Skip to content

Add secrets manager integration for credential retrieval - #897

Merged
sduenas merged 1 commit into
chaoss:mainfrom
alberefe:credential-manager-integration
Jun 16, 2026
Merged

Add secrets manager integration for credential retrieval #897
sduenas merged 1 commit into
chaoss:mainfrom
alberefe:credential-manager-integration

Conversation

@alberefe

Copy link
Copy Markdown
Contributor

Integrate Perceval with external secrets managers (Bitwarden, HashiCorp Vault) so credentials can be resolved at runtime instead of being passed as plain-text CLI arguments.

  • Add --secrets-manager, --item-name, and provider-specific CLI flags
    to BackendCommandArgumentParser
  • Add _pre_init() and _build_manager() in BackendCommand to orchestrate credential resolution via grimoirelab-toolkit's resolve_credentials()
  • Enable secrets manager support on 14 backends
  • Add hvac as optional dependency group
  • Usage in README

@alberefe

Copy link
Copy Markdown
Contributor Author

I'll be fixing this later please wait before you check so every test and dependency is working fine!

@alberefe
alberefe force-pushed the credential-manager-integration branch 2 times, most recently from b16dbb2 to cc2a73e Compare April 29, 2026 11:56

@sduenas sduenas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check my initial comments. Also, my concern is this only makes perceval work if you use the backend command but not the library. Please evaluate if it makes sense to integrate it within fetch or other methods, or if on the other hand, developers should use grimoirelab toolkit instead.

Comment thread perceval/backend.py Outdated
Comment thread perceval/backend.py
@alberefe
alberefe force-pushed the credential-manager-integration branch from cc2a73e to 447d0c2 Compare May 3, 2026 17:02
@alberefe
alberefe requested a review from sduenas May 3, 2026 17:02
Comment thread perceval/backend.py Outdated
Comment thread perceval/backend.py Outdated
@alberefe
alberefe force-pushed the credential-manager-integration branch from 447d0c2 to f8cc53e Compare May 4, 2026 11:54
@alberefe
alberefe requested a review from sduenas May 4, 2026 11:54

@sduenas sduenas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fix the lint errors and add unit test for this functionality.

@alberefe
alberefe force-pushed the credential-manager-integration branch from f8cc53e to e658562 Compare May 5, 2026 09:20
@alberefe

alberefe commented May 5, 2026

Copy link
Copy Markdown
Contributor Author

Getting those errors cause I think it's importing an old version of Toolkit from before it had the las PR changes, is that correct? Not sure how to deal with that or if I'm even correct, but not sure what to do with it.

@sduenas

sduenas commented May 5, 2026

Copy link
Copy Markdown
Member

Getting those errors cause I think it's importing an old version of Toolkit from before it had the las PR changes, is that correct? Not sure how to deal with that or if I'm even correct, but not sure what to do with it.

We fixed it in #900. Please rebase your branch.

@alberefe
alberefe force-pushed the credential-manager-integration branch from e658562 to e98ca15 Compare May 6, 2026 09:56
@alberefe
alberefe requested a review from sduenas May 6, 2026 09:58
@alberefe
alberefe force-pushed the credential-manager-integration branch from e98ca15 to 15eefe8 Compare May 11, 2026 11:27
@alberefe

Copy link
Copy Markdown
Contributor Author

Please fix the lint errors and add unit test for this functionality.

Please fix the lint errors and add unit test for this functionality.

Linting errors should be fixed and made tests for the env functinoality.

@sduenas sduenas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check my comments. The tests fail because hvac is not installed.

Comment thread poetry.lock Outdated
Comment thread poetry.lock Outdated
Comment thread tests/test_backend.py Outdated
Comment thread tests/test_backend.py Outdated
Comment thread tests/test_backend.py Outdated
Comment thread tests/test_backend.py Outdated
Comment thread tests/test_backend.py
@alberefe
alberefe force-pushed the credential-manager-integration branch from 15eefe8 to 9ae098e Compare May 14, 2026 14:12
@alberefe

Copy link
Copy Markdown
Contributor Author

Fix the poetry.lock file (needed to update some packages) and the testing now properly tests perceval functioning and not toolkit.

@alberefe
alberefe requested a review from sduenas May 14, 2026 14:13

@jjmerchante jjmerchante left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, it looks good to me. Just some minor changes

Comment thread releases/unreleased/add-secrets-manager.yml Outdated
Comment thread perceval/backend.py
Comment thread perceval/backend.py Outdated
@alberefe
alberefe force-pushed the credential-manager-integration branch 2 times, most recently from d838165 to 4395645 Compare June 12, 2026 16:40
@alberefe

Copy link
Copy Markdown
Contributor Author

So, I fixed the things you commented, but I am not sure how to proceed with the poetry.lock conflict. I updated poetry to match the version of main, but now I'm getting other conflicts and not sure if leaving it to you. Not fully understand what the problem is.

@alberefe
alberefe requested a review from jjmerchante June 16, 2026 06:52
@jjmerchante
jjmerchante force-pushed the credential-manager-integration branch from 4395645 to 80f0bf5 Compare June 16, 2026 06:52

@jjmerchante jjmerchante left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sduenas sduenas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good to me now. However, would you mind to move the documentation from the README to a file on /docs/perceval? I think it's too long for the readme file. You can leave a brief description of its usage and the rest, move it to a file there. You can also link the file from the README for those who need more info.

Signed-off-by: Alberto Ferrer Sánchez <alberefe@gmail.com>
@alberefe
alberefe force-pushed the credential-manager-integration branch from 80f0bf5 to 1d4c666 Compare June 16, 2026 12:52
@alberefe
alberefe requested a review from sduenas June 16, 2026 12:53
@alberefe

Copy link
Copy Markdown
Contributor Author

Created a new docs file and linked to it from the README.md.

@sduenas sduenas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sduenas
sduenas merged commit 2214fe8 into chaoss:main Jun 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants