Add Servercore provider (servercore) for vals #900

Eug1n1 · 2025-12-01T19:46:04Z

Summary:

Introduces a new provider servercore to fetch secrets from Servercore Secrets Manager.

Auth

Required environment variables:
SERVERCORE_USERNAME
SERVERCORE_PASSWORD
SERVERCORE_ACCOUNT_ID
SERVERCORE_PROJECT_NAME

URI formats:

Fetch string secret:

ref+servercore://SECRET_NAME

Fetch a leaf value from JSON/YAML secret:

ref+servercore://SECRET_NAME#/path/to/leaf

Examples

CLI:

vals get 'ref+servercore://my-json'
vals get 'ref+servercore://my-json#/baz/mykey'

Notes

API returns a base64 string in version.value; provider decodes it, then parses JSON (YAML fallback).

Docs

Servercore Secrets API: https://docs.servercore.com/api/secrets-manager-secrets/

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Copilot

Pull request overview

This PR adds a new Servercore provider to vals, enabling users to retrieve secrets from Servercore Secrets Manager. The implementation follows the established pattern of other vals providers with authentication via environment variables and support for both string and structured (JSON/YAML) secret retrieval.

Key changes:

Adds a new servercore provider with HTTP-based authentication and secret retrieval
Integrates the provider into the vals runtime with the ref+servercore:// URI scheme
Documents the provider usage, authentication requirements, and URI formats in the README

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
vals.go	Registers the new Servercore provider constant and integrates it into the provider factory
pkg/providers/servercore/servercore.go	Implements the core provider with HTTP client, token-based auth with retry logic, and GetString/GetStringMap methods
pkg/providers/servercore/servercore_helpers.go	Defines auth payload structures and environment variable helpers for credentials
README.md	Documents the Servercore provider with authentication requirements, URI formats, examples, and API reference

pkg/providers/servercore/servercore.go

pkg/providers/servercore/servercore_helpers.go

README.md

pkg/providers/servercore/servercore.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Eug1n1 · 2025-12-18T11:07:15Z

pls, let me know if i did something wrong

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

pkg/providers/servercore/servercore.go

README.md

pkg/providers/servercore/servercore.go

README.md

pkg/providers/servercore/servercore.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

…th section Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

README.md

Copilot · 2025-12-24T00:40:08Z

README.md

 ref+httpjson://api.github.com/users/helmfile/repos?floatAsInt=true#///*[1]/id
 ```

+### Servercore secret manager


The section header should use title case for "Secret Manager" to match the capitalization pattern used in other provider section headers (e.g., "Scaleway Secret Manager" on line 1104). Change "secret manager" to "Secret Manager" for consistency.

Suggested change

### Servercore secret manager

### Servercore Secret Manager

Copilot · 2025-12-24T00:40:09Z

pkg/providers/servercore/servercore.go

+package servercore
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"gopkg.in/yaml.v3"
+
+	"github.com/helmfile/vals/pkg/api"
+	"github.com/helmfile/vals/pkg/log"
+)
+
+const (
+	AuthURL        = "https://cloud.api.servercore.com/identity/v3/auth/tokens"
+	SecretBaseURL  = "https://cloud.api.servercore.com/secrets-manager/v1/"
+	usernameEnv    = "SERVERCORE_USERNAME"
+	passwordEnv    = "SERVERCORE_PASSWORD"
+	accountIDEnv   = "SERVERCORE_ACCOUNT_ID"
+	projectNameEnv = "SERVERCORE_PROJECT_NAME"
+)
+
+var (
+	ErrNotFound     = errors.New("secret not found")
+	ErrUnauthorized = errors.New("unauthorized")
+	ErrForbidden    = errors.New("forbidden")
+)
+
+type provider struct {
+	logger   *log.Logger
+	client   *http.Client
+	tokenErr error
+	token    string
+}
+
+func New(l *log.Logger, cfg api.StaticConfig) *provider {
+	// cfg is accepted to satisfy the provider interface; this provider relies solely on
+	// environment variables (e.g., SERVERCORE_* env vars) for configuration.
+	client := &http.Client{Timeout: 10 * time.Second}
+
+	p := &provider{
+		logger: l,
+		client: client,
+	}
+
+	// Acquire token during initialization (token is valid for 24 hours)
+	p.logger.Debugf("servercore: acquiring token during initialization")
+	token, err := p.acquireToken()
+	if err != nil {
+		p.tokenErr = err
+		p.logger.Debugf("servercore: failed to acquire token: %v", err)
+	} else {
+		p.token = token
+		p.logger.Debugf("servercore: provider initialized with token")
+	}
+
+	return p
+}
+
+func (p *provider) getToken() (string, error) {
+	if p.tokenErr != nil {
+		return "", p.tokenErr
+	}
+	return p.token, nil
+}
+
+func (p *provider) acquireToken() (string, error) {
+	envs, err := newAuthEnv()
+	if err != nil {
+		return "", err
+	}
+
+	payload := newAuthPayload(envs.Username, envs.Password, envs.AccountID, envs.ProjectName)
+
+	p.logger.Debugf("servercore: auth request")
+	hdr, err := p.sendJSON(http.MethodPost, AuthURL, nil, payload, nil, http.StatusCreated)
+	if err != nil {
+		return "", fmt.Errorf("servercore: auth request failed: %w", err)
+	}
+
+	token := hdr.Get("X-Subject-Token")
+	if token == "" {
+		return "", fmt.Errorf("servercore: missing X-Subject-Token")
+	}
+
+	p.logger.Debugf("servercore: auth success")
+	return token, nil
+}
+
+func (p *provider) sendJSONWithAuth(method string, url string, in any, out any, successStatus int) (http.Header, error) {
+	token, err := p.getToken()
+	if err != nil {
+		return nil, fmt.Errorf("servercore: auth error: %w", err)
+	}
+	headers := map[string]string{"X-Auth-Token": token}
+	p.logger.Debugf("servercore: request with auth: %s %s", method, url)
+	hdr, err := p.sendJSON(method, url, headers, in, out, successStatus)
+	if err != nil {
+		p.logger.Debugf("servercore: request failed: %s %s: %v", method, url, err)
+		return nil, err
+	}
+
+	p.logger.Debugf("servercore: request ok: %s %s", method, url)
+	return hdr, nil
+}
+
+func (p *provider) sendJSON(method string, url string, headers map[string]string, in any, out any, successStatus int) (http.Header, error) {
+	var body io.Reader
+	if in != nil {
+		b, err := json.Marshal(in)
+		if err != nil {
+			return nil, fmt.Errorf("servercore: marshal: %w", err)
+		}
+		body = bytes.NewReader(b)
+	}
+
+	p.logger.Debugf("servercore: sending request: %s %s", method, url)
+	req, err := http.NewRequest(method, url, body)
+	if err != nil {
+		return nil, fmt.Errorf("servercore: request: %w", err)
+	}
+	if in != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept", "application/json")
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("servercore: do: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	switch resp.StatusCode {
+	case http.StatusNotFound:
+		p.logger.Debugf("servercore: response status 404 for %s %s", method, url)
+		return nil, ErrNotFound
+	case http.StatusUnauthorized:
+		p.logger.Debugf("servercore: response status 401 for %s %s", method, url)
+		return nil, ErrUnauthorized
+	case http.StatusForbidden:
+		p.logger.Debugf("servercore: response status 403 for %s %s", method, url)
+		return nil, ErrForbidden
+	case successStatus:
+		p.logger.Debugf("servercore: response status %d for %s %s", resp.StatusCode, method, url)
+	default:
+		p.logger.Debugf("servercore: response unexpected status %d for %s %s", resp.StatusCode, method, url)
+		return nil, fmt.Errorf("servercore: unexpected status %d", resp.StatusCode)
+	}
+
+	if out != nil {
+		if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+			return resp.Header, fmt.Errorf("servercore: json decode: %w", err)
+		}
+	} else {
+		_, _ = io.Copy(io.Discard, resp.Body)
+	}
+	return resp.Header, nil
+}
+
+func (p *provider) GetString(key string) (string, error) {
+	p.logger.Debugf("servercore: get string for secret=%s", key)
+	secretURL, err := url.JoinPath(SecretBaseURL, key)
+	if err != nil {
+		return "", fmt.Errorf("servercore: error generating secret url: %w", err)
+	}
+
+	var response secretResp
+	if _, err := p.sendJSONWithAuth(http.MethodGet, secretURL, nil, &response, http.StatusOK); err != nil {
+		return "", err
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(response.Version.Value)
+	if err != nil {
+		return "", fmt.Errorf("servercore: b64 decode: %w", err)
+	}
+
+	p.logger.Debugf("servercore: get string ok for secret=%s", key)
+	return string(decoded), nil
+}
+
+func (p *provider) GetStringMap(key string) (map[string]any, error) {
+	p.logger.Debugf("servercore: get map for secret=%s", key)
+	value, err := p.GetString(key)
+	if err != nil {
+		return nil, fmt.Errorf("servercore: get string: %w", err)
+	}
+
+	m := make(map[string]any)
+	if jerr := json.Unmarshal([]byte(value), &m); jerr != nil {
+		p.logger.Debugf("servercore: json decode failed for secret=%s, trying yaml", key)
+		// Fallback to YAML
+		if yerr := yaml.Unmarshal([]byte(value), &m); yerr != nil {
+			return nil, fmt.Errorf("servercore: failed to decode secret as JSON or YAML: json error: %v, yaml error: %w", jerr, yerr)
+		}
+	}
+
+	p.logger.Debugf("servercore: get map ok for secret=%s", key)
+	return m, nil
+}


This new provider lacks test coverage. The repository follows a pattern where providers have corresponding test files (e.g., vals_scaleway_test.go, vals_httpjson_test.go). Consider adding a vals_servercore_test.go file to test the provider's functionality, including authentication, secret retrieval, and error handling scenarios.

Copilot · 2025-12-24T00:40:09Z

pkg/providers/servercore/servercore.go

+	// Acquire token during initialization (token is valid for 24 hours)
+	p.logger.Debugf("servercore: acquiring token during initialization")
+	token, err := p.acquireToken()
+	if err != nil {
+		p.tokenErr = err
+		p.logger.Debugf("servercore: failed to acquire token: %v", err)
+	} else {
+		p.token = token
+		p.logger.Debugf("servercore: provider initialized with token")
+	}
+
+	return p
+}
+
+func (p *provider) getToken() (string, error) {
+	if p.tokenErr != nil {
+		return "", p.tokenErr
+	}
+	return p.token, nil
+}


The authentication token is acquired once during provider initialization and stored for the lifetime of the provider instance. According to the comment on line 52, the token is valid for 24 hours. However, there is no mechanism to refresh the token when it expires. If vals runs for more than 24 hours or if the provider is used after the token expires, all requests will fail with authorization errors. Consider implementing token refresh logic that checks token expiration and reacquires it when necessary, or handle 401 Unauthorized responses by refreshing the token and retrying the request.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Eug1n1 requested review from itscaro, mumoshu, xiaomudk and yxxhero as code owners December 1, 2025 19:46

Eug1n1 added 5 commits December 1, 2025 22:48

feat(servercore): add servercore provider

5c5f783

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

feat(servercore): add helpers, refactoring

6913b31

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

feat(servercore): add yaml parsing, refactoring

79459b7

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

feat(servercore): update readme

bab6b46

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

feat(servercore): add debug logging

644354d

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Eug1n1 force-pushed the feat/servercore-provider branch from ea529c9 to 644354d Compare December 1, 2025 19:49

feat(servercore): fix linter issues

d7b85fc

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

yxxhero requested a review from Copilot December 7, 2025 23:21

Copilot started reviewing on behalf of yxxhero December 7, 2025 23:21 View session

Copilot AI reviewed Dec 7, 2025

View reviewed changes

Eug1n1 and others added 4 commits December 8, 2025 11:22

feat(servercore): fix typo

7603639

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

feat(servercore): prevent token race conditions

ec30d25

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

refactor(servercore): fix constant naming

4ae1c7b

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

refactor(servercore): rename secretUrl to secretURL

2806b01

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Eug1n1 force-pushed the feat/servercore-provider branch from 76d8cac to 2806b01 Compare December 8, 2025 08:32

style(servercore): fix gci formatting

e3ba173

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

yxxhero requested a review from Copilot December 20, 2025 03:03

Copilot started reviewing on behalf of yxxhero December 20, 2025 03:03 View session

Copilot AI reviewed Dec 20, 2025

View reviewed changes

Eug1n1 and others added 2 commits December 20, 2025 17:56

Apply suggestions from code review

eec635a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

fix(servercore): servercore readme section moved behind yc lockbox au…

e1ac8dd

…th section Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

Eug1n1 force-pushed the feat/servercore-provider branch from 07fe9b6 to e1ac8dd Compare December 20, 2025 15:00

refactor(servercore): simplify servercore token acquisition

867effb

Signed-off-by: Shumskiy Evgeniy <vkzheny@gmail.com>

yxxhero requested a review from Copilot December 24, 2025 00:32

Copilot started reviewing on behalf of yxxhero December 24, 2025 00:33 View session

Copilot AI reviewed Dec 24, 2025

View reviewed changes

yxxhero and others added 2 commits December 24, 2025 08:41

Update README.md

18c8bb2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

72ca703

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

yxxhero merged commit 16e8792 into helmfile:main Dec 24, 2025
5 checks passed

BrewTestBot mentioned this pull request Dec 29, 2025

vals 0.43.0 Homebrew/homebrew-core#260574

Merged

Add Servercore provider (servercore) for vals #900

Add Servercore provider (servercore) for vals #900

Conversation

Eug1n1 commented Dec 1, 2025

Summary:

Auth

URI formats:

Examples

CLI:

Notes

Docs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Eug1n1 commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 24, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 24, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants