connection url to use, mutually exclusive with `tenantId`, `clientId`, and `clientSecret`",
185+
scheme: "Connection",
186+
},
187+
{
188+
field: "tenantId",
189+
description: "The Azure Active Directory tenant ID",
190+
required: true
191+
},
192+
{
193+
field: "clientId",
194+
description: "The Azure client/application ID",
195+
scheme: "EnvVar"
196+
},
197+
{
198+
field: "clientSecret",
199+
description: "The Azure client/application secret",
200+
scheme: "EnvVar"
201+
}
202+
]
203+
121204
if (connection == "url") {
122205
rows = rows.concat([
123206
{
@@ -200,62 +283,9 @@ export default function Fields({ common = [], rows = [], oneOf, anyOf, connectio
200283
}
201284
])
202285
} else if (connection == "aws") {
203-
rows = rows.concat([
204-
{
205-
field: oss ? null : "connection",
206-
description: "The connection url to use, mutually exclusive with `accessKey` and `secretKey`",
207-
scheme: "Connection",
208-
},
209-
{
210-
field: "accessKey",
211-
description: "Access Key ID",
212-
scheme: "EnvVar"
213-
},
214-
{
215-
field: "secretKey",
216-
description: "Secret Access Key",
217-
scheme: "EnvVar"
218-
},
219-
{
220-
field: "region",
221-
description: "The AWS region",
222-
scheme: "string"
223-
},
224-
{
225-
field: "endpoint",
226-
scheme: "string",
227-
description: "Custom AWS Endpoint to use",
228-
},
229-
{
230-
field: "skipTLSVerify",
231-
description: "Skip TLS verify when connecting to AWS",
232-
scheme: 'bool'
233-
}
234-
])
286+
rows = rows.concat(awsFields)
235287
} else if (connection == "gcp") {
236-
rows = rows.concat([
237-
{
238-
field: oss ? null : 'connection',
239-
description:
240-
'The connection url to use, mutually exclusive with `credentials`',
241-
scheme: 'Connection'
242-
},
243-
{
244-
field: 'credentials',
245-
description: 'The credentials to use for authentication',
246-
scheme: 'EnvVar'
247-
},
248-
{
249-
field: 'endpoint',
250-
description: 'Custom GCP Endpoint to use',
251-
scheme: 'string'
252-
},
253-
{
254-
field: 'skipTLSVerify',
255-
description: 'Skip TLS verification when connecting to GCP',
256-
scheme: 'bool'
257-
}
258-
])
288+
rows = rows.concat(gcpFields)
259289
} else if (connection == "sftp") {
260290
rows = rows.concat([
261291
{
@@ -347,34 +377,7 @@ export default function Fields({ common = [], rows = [], oneOf, anyOf, connectio
347377
scheme: "[CNRM](/reference/connections/kubernetes/#cnrm-connection)",
348378
}])
349379
} else if (connection == "azure") {
350-
rows = rows.concat([
351-
{
352-
field: oss ? null : "connection",
353-
description: "The connection url to use, mutually exclusive with `tenantId`, `subscriptionId`, `clientId`, and `clientSecret`",
354-
scheme: "Connection",
355-
},
356-
{
357-
field: "tenantId",
358-
description: "The Azure Active Directory tenant ID",
359-
required: true
360-
},
361-
{
362-
field: "subscriptionId",
363-
description: "The Azure subscription ID",
364-
required: true,
365-
scheme: "EnvVar"
366-
},
367-
{
368-
field: "clientId",
369-
description: "The Azure client/application ID",
370-
scheme: "EnvVar"
371-
},
372-
{
373-
field: "clientSecret",
374-
description: "The Azure client/application secret",
375-
scheme: "EnvVar"
376-
}
377-
])
380+
rows = rows.concat(azureFields)
378381
} else if (connection == "openai") {
379382
rows = rows.concat([
380383
{
@@ -618,6 +621,33 @@ export default function Fields({ common = [], rows = [], oneOf, anyOf, connectio
618621
} else if (connection == "prometheus") {
619622
// Prometheus extends HTTP connection, so HTTP fields will be included
620623
rows = rows.concat([])
624+
} else if (connection == "aws_kms") {
625+
rows = rows.concat(awsFields.concat([
626+
{
627+
field: "keyID",
628+
description: "KMS key ID, alias, or ARN. Can include region specification for aliases (e.g., alias/ExampleAlias?region=us-east-1)",
629+
scheme: "string",
630+
required: true
631+
}
632+
]))
633+
} else if (connection == "gcp_kms") {
634+
rows = rows.concat(gcpFields.concat([
635+
{
636+
field: "keyID",
637+
description: "KMS key resource path in the format: projects/PROJECT/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY",
638+
scheme: "string",
639+
required: true
640+
}
641+
]))
642+
} else if (connection == "azure_key_vault") {
643+
rows = rows.concat(azureFields.concat([
644+
{
645+
field: "keyID",
646+
description: "Key Vault key URL in the format: https://vault-name.vault.azure.net/keys/key-name",
647+
scheme: "string",
648+
required: true
649+
}
650+
]))
621651
}
622652

623653
rows = rows.concat(common.filter(row => row.required)).filter(i => i.field != null)

‎mission-control-chart‎

‎mission-control/docs/guide/playbooks/concepts/sensitive-data.mdx‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
title: Sensitive Data
3+
sidebar_custom_props:
4+
icon: material-symbols-light:security
5+
---
6+
7+
Sensitive data includes passwords, API keys, tokens, and other confidential information that requires protection from unauthorized access or exposure. Mission Control provides comprehensive protection for sensitive data throughout the entire playbook lifecycle.
8+
9+
## Secret Parameters
10+
11+
Use `secret` type parameters to handle sensitive data in playbooks:
12+
13+
```yaml
14+
parameters:
15+
- name: database_password
16+
type: secret
17+
label: "Database Password"
18+
description: "Password for database connection"
19+
required: true
20+
```
21+
22+
## KMS Connection
23+
24+
:::info
25+
Your Mission Control instance **must** have a KMS connection configured to use secret parameters.
26+
:::
27+
28+
Configure this using the `--secret-keeper-connection` flag:
29+
30+
```bash
31+
mission-control serve --secret-keeper-connection "connection://default/my-kms-key"
32+
```
33+
34+
or in the helm chart:
35+
36+
```yaml
37+
kmsConnection: "connection://default/my-kms-key"
38+
```
39+
40+
Supported connection types:
41+
- AWS KMS
42+
- Azure Key Vault
43+
- GCP KMS

‎mission-control/docs/installation/_properties_mission_control.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import Container from './_properties_container.mdx'
1212
| otel.serviceName | Defaults to `mission-control` |
1313
| properties.incidents.disable | Defaults to `{}` |
1414
| properties.logs.disable | Defaults to `true` |
15+
| kmsConnection | Provide the KMS connection string to use for secret parameters. See [KMS connection documentation](/reference/connections/KMS/) for details. | |
1516
| replicas | Defaults to `1` |
1617
| resources.limits.cpu | Defaults to `500m` |
1718
| resources.limits.memory | Defaults to `1024Mi` |

‎mission-control/docs/reference/connections/KMS/aws-kms.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: AWS KMS
3+
sidebar_custom_props:
4+
icon: aws
5+
---
6+
7+
<!-- Source: modules/duty/connection/awskms.go:12#AWSKMS -->
8+
9+
<Fields connection="aws_kms"/>
10+
11+
## Example
12+
13+
```yaml title="awskms.yaml" file=<rootDir>/modules/mission-control/fixtures/connections/awskms.yaml
14+
15+
```

‎mission-control/docs/reference/connections/KMS/azure-key-vault.mdx‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
title: Azure Key Vault
3+
sidebar_custom_props:
4+
icon: azure
5+
---
6+
7+
<!-- Source: modules/duty/connection/azurekeyvault.go:14#AzureKeyVault -->
8+
9+
<Fields connection="azure_key_vault"/>
10+
11+
## Example
12+
13+
```yaml title="azure-key-vault-connection.yaml"
14+
apiVersion: v1
15+
kind: Connection
16+
metadata:
17+
name: azure-key-vault-connection
18+
spec:
19+
type: azure_key_vault
20+
clientID:
21+
valueFrom:
22+
secretKeyRef:
23+
name: azure-credentials
24+
key: AZURE_CLIENT_ID
25+
clientSecret:
26+
valueFrom:
27+
secretKeyRef:
28+
name: azure-credentials
29+
key: AZURE_CLIENT_SECRET
30+
tenantID: your-tenant-id
31+
properties:
32+
keyID: https://your-vault.vault.azure.net/keys/mission-control-key
33+
```

‎mission-control/docs/reference/connections/KMS/gcp-kms.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: GCP KMS
3+
sidebar_custom_props:
4+
icon: gcp
5+
---
6+
7+
<!-- Source: modules/duty/connection/gcpkms.go:12#GCPKMS -->
8+
9+
<Fields connection="gcp_kms"/>
10+
11+
## Example
12+
13+
```yaml title="gcpkms.yaml" file=<rootDir>/modules/mission-control/fixtures/connections/gcpkms.yaml
14+
15+
```

‎mission-control/docs/reference/connections/KMS/index.mdx‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: KMS
3+
sidebar_custom_props:
4+
icon: material-symbols-light:security
5+
---
6+
7+
import DocCardList from '@theme/DocCardList';
8+
9+
<DocCardList />

‎mission-control/docs/reference/connections/Notifications/index.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
title: Notifications
3+
sidebar_position: 2
4+
5+
sidebar_custom_props:
6+
icon: ix:alarm-bell
7+
---
8+
9+
import DocCardList from '@theme/DocCardList';
10+
11+
<DocCardList />

0 commit comments

Comments
 (0)