Add AWS Secrets Manager plugin; restructure secret providers into secret-providers/ - #84
Merged
Merged
Conversation
…der; add AWS Secrets Manager plugin Moves the Azure Key Vault and Delinea Secret Server secret-provider plugins from flat product-root files into a secret-providers/ subfolder (matching the device-drivers/ convention), generalizing the in-repo filename to plugin.py. Adds the AWS Secrets Manager plugin alongside them. Documents a new "Using the Alias in an Integration Model Instance" pattern in all three READMEs, and updates the top-level README's asset-type table, repository structure diagram, and Getting Started steps to include secret-providers as a recognized asset type. BREAKING: anyone with an existing secret-provider registered against /opt/gateway/azure-plugin.py or /opt/gateway/delinea-plugin.py should re-copy the plugin from its new path (Product/secret-providers/plugin.py) before updating; the deployed host-side filename is unchanged.
…ce-first The Architecture section previously showed only the device-inventory flow, then bolted the Integration Model instance case on afterward as a "but you can also" footnote. Reframed so Gateway resolving the secret is the one constant, with device inventory and Integration Model instances shown as two equal callers into the same alias → provider → plugin path. Merged the two usage examples under one "Referencing the Alias" section with matching subsections instead of a separate standalone section.
…o Referencing the Alias Readers configuring an alternative secrets-manager plugin want "what this is, then how to set it up" - not an intro, a bulleted rationale, and a diagram before Prerequisites. Replaced the verbose opening with a short What This Is (folds in the value prop: one less credential store, automatic rotation propagation, no VPN between SaaS Platform and an on-prem secrets manager) and dropped the standalone Architecture section. The diagram now lives inline in Referencing the Alias, where it's actually needed to introduce the two worked examples, and the caller list is broadened (not just device inventory / Integration Model instances) to include Config Manager command templates and GatewayManager tasks (runService, runCode, sendCommand, sendConfig), linking to Itential's own external-secrets overview doc for the complete list rather than inventing unverified specifics.
…tory Manager Nodes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
secret-providers/subfolder (matching thedevice-drivers/convention), generalizing the in-repo filename toplugin.pyrunService,runCode,sendCommand,sendConfig)secret-providers/README.mdto lead with a short "What This Is" before diving into setup, instead of a long intro/architecture section up frontsecret-providersas a recognized asset type in the top-levelREADME.md(asset-type table, repository structure diagram, Getting Started steps)Breaking change
Anyone with an existing secret-provider registered against
/opt/gateway/azure-plugin.pyor/opt/gateway/delinea-plugin.pyshould re-copy the plugin from its new path (Product/secret-providers/plugin.py) — the recommended host-side filename is unchanged, only the in-repo path moved.Test plan
plugin.pyfiles passpython3 -c "import ast; ast.parse(...)"syntax checksaws_signing_helper, and manually-verified SigV4 signing)iagctlon a live Itential Gateway 5.5 host, confirmed viasecret_resolution ... outcome=successin the gateway log