Skip to content

feat: allow EDA credential fields to link to external Secret Management Systems (SMS)#1361

Merged
hsong-rh merged 1 commit into
ansible:mainfrom
hsong-rh:aap-46900
Jul 21, 2025
Merged

feat: allow EDA credential fields to link to external Secret Management Systems (SMS)#1361
hsong-rh merged 1 commit into
ansible:mainfrom
hsong-rh:aap-46900

Conversation

@hsong-rh
Copy link
Copy Markdown
Contributor

@hsong-rh hsong-rh commented Jul 10, 2025

This RP is regenerated from #1349

AAP allows text fields in a Credential to be connected to an external Secret Management System like Hashicorp Vault.
EDA was lacking this feature, this fix tries to address that by providing

  • Test External SMS for connectivity and existence of secrets
  • Optionally link text fields to External SMS
  • Uses the awx-plugins-core to manage the connections to external SMS

New API end points added

  • /api/eda/v1/credential-types/nnn/test/ (POST)
  • /api/eda/v1/eda-credentials/nnn/test/ (POST)
  • /api/eda/v1/eda-credentials/nnn/input_sources/ (GET)
  • /api/eda/v1/credential_input_sources/ (CRUD)

The awx-plugins-core supports 10 different external systems, for parity we have added the schema for all 10 of them

  1. CyberArk Central Credential Provider Lookup
  2. AWS Secrets Manager lookup
  3. Microsoft Azure Key Vault
  4. Centrify Vault Credential Provider Lookup
  5. CyberArk Conjur Secrets Manager Lookup
  6. HashiCorp Vault Secret Lookup
  7. HashiCorp Vault Signed SSH
  8. Thycotic DevOps Secrets Vault
  9. Thycotic Secret Server
  10. GitHub App Installation Access Token Lookup

https://issues.redhat.com/browse/AAP-46900

flowchart TD;
    A[EDA UI] -->|Create Credential| B(EDA API);
    B --> C{AWX Plugins};
    C -->|Fetch/Test| D[fa:fa-vault Hashicorp];
    C -->|Fetch/Test| E[fa:fa-vault CyberArk];
    C -->|Fetch/Text| F[fa:fa-vault Azure];
Loading

@hsong-rh hsong-rh requested a review from a team as a code owner July 10, 2025 20:18
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jul 10, 2025

Codecov Report

❌ Patch coverage is 99.67638% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.14%. Comparing base (2b9eddb) to head (d2804c2).
⚠️ Report is 122 commits behind head on main.

Files with missing lines Patch % Lines
src/aap_eda/core/utils/credentials.py 97.29% 1 Missing ⚠️
src/aap_eda/services/project/scm.py 50.00% 1 Missing ⚠️
@@            Coverage Diff             @@
##             main    #1361      +/-   ##
==========================================
+ Coverage   93.94%   94.14%   +0.20%     
==========================================
  Files         324      335      +11     
  Lines       18951    19537     +586     
==========================================
+ Hits        17804    18394     +590     
+ Misses       1147     1143       -4     
Flag Coverage Δ
unit-int-tests-3.11 94.09% <99.67%> (+0.20%) ⬆️
unit-int-tests-3.12 94.14% <99.67%> (+0.20%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
src/aap_eda/analytics/utils.py 100.00% <100.00%> (ø)
src/aap_eda/api/exceptions.py 100.00% <100.00%> (ø)
src/aap_eda/api/filters/__init__.py 100.00% <100.00%> (ø)
src/aap_eda/api/filters/credential_input_source.py 100.00% <100.00%> (ø)
src/aap_eda/api/serializers/__init__.py 100.00% <100.00%> (ø)
src/aap_eda/api/serializers/activation.py 96.20% <100.00%> (+0.02%) ⬆️
...aap_eda/api/serializers/credential_input_source.py 100.00% <100.00%> (ø)
src/aap_eda/api/serializers/credential_type.py 100.00% <100.00%> (ø)
src/aap_eda/api/serializers/eda_credential.py 99.13% <100.00%> (+0.09%) ⬆️
src/aap_eda/api/urls.py 100.00% <100.00%> (ø)
... and 32 more

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@sonarqubecloud
Copy link
Copy Markdown

@hsong-rh
Copy link
Copy Markdown
Contributor Author

The e2e test failure will be handled by updating the API client on the eda-qa side after this has been merged.

@hsong-rh hsong-rh merged commit 1766604 into ansible:main Jul 21, 2025
6 of 7 checks passed
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 3, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 4, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 5, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 5, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 5, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 7, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 4 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info
  - credential_test
  - credential_type_test

[1] ansible/eda-server#1361
kaiokmo added a commit to kaiokmo/event-driven-ansible that referenced this pull request Aug 7, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 2 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info

As a bonus feature, we also implement the "test" functionality to
credential and credential_type, which essentially adds the support
to reach the test credential endpoints to check if a credential
is working as expected before actually creating the credential.

[1] ansible/eda-server#1361
kaiokmo added a commit to ansible/event-driven-ansible that referenced this pull request Aug 8, 2025
Based on eda-server PR 1361[1], now EDA allows credentials to link to
external Secret Management Systems (SMS), like Hashicorp Vault and
others.

To comply with the back-end functionality, this PR adds 2 new modules
to the collection:
  - credential_input_source
  - credential_input_source_info

We also implement the "test" functionality to
credential and credential_type, which essentially adds the support
to reach the test credential endpoints to check if a credential
is working as expected before actually creating the credential.

[1] ansible/eda-server#1361

Co-authored-by: Madhu Kanoor <mkanoor@redhat.com>
mkanoor added a commit to mkanoor/eda-server that referenced this pull request Aug 20, 2025
mkanoor added a commit that referenced this pull request Aug 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants