feat: add binary secret value support via ValueEncoding enum#375
Merged
Conversation
This was referenced Mar 19, 2026
jhrv
force-pushed
the
binary-secret-values
branch
from
81430b2 to
576e4c8
Compare
Add ValueEncoding enum (PLAIN_TEXT/BASE64) to GraphQL schema for secret values. Binary values are base64-encoded before storage and decoded on read. Detection uses utf8.Valid() on raw Kubernetes data to determine encoding on the read path. Updates both read paths (GetSecretValues, ViewSecretValues) and write paths (AddSecretValue, UpdateSecretValue) to handle encoding.
jhrv
force-pushed
the
binary-secret-values
branch
from
576e4c8 to
ab166a3
Compare
thokra-nav
approved these changes
Mar 19, 2026
| """ | ||
| Encoding of a secret or config value. | ||
| """ | ||
| enum ValueEncoding { |
Contributor
There was a problem hiding this comment.
Vi har ganske mange NoeValue... typer. Tenker vi at et generelt navn er helt i orden, at eller skulle vi vært pittelitt mer spesifikk ?
Contributor
Author
There was a problem hiding this comment.
Godt poeng! Navnet ValueEncoding er bevisst generelt fordi det skal gjenbrukes for config-verdier også (neste steg etter secrets). Men du har rett i at den ikke hørte hjemme i secret.graphqls — har nå flyttet den til workloads.graphqls der den lever som en delt type.
Add ValueEncoding enum (PLAIN_TEXT/BASE64) to GraphQL schema for secret values. Binary values are base64-encoded before storage and decoded on read. Detection uses utf8.Valid() on raw Kubernetes data to determine encoding on the read path. Updates both read paths (GetSecretValues, ViewSecretValues) and write paths (AddSecretValue, UpdateSecretValue) to handle encoding.
thokra-nav
reviewed
Mar 20, 2026
sechmann
reviewed
Mar 20, 2026
internal/workload/secret/models.go
Outdated
| return fmt.Errorf("enums must be strings") | ||
| } | ||
|
|
||
| *e = ValueEncoding(str) |
Contributor
There was a problem hiding this comment.
Denne burde kanskje ikke bli satt dersom det feiler?
tmp := ValueEncoding(str)
if tmp.IsValid() {
return fmt.Errorf("%s is not a valid ValueEncoding", str)
}
*e = tmp
return nil
eller noe sånt
Contributor
Author
There was a problem hiding this comment.
God catch! Fikset — bruker nå en tmp-variabel og setter bare *e hvis validering er OK.
Add ValueEncoding enum (PLAIN_TEXT/BASE64) to GraphQL schema for secret values. Binary values are base64-encoded before storage and decoded on read. Detection uses utf8.Valid() on raw Kubernetes data to determine encoding on the read path. Updates both read paths (GetSecretValues, ViewSecretValues) and write paths (AddSecretValue, UpdateSecretValue) to handle encoding.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds support for binary secret values (keystores, certificates, .p12 files) in the GraphQL API.
ValueEncodingenum (PLAIN_TEXT/BASE64) to the GraphQL schemaSecretValuetype now includes anencodingfieldSecretValueInputaccepts an optionalencodingfield (defaults toPLAIN_TEXT)utf8.Valid()on raw Kubernetes data to detect binary values — no annotations neededGetSecretValues) and elevated (ViewSecretValues) read paths updatedAddSecretValue,UpdateSecretValue) handles encoding/decodingRelated
Notes
The
ValueEncodingenum is intentionally named generically (notSecretValueEncoding) as it will be reused for config values.