feat: add OwnerMigrationStore adapter for vault org_id migration#21691
feat: add OwnerMigrationStore adapter for vault org_id migration#21691prashantkumar1982 wants to merge 1 commit intodevelopfrom
Conversation
Add a transparent adapter layer (OwnerMigrationReadStore / OwnerMigrationWriteStore) that sits between the vault plugin and the KV store to handle the migration of secrets from workflow_owner-keyed entries to org_id-keyed entries. The adapter implements the same ReadKVStore / WriteKVStore interfaces and provides: - Dual-owner lookup on reads (org_id first, workflow_owner fallback) - Metadata merging and deduplication across both owners for list operations - org_id-based writes for all new/updated secrets - Lazy migration: deletes legacy workflow_owner entries on update - Dual-owner deletion with cleanup of both owners - Pass-through for pending queue operations (not owner-scoped) This is a standalone component (not wired into the plugin yet) with comprehensive unit tests covering all operations and migration scenarios.
|
👋 prashantkumar1982, thanks for creating this pull request! To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team. Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks! |
|
I see you updated files related to
|
|
✅ No conflicts with other open PRs targeting |
|
|
|
||
| var _ ReadKVStore = (*OwnerMigrationReadStore)(nil) | ||
|
|
||
| func NewOwnerMigrationReadStore(inner ReadKVStore, orgID, workflowOwner string) *OwnerMigrationReadStore { |
There was a problem hiding this comment.
I'm not sure how this would be transparent since this implies that we'll have one read store per owner/org ID. Atm we typically instantiate one readStore for every plugin function call
| } | ||
|
|
||
| // org_id entries take priority in deduplication. | ||
| addEntries(orgMd) |
There was a problem hiding this comment.
Is there a risk that the merged list will end up having more than the max allowed number of secrets?
2 participants
Summary
OwnerMigrationReadStoreandOwnerMigrationWriteStoreadapters incore/services/ocr2/plugins/vault/owner_migration_store.gothat implement the existingReadKVStore/WriteKVStoreinterfaces with transparent dual-owner (org_id / workflow_owner) migration logic.This is a standalone component in the JWT auth rollout plan — not wired into the plugin yet. No behavior change.