feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider by felipeosantos · Pull Request #3895 · external-secrets/external-secrets

felipeosantos · 2024-09-09T15:02:58Z

Problem Statement

The Senhasegura provider has a feature to encrypt sensitive data when returning information. However, External Secrets does not decrypt this sensitive data when creating a secret in Kubernetes.

Related Issue

Feature #3582

Proposed Changes

Implemented a feature to decrypt sensitive data in External Secrets using a private key, designed in a way that allows other providers to also use this feature. Modified the External Secrets type to accept the configuration of a private key (specific to each provider), options such as encryption scheme, private key type, and hash algorithm.

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

felipeosantos · 2024-09-09T18:16:36Z

For testing, mock the attached files on Postman and apply the YAML configuration below. However, make sure to change the URL to your Postman mock first.
senhasegura-mock.postman_collection.json

---
apiVersion: v1
kind: Secret
metadata:
  name: senhasegura-dsm-auth
stringData:
  CLIENT_SECRET: "CHANGEME"
  # Optional, used only when sensitive data has been encrypted in senhasegura
  PRIVATE_KEY: |
    -----BEGIN PRIVATE KEY-----
    MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQChzs1R+jA3Goqi
    ropPzF4Ehpbi6VklbeZWP+RoU3rJshONJO6w9tPhbp0YIXrPSM9P5a9xaaNxDR9e
    u84O05+vq3C4P9I0jb5GSjiuznrmsprFWGaGdd4Vr7Fir1oqfeVc+znQFUCvkq7B
    EWobOonl6ktQ2OHBK0bEzXB7qY7P4ETI6owDUL+pkAwHzdnwk4sXMDKBLT3WZVRn
    xPppIJ4VAEph1fJOCIIskxVBh8cAT4QRxsdu8oB7cAuYJLBBKiS/GGIA7vh9sQrb
    +0BAgLqvy+kiQeQhYgF/Y/uVwkgAphFzSjSjoSFQ50nNE2VJA5J6o7QZ413DlIWr
    VJKNZJDbAgMBAAECggEAemklU5te1pExyJka8fu+NNZNWCUI2BQoaZ+0gGiHQAeE
    WwdRvHc/HBC+r/7EFgUTMXKmI7qzd1diIB0caoMXD6M3h2xg7nk9NZf5AeYbfGQq
    SpnyFk8dUHK2U94s7HCKEKnOtukdIrZplo5CI49Ju7JggC1TvPuscj6pliRUclYY
    Pc6pTVaG+bludDR8YkQ1mGi04wMQHpnisegRpMSjt9uZc1jKM7SSaHggu4/vuewo
    CFdra50/MjidIOXd5T5iVYY28J+gR8oCCKySTogNJ3JpNMNAW4FHfime5B+uS0IA
    YI/N8yjT/BPgRt4lQpR+6zi3fpguWNIM71xye1/R4QKBgQDNZNGFOntbFM2NTPYu
    4APRVu4a0gM+JEA/ozuxTigkgaj6dNeJvaNTxcKG0MmGxQLEcvgCDaWIoM6Qrj1K
    YVwdiv1MddRDdSHQjGjNM6n7jNfYVQ2gP+1wDwTMN+eyAW8KoZByaQimmjyBj/Ps
    C8VWPxyrw/UeHqzTazyEIZ2fHQKBgQDJrM2/xx7F63C6GaW+5gMeColxkdYb29Aw
    R3xb2rn5lVPLW0BORQQuepZuaI+ZLTb4Op7V4yAC/S9femFXpgkZa56aacwy1jxb
    R9WO0CWP3QCUCcIBF/4lbJDZ6gQLr51oahXhhjbgGMrlguC/j4R9n3i58EaeukeE
    +Hsu/hMWVwKBgETsWALFJS/jQzbvZI1GTwGoki4d20i3EXhJZnaRK5dUi0fAfbOT
    F4O9ERH8biPzaIJTsjW+LpYyoB6c2aRkF20yft1xjNE2NSquc1yowZnQIX5OzEvC
    KAM6hvmgqPdq08BVhwtdg7GkgDlZ/Rhwur++XfilwVNiJ8yqZ5xPS31hAoGBALnu
    hB5MMPXd86bPoHyYSMV4h3DaOGCkzpLERUXWKOGOp5tzfJzsikdjo68U3VcmVWiT
    ev7MkCXRUMyg4n/RRtBV5PqNkcJIu4qYdq5c/lRdN3xEZsVlXl0Yc49EbghsFx49
    uACdIZiHov/oItbZNRgwXzhl6mXKbceM4tzXR7evAoGBALug2beVoVAl2nAB2RkQ
    Jy3viDKO+C6Z82gsS5x9Wif9cJTppIarZC+t7w33f4WHJiYT1VDxse08dohC5Nn7
    7WWKdtLMSyUaXE46s37Kl5tkTkROj3wBzSIzwLYAwsthcpQVubwDAMsig8EUAdr/
    0IwaauEPX9lBYMZDMYuSAR5n
    -----END PRIVATE KEY-----
    
---
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: senhasegura
  namespace: default
spec:
  provider:
    senhasegura:
      auth:
        clientId: CHANGEME
        clientSecretSecretRef:
          key: CLIENT_SECRET
          name: senhasegura-dsm-auth
      ignoreSslCertificate: false
      module: DSM
      privateKeySecretRef:
        key: PRIVATE_KEY
        name: senhasegura-dsm-auth
      url: https://fe5d01a9-e201-4006-acd3-68e39030a70a.mock.pstmn.io
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: busybox-nexus-ms2
  namespace: default
spec:
  data:
    - remoteRef:
        key: dip_app-cripto_dev
        property: USER_01
      secretKey: OAM_APIGW_INT_USERNAME
    - remoteRef:
        decodingStrategy: Base64
        decryptingStrategy:
          scheme: RSA-OAEP
        key: dip_app-cripto_dev
        property: PASS_01
      secretKey: OAM_APIGW_INT_CLIENTID
  refreshInterval: 120s
  secretStoreRef:
    kind: SecretStore
    name: senhasegura
  target:
    name: busybox-nexus-ms2

Skarlso · 2024-09-18T05:42:22Z

Hmmm... So I can see the appeal of extending ExternalSecrets to use a decryption scheme, but honestly, I find this a premature optimization kind of approach? Like, NONE of the other providers have anything NEAR such a feature so extending the base type to do this seems overkill.

I would suggest expanding only the Senhasegura provider's type. We follow the least friction path here. Don't add if it's not needed. :) Meaning, we keep changes localised to providers. For example, even CAProvider additions was refactored only after several more providers where using it. Than it was standardised. If we see more than one provider needing decryption we'll add something for that. For now, please keep the changes local to Senhasegura. Thanks 🙇

felipeosantos · 2024-09-18T14:31:51Z

Ok, thanks for your feedback. I just wanted to explain my reasoning: changing the external secrets type to a decryption schema will impact other providers, even if they are not currently in use. However, this change will make it easier to implement similar functionality if other providers need it in the future. As a matter of fact, I will develop it in such a way that only senhasegura will have this feature. Regarding this change - decryptingStrategy: - remoteRef: conversionStrategy: Default decodingStrategy: Base64 decryptingStrategy: hash: SHA1 privateKeyType: PKCS8 scheme: RSA-OAEP key: dip_app-cripto_dev property: PASS_01 Do you have any considerations? I need to check if the property must be decrypted. Considering that only senhasegura has this feature, how could we define the type?

Skarlso · 2024-09-19T12:53:54Z

Considering that only senhasegura has this feature, how could we define the type?

These could be defined in the metadata section of the external secret object. And use a Key to define which key you are targeting with this setting.

So like, you could have a section as such:

metadata:
  decryption:
    keyname:
        decryptingStrategy:
          hash: SHA1
          privateKeyType: PKCS8
          scheme: RSA-OAEP
    anotherKeyName:
        decryptingStrategy:
          hash: SHA1
          privateKeyType: PKCS8
          scheme: RSA-OAEP

Doing this, the key would be the map key so you could lookup quickly if a decoding strategy is defined for a specific key.

This way, there is no need to change the ref type.

felipeosantos · 2024-09-19T13:48:06Z

Actually, there is a section in external secret types, wouldn't it be that?

How could I implement this in this case without the properties existing in the object? Is there already an example in the project for me to check?

Skarlso · 2024-09-20T12:22:46Z

ah, I honestly though that ES would have a metadata field similar to what PushSecret has. But I can see that it doesn't.

Okay, how about this. You could create a template method that can have certain arguments that let's you decode the given value?

And if you do that, that would be something that EVERY provider could use. :) WDYT?

Skarlso · 2024-09-21T08:55:47Z

Talked it over with the rest of the team, and the Template idea can be a really nice one to allow this feature for the other providers as well. :) 👍

felipeosantos · 2024-09-23T20:49:45Z

I implemented a new solution without the need to refactor other providers. I created a new interface that "extends" the v1beta1.SecretsClient interface. This way, only those who implement the new interface will have the feature to decrypt sensitive data. I will conduct new tests with another provider to see the behavior. WDYT?

Skarlso · 2024-09-24T10:23:51Z

But you are still extending remoteRef with a capability that is only supported by a single provider. 🤔

felipeosantos · 2024-09-24T13:02:54Z

The idea is to have it work like the base64 feature. In this process, I need this feature too. I honestly don't see any problem with this format; the only difference between these features is how the private key is retrieved by the provider. I will still need to understand how the template works to try implementing your suggestion

sonarqubecloud · 2024-10-01T22:23:48Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Skarlso · 2024-10-02T07:16:47Z

@felipeosantos Are you doing the template stuff then? :)

felipeosantos · 2024-10-02T11:51:30Z

Sorry, @Skarlso, but I still haven't had time to implement the template. However, in my company, we are already using many microservices with this format. I need to think about how to migrate to the template format as well. That's why I'm maintaining this fork. In fact, I intend to implement the template format ASAP. Do you prefer to close this PR, and I’ll open a new one when I implement the feature this way?

Skarlso · 2024-10-03T05:04:30Z

It's fine, you can leave this open and go from here I think.

github-actions · 2025-01-02T01:58:32Z

This pr is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.

felipeosantos · 2025-01-16T14:36:10Z

Hello @Skarlso, I will start an implementation with the template. Could you please remove the Stale tag?

Skarlso · 2025-01-16T14:40:05Z

Sure!

sonarqubecloud · 2025-02-18T02:35:23Z

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2025-04-01T12:19:13Z

Quality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

pkg/template/v2/template_test.go

…vanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

pkg/template/v2/_testdata/rsa_oaep_sha256_pkcs1.bin

…cryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

Skarlso · 2025-09-17T06:33:51Z

This looks okay now, I'm waiting for @felipeosantos to put that back that test with a different name and some explanation that it's not an exploit. :D

gusfcarvalho · 2025-09-17T09:28:29Z

IMO if this is an encrypted file only, it should be created as part of the test setup, and available only in memory.

… decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

felipeosantos · 2025-09-17T13:40:31Z

IMO if this is an encrypted file only, it should be created as part of the test setup, and available only in memory.

About the rsaDecrypt function unit test - it was implemented. But for the template function unit test, I used a similar approach that involved complex data (e.g., a PFX file), and in my case, purely encrypted data. However, if you prefer that I generate the data dynamically, I can do that without any problem - though it will involve writing some helper functions, which might make the template test more complex.

Skarlso · 2025-09-17T14:57:46Z

Hmmm, I don't know. I don't want an entire encryption suit in the tests just to test decryption. But I also don't really want a file that could potentially be flagged as insecure or malicious data just because it's unreadable and looks like garbage.

Argh. How much code would be involved with the encryption library? Because I also don't really want to " just test it in production " :D

gusfcarvalho · 2025-09-17T16:05:16Z

Hmmm, I don't know. I don't want an entire encryption suit in the tests just to test decryption. But I also don't really want a file that could potentially be flagged as insecure or malicious data just because it's unreadable and looks like garbage.

Argh. How much code would be involved with the encryption library? Because I also don't really want to " just test it in production " :D

counter argument to implement the helper functions needed - if something breaks / a user complain its not working, we have a contract test to refer to. It will be easier to simulate with "their data"

felipeosantos · 2025-09-17T18:38:15Z

Hmmm, I don't know. I don't want an entire encryption suit in the tests just to test decryption. But I also don't really want a file that could potentially be flagged as insecure or malicious data just because it's unreadable and looks like garbage.
Argh. How much code would be involved with the encryption library? Because I also don't really want to " just test it in production " :D

counter argument to implement the helper functions needed - if something breaks / a user complain its not working, we have a contract test to refer to. It will be easier to simulate with "their data"

I will adjust this point.

Skarlso · 2025-09-23T05:03:29Z

@felipeosantos Please ping me when I can continue.

… decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

felipeosantos · 2025-09-23T05:36:22Z

@felipeosantos Please ping me when I can continue.

Done!

sonarqubecloud · 2025-09-23T10:40:03Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Skarlso · 2025-09-24T07:36:27Z

Thank you so much for all the effort you've put into this!

…a Devops Secrets Management (DSM) provider (external-secrets#3895) * Initial Commit Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * Building an RSA-Based Sensitive Data Decryption Feature with Advanced Templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * reviewable: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * chore(license): building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: remove bin data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> --------- Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Olumide Ogundele <olumideralph@gmail.com>

* chore(lint): fix revive lint errors in providers package Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> * feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider (#3895) * Initial Commit Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * Building an RSA-Based Sensitive Data Decryption Feature with Advanced Templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * reviewable: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * chore(license): building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: remove bin data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> --------- Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> * chore(lint): fix dot error Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> --------- Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Gergely Brautigam <skarlso777@gmail.com> Co-authored-by: Felipe Oliveira <felipeoliveira.s.br@gmail.com> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com>

…a Devops Secrets Management (DSM) provider (external-secrets#3895) * Initial Commit Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * Building an RSA-Based Sensitive Data Decryption Feature with Advanced Templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * reviewable: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * chore(license): building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: remove bin data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> --------- Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Samuel Molling <samuelmolling@gmail.com>

…ts#5362) * chore(lint): fix revive lint errors in providers package Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> * feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider (external-secrets#3895) * Initial Commit Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * Building an RSA-Based Sensitive Data Decryption Feature with Advanced Templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * reviewable: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * chore(license): building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: remove bin data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> --------- Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> * chore(lint): fix dot error Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> --------- Signed-off-by: Olumide Ogundele <olumideralph@gmail.com> Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com> Signed-off-by: Gergely Brautigam <skarlso777@gmail.com> Co-authored-by: Felipe Oliveira <felipeoliveira.s.br@gmail.com> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Samuel Molling <samuelmolling@gmail.com>

felipeosantos requested a review from a team as a code owner September 9, 2024 15:02

felipeosantos requested a review from gusfcarvalho September 9, 2024 15:02

felipeosantos changed the title ~~Add support for decryption scheme from properties on senhasegura DevOps Secrets Management (DSM) provider~~ Add Support for Decryption Scheme from Properties in senhasegura DevOps Secrets Management (DSM) Provider Sep 9, 2024

felipeosantos force-pushed the main branch from bda6232 to 57f15d9 Compare September 9, 2024 15:37

Skarlso self-assigned this Sep 18, 2024

felipeosantos force-pushed the main branch 3 times, most recently from 9b32e72 to 092914a Compare September 23, 2024 20:20

felipeosantos changed the title ~~Add Support for Decryption Scheme from Properties in senhasegura DevOps Secrets Management (DSM) Provider~~ feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider Oct 2, 2024

github-actions bot added the Stale This issue/Pull Request is stale and will be automatically closed label Jan 2, 2025

Skarlso removed the Stale This issue/Pull Request is stale and will be automatically closed label Jan 16, 2025

Skarlso reviewed Sep 13, 2025

View reviewed changes

pkg/template/v2/template_test.go Outdated Show resolved Hide resolved

felipeosantos added 3 commits September 14, 2025 17:50

Merge branch 'external-secrets:main' into main

7036b74

test: building an rsa-based sensitive data decryption feature with ad…

cc40306

…vanced templating v2 Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

Merge branch 'external-secrets:main' into main

18c9b07

Skarlso reviewed Sep 15, 2025

View reviewed changes

pkg/template/v2/_testdata/rsa_oaep_sha256_pkcs1.bin Outdated Show resolved Hide resolved

test: remove bin data test on building an rsa-based sensitive data de…

31693a1

…cryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

felipeosantos added 2 commits September 17, 2025 09:14

Merge branch 'external-secrets:main' into main

71c2e20

test: add encrypted data test on building an rsa-based sensitive data…

525224e

… decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

Merge branch 'external-secrets:main' into main

cfd8e7a

test: add encrypted data test on building an rsa-based sensitive data…

a004fd7

… decryption feature Signed-off-by: Felipe Oliveira dos Santos <felipeoliveira.s.br@gmail.com>

Merge branch 'external-secrets:main' into main

aeda524

Skarlso approved these changes Sep 24, 2025

View reviewed changes

Skarlso merged commit de30360 into external-secrets:main Sep 24, 2025
26 checks passed

budimanjojo mentioned this pull request Dec 7, 2025

getSecretKey template function shouldn't exist #5690

Closed

GoVulnBot mentioned this pull request Jan 20, 2026

x/vulndb: potential Go vuln in github.com/external-secrets/external-secrets: GHSA-77v3-r3jw-j2v2 golang/vulndb#4330

Closed

evrardj-roche mentioned this pull request Jan 27, 2026

Add support for decryption scheme from properties on senhasegura DevOps Secrets Management (DSM) provider #3582

Closed

Uh oh!

Conversation

felipeosantos commented Sep 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Checklist

Uh oh!

felipeosantos commented Sep 9, 2024

Uh oh!

Skarlso commented Sep 18, 2024

Uh oh!

felipeosantos commented Sep 18, 2024 via email • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 19, 2024

Uh oh!

felipeosantos commented Sep 19, 2024

Uh oh!

Skarlso commented Sep 20, 2024

Uh oh!

Skarlso commented Sep 21, 2024

Uh oh!

felipeosantos commented Sep 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 24, 2024

Uh oh!

felipeosantos commented Sep 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Oct 1, 2024

Quality Gate passed

Uh oh!

Skarlso commented Oct 2, 2024

Uh oh!

felipeosantos commented Oct 2, 2024

Uh oh!

Skarlso commented Oct 3, 2024

Uh oh!

github-actions bot commented Jan 2, 2025

Uh oh!

felipeosantos commented Jan 16, 2025

Uh oh!

Skarlso commented Jan 16, 2025

Uh oh!

sonarqubecloud bot commented Feb 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Quality Gate passed

Uh oh!

sonarqubecloud bot commented Apr 1, 2025

Quality Gate failed

Uh oh!

Uh oh!

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

gusfcarvalho commented Sep 17, 2025

Uh oh!

felipeosantos commented Sep 17, 2025

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

gusfcarvalho commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

felipeosantos commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 23, 2025

Uh oh!

felipeosantos commented Sep 23, 2025

Uh oh!

sonarqubecloud bot commented Sep 23, 2025

Quality Gate passed

Uh oh!

Uh oh!

Skarlso commented Sep 24, 2025

Uh oh!

felipeosantos commented Sep 9, 2024 •

edited

Loading

felipeosantos commented Sep 18, 2024 via email •

edited

Loading

felipeosantos commented Sep 23, 2024 •

edited

Loading

felipeosantos commented Sep 24, 2024 •

edited

Loading

sonarqubecloud bot commented Feb 18, 2025 •

edited

Loading

gusfcarvalho commented Sep 17, 2025 •

edited

Loading

felipeosantos commented Sep 17, 2025 •

edited

Loading