UI: Implement KV patch+subkey [enterprise] #28212

hellobontempo · 2024-08-28T20:04:28Z

Description

This PR adds subkey/patch to the Vault UI for enterprise users.

subkey_mov.mov

TODO only if you're a HashiCorp employee

Backport Labels: If this PR is in the ENT repo and needs to be backported, backport
to N, N-1, and N-2, using the backport/ent/x.x.x+ent labels. If this PR is in the CE repo, you should only backport to N, using the backport/x.x.x label, not the enterprise labels.
- If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
of a public function, even if that change is in a CE file, double check that
applying the patch for this PR to the ENT repo and running tests doesn't
break any tests. Sometimes ENT only tests rely on public functions in CE
files.
Jira: If this change has an associated Jira, it's referenced either
in the PR description, commit message, or branch name.
RFC: If this change has an associated RFC, please link it in the description.
ENT PR: If this change has an associated ENT PR, please link it in the
description. Also, make sure the changelog is in this PR, not in your ENT PR.

github-actions · 2024-08-28T20:25:34Z

CI Results:
All Go tests succeeded! ✅

* build json editor patch form * finish patch component and tests * add tab to each route * and path route * add overview tab to tests * update overview to use updated_time instead of created_time * redirect relevant secret.details to secret.index * compute secretState in component instead of pass as arg * add capabilities service * add error handling to fetchSubkeys adapter request * add overview tabs to test * add subtext to overview card * remaining redirects in secret edit * remove create new version from popup menu * fix breadcrumbs for overview * separate adding capabilities service * add service to kv engine * Revert "separate adding capabilities service" This reverts commit bb70b12. * Revert "add service to kv engine" This reverts commit bfa8805. * update navigation test * consistently navigate to secret.index route to be explicit * finish overview navigation tests * add copyright header * update delete tests * fix nav testrs * cleanup secret edit redirects * remove redundant async/awaits * fix create test * edge case tests * secret acceptance tests * final component tests

…(sidebranch) (#28192) * add tab to each route * and path route * add overview tab to tests * update overview to use updated_time instead of created_time * redirect relevant secret.details to secret.index * compute secretState in component instead of pass as arg * add capabilities service * add error handling to fetchSubkeys adapter request * add patch route and put in page component * add patch secret action to subkeys card * fix component name * add patch capability * alphabetize computed capabilities * update links, cleanup selectors * fix more merge conflict stuff * add capabilities test * add models to patch link * add test for patch route * rename external route * add error templates * make notes about enterprise tests, filter one * remove errors, transition (redirect) instead * redirect patch routes

@secret

* remove @secret from metadata details * use metadata model instead of secret in paths page * put delete back into kv/data adapter * grant access in control group test * update metadata route and permissions * remove secret from parent route, only fetch in details route * change more permissions to route perms, add tests * revert overview redirect from list view * wrap model in conditional for perms * remove redundant canReadCustomMetadata check * rename adapter method * handle overview 404 * remove comment * add customMetadata as an arg * update grantAccess in test * make version param easier to follow * VAULT-30494 handle 404 jira * refactor capabilities to return an object * update create tests * add test for default truthy capabilities

* add enterprise check for subkey card * add max height and scroll to subkey card * only fetch subkeys if enterprise * remove check in overview * add test * Update ui/tests/integration/components/kv/page/kv-page-overview-test.js

github-actions · 2024-08-29T13:57:16Z

Build Results:
All builds succeeded! ✅

* add assertion * add optional chaining * create/delete versioned secret in each module * wait for transition * add another waitUntil

* add patch latest version action to toolbar * make isPatchAllowed arg all encompassing * no longer need model check * use hash so both promises fire at the same time * add subkeys to policy * Update ui/lib/kv/addon/routes/secret.js

hashishaw

Great work! Just some 🧹

hashishaw · 2024-08-29T20:20:15Z

ui/app/routes/vault/cluster/secrets/backend/secret-edit.js

-            secret
-          );
+        let route, params;
+        switch (true) {


Creative! Threw me off guard 😂

hashishaw · 2024-08-29T20:21:46Z

ui/app/routes/vault/cluster/secrets/backend/secret-edit.js

@@ -81,17 +81,27 @@ export default Route.extend({
      const mode = this.routeName.split('.').pop();
      // for kv v2, redirect users from the old url to the new engine url (1.15.0 +)
      if (secretEngine.type === 'kv' && secretEngine.version === 2) {


Since we're cleaning up the redirect logic, I believe we should also redirect for secretEngine.type === 'generic' && secretEngine.version === 2

I'm hesitant to change or add anything to this logic flow, but happy to do this as a follow on! The only improvement/change I made by reorganizing the logic is to navigate to edit or index accordingly instead of arbitrarily go to details. I think during the original implementation we weren't aware we had the route info available to discern between a user either viewing or editing secret so navigate to the details route

hashishaw · 2024-08-29T20:22:48Z

ui/app/services/capabilities.ts

-  this method returns a capabilities model for each path in the array of paths
-  */
-  async fetchMultiplePaths(paths: string[]): Promise<Array<CapabilitiesModel>> | AdapterError {
+  async fetchMultiplePaths(paths: string[]): MultipleCapabilities | AdapterError {


Suggested change

async fetchMultiplePaths(paths: string[]): MultipleCapabilities | AdapterError {

async fetchMultiplePaths(paths: string[]): Promise<MultipleCapabilities | AdapterError> {

This actually doesn't return a promise! On line 45 we await the request and this just returns an object with the path as the key and value as the capabilities:

{ "my/api/path": { canCreate: true, canDelete: true, canList: true, canPatch: true, canRead: true, canSudo: true, canUpdate: true, }; }

Which reminds me that I need to remove the try...catch wrapping the whole thing!

I thought any async method technically returns a promise... 🤔

async is just necessary so we can await the promise on line 45, the method itself is not a promise, though!

hashishaw · 2024-08-29T20:25:14Z

ui/lib/kv/addon/components/page/secret/details.js

-    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret', {
-      queryParams: { version: this.version },
-    });
+    // TODO test/update this when model moves to details route


Is this TODO done?

hashishaw · 2024-08-29T20:29:05Z

ui/lib/kv/addon/routes/secret.js

    });
  }

  @action
  willTransition(transition) {
+    // TODO update this comment and refreshes


hashishaw · 2024-08-29T20:32:58Z

ui/lib/kv/addon/utils/kv-breadcrumbs.js

@@ -45,7 +45,7 @@ export function breadcrumbsForSecret(backend, secretPath, lastItemCurrent = fals
        };
      }
      if (!isDir) {
-        return { label: segment.label, route: 'secret.details', models: [backend, segment.model] };
+        return { label: segment.label, route: 'secret', models: [backend, segment.model] };


We might have missed secret.index here?

Suggested change

return { label: segment.label, route: 'secret', models: [backend, segment.model] };

return { label: segment.label, route: 'secret.index', models: [backend, segment.model] };

Oh yeah - I didn't change this one intentionally because I was getting strange failures but let me look back into

* add conditional for enterprise checking tabs * cleanup fetchMultiplePaths method * add test * remove todo comment, ticket created and design wants to hold off * keep transition, update comments * cleanup tests, add index to breadcrumbs * add some test coverage * toggle so value is readable

hellobontempo · 2024-08-29T23:30:53Z

enterprise passed:

cwchristerw · 2024-09-22T11:01:04Z

I would like to see this feature in Vault CE, because due to this feature being implemented, #28261 will remove similar feature from Vault CE. @hellobontempo

heatherezell · 2024-09-23T17:25:19Z

For now, we see this as an enterprise feature as many customers have requested this capability at the enterprise level. We consider feedback from the community as part of our roadmap planning process, so please upvote the feature request issue and we may consider it in the future.

hellobontempo added the ui label Aug 28, 2024

hellobontempo added this to the 1.18.0-rc milestone Aug 28, 2024

github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Aug 28, 2024

vercel bot deployed to Preview August 28, 2024 20:11 View deployment

hellobontempo force-pushed the ui/VAULT-20524/implement-kv-patch-subkey-ui branch from ca1196d to f41e93e Compare August 28, 2024 20:26

hellobontempo and others added 5 commits August 28, 2024 13:27

rename kvSecretDetails external route to kvSecretOverview

0e0be85

add comment

cbe095a

hellobontempo force-pushed the ui/VAULT-20524/implement-kv-patch-subkey-ui branch from f41e93e to c432c74 Compare August 28, 2024 20:27

hellobontempo and others added 2 commits August 28, 2024 13:59

remove destroy-all-versions from kv/data adapter

755d226

UI: Add enterprise checks (#28215)

069a96c

* add enterprise check for subkey card * add max height and scroll to subkey card * only fetch subkeys if enterprise * remove check in overview * add test * Update ui/tests/integration/components/kv/page/kv-page-overview-test.js

hellobontempo marked this pull request as ready for review August 29, 2024 02:54

hellobontempo requested a review from a team as a code owner August 29, 2024 02:54

hellobontempo added 3 commits August 29, 2024 08:55

Merge branch 'main' into ui/VAULT-20524/implement-kv-patch-subkey-ui

198457d

fix test failures (#28222)

b1e9264

* add assertion * add optional chaining * create/delete versioned secret in each module * wait for transition * add another waitUntil

UI: Add patch latest version to toolbar (#28223)

eba4601

* add patch latest version action to toolbar * make isPatchAllowed arg all encompassing * no longer need model check * use hash so both promises fire at the same time * add subkeys to policy * Update ui/lib/kv/addon/routes/secret.js

hashishaw approved these changes Aug 29, 2024

View reviewed changes

hellobontempo and others added 2 commits August 29, 2024 15:18

add changelog

1aa5418

hellobontempo merged commit f634808 into main Aug 29, 2024
26 checks passed

hellobontempo deleted the ui/VAULT-20524/implement-kv-patch-subkey-ui branch August 29, 2024 23:38

This was referenced Aug 30, 2024

UI: improve control group UX #28232

Merged

UI: add isPatchAllowed to jsdoc component notes #28260

Merged

hashishaw mentioned this pull request Sep 3, 2024

UI Remove obscured json #28261

Merged

1 task

hellobontempo mentioned this pull request Sep 5, 2024

UI: Hide patch for deleted or destroyed secrets #28301

Merged

6 tasks

hashishaw mentioned this pull request Sep 6, 2024

UI: Fix no data read within namespaces #28311

Merged

fer1592 mentioned this pull request Sep 17, 2024

Populate a single kubernetes secret from multiple Vault secrets hashicorp/vault-secrets-operator#923

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

UI: Implement KV patch+subkey [enterprise] #28212

UI: Implement KV patch+subkey [enterprise] #28212

hellobontempo commented Aug 28, 2024 •

edited

Loading

github-actions bot commented Aug 28, 2024 •

edited

Loading

github-actions bot commented Aug 29, 2024

hashishaw left a comment

hashishaw Aug 29, 2024

hashishaw Aug 29, 2024

hellobontempo Aug 29, 2024

hashishaw Aug 29, 2024

hellobontempo Aug 29, 2024

hellobontempo Aug 29, 2024

hashishaw Aug 29, 2024

hellobontempo Aug 29, 2024

hashishaw Aug 29, 2024

hashishaw Aug 29, 2024

hashishaw Aug 29, 2024

hellobontempo Aug 29, 2024

hellobontempo commented Aug 29, 2024

cwchristerw commented Sep 22, 2024

heatherezell commented Sep 23, 2024

	async fetchMultiplePaths(paths: string[]): MultipleCapabilities \| AdapterError {
	async fetchMultiplePaths(paths: string[]): Promise<MultipleCapabilities \| AdapterError> {

	return { label: segment.label, route: 'secret', models: [backend, segment.model] };
	return { label: segment.label, route: 'secret.index', models: [backend, segment.model] };

UI: Implement KV patch+subkey [enterprise] #28212

UI: Implement KV patch+subkey [enterprise] #28212

Conversation

hellobontempo commented Aug 28, 2024 • edited Loading

Description

TODO only if you're a HashiCorp employee

github-actions bot commented Aug 28, 2024 • edited Loading

github-actions bot commented Aug 29, 2024

hashishaw left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellobontempo commented Aug 29, 2024

cwchristerw commented Sep 22, 2024

heatherezell commented Sep 23, 2024

hellobontempo commented Aug 28, 2024 •

edited

Loading

github-actions bot commented Aug 28, 2024 •

edited

Loading