provider rotation #432

nyobe · 2025-01-15T03:48:27Z

Introduces a new provider type and verb to support rotating static credentials.

Rotator providers have an additional state input which is used as a write-back target. The result of invoking Rotate is persisted back into the environment to this key. This provides a stable location to write to without accidentally clobbering interpolations that might be used for other inputs.

The new fn::rotate function type is used to invoke this new type of provider. It behaves similarly to existing providers during Open, but during rotation the evaluator will invoke the Rotate and collect their outputs, and the caller is expected to persist these updates back into the environment as a new revision.

# long form
fn::rotate:
  provider: provider
  inputs:
    # any config the provider needs to use during rotation
  state:
    # persisted state

# short form
fn::rotate::provider:
  # inputs
  state:
    # the special `state` input is hoisted out of inputs for the short form

Closes https://github.com/pulumi/pulumi-service/issues/24986

dschaller · 2025-01-16T18:35:01Z

eval/patch.go

+
+// ApplyPatches applies a set of patches values to an environment definition.
+// If patch values contain secret values, they will be wrapped with fn::secret.
+func ApplyPatches(source []byte, patches []*Patch) ([]byte, error) {


Not blocking just more of a thought - I wonder if we would ever want to have this be generic enough to apply any patch instead of limiting this to just values. I know for our current use case this isn't in scope but if a customer wants to use this to apply a patch for automating a migration of which requires import changes it could be helpful.

If we stick with just values here we may want to capture that in the function name

that's fair, it could drop the hardcoded assumption of the values toplevel key.
the name is also a bit of a misnomer since it's not doing a json patch, it's just doing a replacement. Perhaps BulkSetValues or ApplyReplacements or something like that? idk

nyobe · 2025-01-16T20:00:18Z

provider.go

+	Schema() (inputs, state, outputs *schema.Schema)
+
+	// Open retrieves the provider's secrets.
+	Open(ctx context.Context, inputs, state map[string]Value, executionContext EnvExecContext) (Value, error)


possibly Open should only take state, not inputs, because longer term we don't want to necessarily evaluate managing credential inputs during Open, just during Rotate?

seanyeh · 2025-01-16T21:23:47Z

eval/eval.go

@@ -98,7 +105,28 @@ func CheckEnvironment(
 	execContext *esc.ExecContext,
 	showSecrets bool,
 ) (*esc.Environment, syntax.Diagnostics) {
-	return evalEnvironment(ctx, true, name, env, decrypter, providers, environments, execContext, showSecrets)
+	checked, _, diags := evalEnvironment(ctx, true, name, env, decrypter, providers, nil, environments, execContext, showSecrets, nil)


I think we'll need to accept a rotatorLoader in CheckEnvironment to pass to the eval

you are totally right.. this is partly why I'm unsure about the Provider and Rotator interfaces diverging for Open() and Schema(), which is why RotatorLoader is even required :(

eval/eval.go

dschaller · 2025-01-17T19:43:12Z

provider.go

+	Schema() (inputs, state, outputs *schema.Schema)
+
+	// Open retrieves the provider's secrets.
+	Open(ctx context.Context, inputs, state map[string]Value, executionContext EnvExecContext) (Value, error)


yeah I would drop the inputs from open since we don't really need the inputs to perform the open. Also, it encourages best practice of not having the inputs be considered part of the open permissions

dschaller · 2025-01-17T23:06:13Z

eval/eval.go

 	envs EnvironmentLoader,
 	execContext *esc.ExecContext,
 	showSecrets bool,
-) (*esc.Environment, syntax.Diagnostics) {
+	rotatePaths map[string]bool,


@pgavlin wdyt about removing this? is there a strong use case for rotating specific paths within an environment?

nyobe · 2025-01-17T23:15:20Z

eval/eval.go

@@ -165,6 +198,9 @@ type evalContext struct {
 	root      *expr  // the root expression
 	base      *value // the base value

+	rotatePaths  map[string]bool // when non-nil, specifies providers to rotate. if empty, the full environment is rotated.


this might be too overloaded, maybe we should have an explicit rotating boolean instead of this nil check

dschaller · 2025-01-17T23:42:45Z

eval/patch.go

+		}
+	}()
+	// wrap secret values
+	if v.Secret {


Would this only wrap the top most value as a secret instead of the potentially nested values that are secrets? (I could be wrong about this but adding a test should help determine this)

nyobe · 2025-01-18T00:07:05Z

provider.go

+// Rotators persist internal state by writing back to the environment.
+type Rotator interface {
+	// Schema returns the provider's input, state, and output schemata.
+	Schema() (inputs, state, outputs *schema.Schema)


We talked about it being confusing that open doesn't necessarily return the full state, so perhaps this can be simplified so that the output schema is used for state schema?

(This would also help heal the divergence of the Rotator and Provider interfaces)

nyobe added 5 commits January 14, 2025 19:28

initial rotate verb

8c4a065

example

4010ab8

fn::rotate

a1f4ec9

rotate scoped to specific paths

4fa0993

move patch handling to eval pkg

4e22ea2

nyobe force-pushed the claire/provider-rotation branch from be5df41 to 4e22ea2 Compare January 16, 2025 00:18

separate rotator inputs and state

65b0277

dschaller reviewed Jan 16, 2025

View reviewed changes

nyobe commented Jan 16, 2025

View reviewed changes

seanyeh reviewed Jan 16, 2025

View reviewed changes

need to add RotatorLoaders to Check and Open too

54d9977

nyobe marked this pull request as ready for review January 16, 2025 23:34

nyobe requested a review from pgavlin January 16, 2025 23:35

license heading

889c6f0

seanyeh reviewed Jan 16, 2025

View reviewed changes

eval/eval.go Outdated Show resolved Hide resolved

fix rotator.Open not getting called when not rotating

e183ea7

dschaller reviewed Jan 17, 2025

View reviewed changes

nyobe added 2 commits January 17, 2025 12:13

fix rotator loaders need to be present for opening imports

d17fcda

initial snapshot test

4769a69

dschaller reviewed Jan 17, 2025

View reviewed changes

nyobe commented Jan 17, 2025

View reviewed changes

dschaller reviewed Jan 17, 2025

View reviewed changes

nyobe commented Jan 18, 2025

View reviewed changes

nyobe added 2 commits January 17, 2025 17:26

test valueToSecretJSON

14d609a

lint

6042f21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

provider rotation #432

provider rotation #432

nyobe commented Jan 15, 2025 •

edited

Loading

dschaller Jan 16, 2025

nyobe Jan 16, 2025

nyobe Jan 16, 2025 •

edited

Loading

seanyeh Jan 16, 2025

nyobe Jan 16, 2025 •

edited

Loading

dschaller Jan 17, 2025

dschaller Jan 17, 2025

nyobe Jan 17, 2025 •

edited

Loading

dschaller Jan 17, 2025

nyobe Jan 18, 2025

provider rotation #432

Are you sure you want to change the base?

provider rotation #432

Conversation

nyobe commented Jan 15, 2025 • edited Loading

dschaller Jan 16, 2025

Choose a reason for hiding this comment

nyobe Jan 16, 2025

Choose a reason for hiding this comment

nyobe Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

seanyeh Jan 16, 2025

Choose a reason for hiding this comment

nyobe Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

dschaller Jan 17, 2025

Choose a reason for hiding this comment

dschaller Jan 17, 2025

Choose a reason for hiding this comment

nyobe Jan 17, 2025 • edited Loading

Choose a reason for hiding this comment

dschaller Jan 17, 2025

Choose a reason for hiding this comment

nyobe Jan 18, 2025

Choose a reason for hiding this comment

nyobe commented Jan 15, 2025 •

edited

Loading

nyobe Jan 16, 2025 •

edited

Loading

nyobe Jan 16, 2025 •

edited

Loading

nyobe Jan 17, 2025 •

edited

Loading