Repository navigation
chore: remove unused native connector secrets code - #4524
Merged
Jan-Kazlouski-elastic merged 1 commit intoOct 7, 2026
Merged
Jan-Kazlouski-elastic merged 1 commit into
Jan-Kazlouski-elastic merged 1 commit into
Conversation
Contributor
|
buildkite test this |
Jan-Kazlouski-elastic
added
v8.19.24
v9.5.6
v9.4.9
and removed
v9.4.8
v9.5.5
v8.19.23
labels
Contributor
|
Thank you @ShivamSharma43 |
the pieces it left with no remaining callers: get_connector_secret(), the Connector.api_key_secret_id property, ApiKeyNotFoundError, and Features.native_connector_api_keys_enabled() / NATIVE_CONNECTOR_API_KEYS, along with their tests. The native_connector_api_keys features entry, create_connector_secret() and the CLI's use of it are left in place. Part of elastic#2990 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ShivamSharma43
force-pushed
the
cleanup/2990-native-connector-secrets
branch
from
October 6, 2026 19:01
7b9a7d5 to
a04844a
Compare
Contributor
|
buildkite test this |
Jan-Kazlouski-elastic
enabled auto-merge (squash)
October 7, 2026 12:36
Jan-Kazlouski-elastic
disabled auto-merge
October 7, 2026 12:41
Jan-Kazlouski-elastic
enabled auto-merge (squash)
October 7, 2026 12:43
This was referenced Oct 7, 2026
Jan-Kazlouski-elastic
pushed a commit
that referenced
this pull request
Oct 7, 2026
Backports the following commits to 9.5: - chore: remove unused native connector secrets code (#4524) Co-authored-by: Shivam Sharma <192242476+ShivamSharma43@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Jan-Kazlouski-elastic
pushed a commit
that referenced
this pull request
Oct 7, 2026
Backports the following commits to 9.4: - chore: remove unused native connector secrets code (#4524) Co-authored-by: Shivam Sharma <192242476+ShivamSharma43@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
6 tasks done
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Oct 7, 2026
) ## Closes #2990 Follow-up to #4524. Since 9.0 (#2989) the framework never reads connector secrets, but `connectors connector create --native` still stored the connector API key in a connector secret and wrote its id to `api_key_secret_id`. Nothing consumes that secret. Changes: - CLI no longer creates a connector secret; `api_key_secret_id` is written as `null` - Remove `ESManagementClient.create_connector_secret()` (CLI was the only caller) and its test - Remove `test_get_index_or_alias`, a copy of the secret test that never called `get_index_or_alias` (covered by `test_extract_index_or_alias_*`) - `CONNECTOR_PROTOCOL.md`: note `api_key_secret_id` is not read by the framework since 9.0 Deliberately kept: - `native_connector_api_keys` in `BaseDataSource.features()`: part of the ES `ConnectorFeatures` schema; removing it would make native connector docs be rewritten on every scheduler poll, because the key sets would never match - `api_key_secret_id` field: still part of the ES Connector API and written by Kibana Not for 8.19: 8.19 still reads connector secrets during native syncs. ## Checklists #### Pre-Review Checklist - [x] this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check `config.yml.example`) - [x] this PR has a meaningful title - [x] this PR links to all relevant github issues that it fixes or partially addresses - [x] Covered the changes with automated tests - [x] Tested the changes locally (`make clean install autoformat lint test`) - [x] Added a label for each target release version (example: `v7.13.2`, `v7.14.0`, `v8.0.0`) ## Release Note The `connectors connector create --native` CLI command no longer stores the connector API key in a connector secret.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #2990
#2989 removed
_update_native_connector_authentication(), the only place the framework read a connector secret, and setnative_connector_api_keys_enabledto False. Several pieces it relied on were left behind with no remaining callers. This PR removes those:ESManagementClient.get_connector_secret()Connector.api_key_secret_idpropertyApiKeyNotFoundErrorinsync_job_runner.pyFeatures.native_connector_api_keys_enabled()and theFeatures.NATIVE_CONNECTOR_API_KEYSconstant inconnectors_sdkTheir tests are removed with them, along with a leftover
native_connector_api_keys_enabledmock intest_sync_job_runner.py.Nothing here changes what is written to Elasticsearch or what Kibana sees. The following are deliberately left in place because removing them would be observable outside the framework, and are for a separate PR if that is wanted:
native_connector_api_keysentry inBaseDataSource.features(), which is written into the connector doccreate_connector_secret(), whichconnectors connector create --nativestill uses to store an API key and setapi_key_secret_idon the connector docapi_key_secret_idindocs/CONNECTOR_PROTOCOL.mdFeatures.native_connector_api_keys_enabled()andNATIVE_CONNECTOR_API_KEYSare public in the publishedconnectors_sdkpackage. Nothing in this repo uses them, but external code calling them would break.Tests:
make lintandmake testpass in bothapp/connectors_service(2504 passed, 92.01% coverage) andlibs/connectors_sdk(343 passed, 84.21% coverage).Checklists
Pre-Review Checklist
config.yml.example)make lintandmake test; not tested against a live cluster)Related Pull Requests
test_management_client.py, so whichever merges second will need a small rebase.Generated with Claude Code