feat: add SecretsConfig proto for encrypted env vars by Flo4604 · Pull Request #4451 · unkeyed/unkey

Flo4604 · 2025-12-02T13:40:50Z

What does this PR do?

This adds a new protobuf so we can snapshot the env vars.

it's a protobuf so we can maybe in the future extend it if we want too with other information e.g who created / edited it last whatever.

Type of change

Bug fix (non-breaking change which fixes an issue)
Chore (refactoring code, technical debt, workflow improvements)
Enhancement (small improvements)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How should this be tested?

Not at all.

Checklist

Required

Appreciated

If a UI change was made: Added a screen recording or screenshots to this PR
Updated the Unkey Docs if changes were necessary

changeset-bot · 2025-12-02T13:40:54Z

⚠️ No Changeset found

Latest commit: 1f4644b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-12-02T13:40:55Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
dashboard	Error			Dec 9, 2025 4:14pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
engineering	Ignored	Preview		Dec 9, 2025 4:14pm

coderabbitai · 2025-12-02T13:40:55Z

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

Adds a new protobuf definition file for control-plane secrets management. Introduces the SecretsConfig message with a single map field to store encrypted secret key-value pairs, representing environment variables snapshotted at deployment time.

Changes

Cohort / File(s)	Change Summary
Protobuf Secrets Data Model `go/proto/ctrl/v1/secrets.proto`	New file. Defines `SecretsConfig` message in `ctrl.v1` package with `map<string, string> secrets` field for storing encrypted environment variables.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Simple protobuf message definition with minimal logic
Single new file with straightforward data structure (one map field)
No control flow or complex interactions to review

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat/env-vars-secrets-proto

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 14cf21b and 1f4644b.

⛔ Files ignored due to path filters (2)

apps/dashboard/gen/proto/ctrl/v1/secrets_pb.ts is excluded by !**/gen/**
go/gen/proto/ctrl/v1/secrets.pb.go is excluded by !**/*.pb.go, !**/gen/**

📒 Files selected for processing (1)

go/proto/ctrl/v1/secrets.proto (1 hunks)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Flo4604 · 2025-12-02T13:41:06Z

Flo4604 · 2025-12-02T20:14:07Z

@coderabbitai review

coderabbitai · 2025-12-02T20:14:13Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

go/proto/ctrl/v1/secrets.proto

* feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com>

* feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too * add inital webhook stuff * add generated stuff * adjust comments * use otel lgtm stack in k8s too * fix some rabbit comments * fix some rabbit comments * get rid of some unncessary comments * actually add unkey env cmd gitignores... * fix golint issues * Fix/update validation issues status label (#4478) * fix: update API key status label from 'Potential issues' to 'High Error Rate' Changed the validation-issues status label to more clearly communicate that the key is receiving invalid requests, rather than implying the API or key itself is broken. Changes: - Label: 'Potential issues' → 'High Error Rate' - Tooltip: Updated to clarify that requests are invalid (rate limited, unauthorized, etc.) rather than suggesting system issues Fixes #4474 * chore: apply biome formatting * fix: update status label to 'Elevated Rejections' per review --------- Co-authored-by: CodeReaper <148160799+MichaelUnkey@users.noreply.github.com> * chore: Remove un-used UI components (#4472) * removed un used components * updated members refs --------- Co-authored-by: James P <james@unkey.dev> Co-authored-by: Andreas Thomas <dev@chronark.com> * perf: fix n+1 (#4484) * fix: add 403 error when 0 key verification perms (#4483) * fix: add 403 error when 0 key verification perms * cleanup tests * feat: add environment variables db schema and queries (#4450) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars (#4451) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * feat: add GetPullToken * feat: dashboard UI for environment variables management (#4452) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * feat: decrypt env vars in CTRL workflow before passing to Krane (#4453) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * feat: inject env vars into pod spec via Krane (#4454) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * feat: add customer-workload service account for pod isolation (#4455) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * remove gw from k8s manifest, add agent fix ctrl vault for certs (#4463) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * chore: Make Stripe Great Again (#4479) * fix: Make stripe webhooks more robust * chore: Move alert to UI (#4485) * Moved alert to ui and swapped usages * feat: better env var injection (#4468) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too * add inital webhook stuff * add generated stuff * adjust comments * use otel lgtm stack in k8s too * fix some rabbit comments * fix some rabbit comments * get rid of some unncessary comments * actually add unkey env cmd gitignores... * fix golint issues (#4477) * [autofix.ci] apply automated fixes * fix fmt * linter be happy --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <dev@chronark.com> * make token pod owned * feat: add lets encrypt challenges (#4471) * feat: add lets encrypt challenges * always disable cname following * cleanup some code * cleanup some code * cleanup some code * cleanup some code * cleanup some code * fix golint issues * fix golint issues * fmt * remove old webhook code * remove old webhook code * make build id not optiona * cleanup * cleanup * fmt * fmt --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: abhay <88815641+theabhayprajapati@users.noreply.github.com> Co-authored-by: CodeReaper <148160799+MichaelUnkey@users.noreply.github.com> Co-authored-by: James P <james@unkey.dev> Co-authored-by: Andreas Thomas <dev@chronark.com>

Flo4604 mentioned this pull request Dec 2, 2025

feat: add environment variables db schema and queries #4450

Merged

19 tasks

vercel bot temporarily deployed to Preview – engineering December 2, 2025 13:41 Inactive

vercel bot temporarily deployed to Preview – dashboard December 2, 2025 13:44 Inactive

Flo4604 marked this pull request as ready for review December 2, 2025 13:51

Flo4604 requested review from MichaelUnkey, chronark, imeyer, mcstepp, ogzhanolguncu and perkinsjr as code owners December 2, 2025 13:51

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from 1da92f7 to bea9bf0 Compare December 2, 2025 20:14

Flo4604 force-pushed the feat/env-vars-db-schema branch from 434bc89 to d7c4696 Compare December 2, 2025 20:14

vercel bot temporarily deployed to Preview – engineering December 2, 2025 20:15 Inactive

vercel bot temporarily deployed to Preview – dashboard December 2, 2025 20:19 Inactive

chronark reviewed Dec 3, 2025

View reviewed changes

go/proto/ctrl/v1/secrets.proto Show resolved Hide resolved

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from d9f779c to bea9bf0 Compare December 3, 2025 11:10

vercel bot temporarily deployed to Preview – dashboard December 3, 2025 11:12 Inactive

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from ff4e2a8 to bea9bf0 Compare December 3, 2025 11:17

vercel bot temporarily deployed to Preview – dashboard December 3, 2025 11:19 Inactive

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from 8c2cd78 to bea9bf0 Compare December 3, 2025 11:20

vercel bot temporarily deployed to Preview – dashboard December 3, 2025 11:22 Inactive

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from 819d12d to bea9bf0 Compare December 3, 2025 13:07

Flo4604 mentioned this pull request Dec 3, 2025

remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

Merged

19 tasks

vercel bot temporarily deployed to Preview – dashboard December 3, 2025 13:09 Inactive

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from 138639d to bea9bf0 Compare December 3, 2025 13:10

vercel bot temporarily deployed to Preview – dashboard December 3, 2025 13:12 Inactive

Flo4604 mentioned this pull request Dec 3, 2025

feat: better env var injection #4468

Merged

19 tasks

Flo4604 force-pushed the feat/env-vars-db-schema branch from d7c4696 to b875df9 Compare December 4, 2025 09:51

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from e1948a4 to 849b2de Compare December 4, 2025 09:51

vercel bot temporarily deployed to Preview – engineering December 4, 2025 09:52 Inactive

vercel bot temporarily deployed to Preview – dashboard December 4, 2025 09:52 Inactive

Flo4604 and others added 4 commits December 4, 2025 18:36

feat: add environment variables db schema and queries

405ea48

fix db query

5b0249e

feat: add SecretsConfig proto for encrypted env vars

60f228c

[autofix.ci] apply automated fixes

ac29218

Flo4604 force-pushed the feat/env-vars-secrets-proto branch from 849b2de to ac29218 Compare December 4, 2025 17:36

Flo4604 force-pushed the feat/env-vars-db-schema branch from b875df9 to 5b0249e Compare December 4, 2025 17:36

vercel bot temporarily deployed to Preview – engineering December 4, 2025 17:37 Inactive

vercel bot temporarily deployed to Preview – dashboard December 4, 2025 17:40 Inactive

Flo4604 mentioned this pull request Dec 4, 2025

fix golint issues #4477

Merged

19 tasks

Base automatically changed from feat/env-vars-db-schema to main December 9, 2025 16:10

Merge branch 'main' into feat/env-vars-secrets-proto

1f4644b

chronark merged commit 8f019c4 into main Dec 9, 2025
7 of 10 checks passed

chronark deleted the feat/env-vars-secrets-proto branch December 9, 2025 16:11

vercel bot temporarily deployed to Preview – dashboard December 9, 2025 16:14 Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add SecretsConfig proto for encrypted env vars#4451

feat: add SecretsConfig proto for encrypted env vars#4451
chronark merged 5 commits intomainfrom
feat/env-vars-secrets-proto

Flo4604 commented Dec 2, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

vercel bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 2, 2025 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Uh oh!

Flo4604 commented Dec 2, 2025 •

edited

Loading

Uh oh!

Flo4604 commented Dec 2, 2025

Uh oh!

coderabbitai bot commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Flo4604 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Type of change

How should this be tested?

Checklist

Required

Appreciated

Uh oh!

changeset-bot bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Uh oh!

Flo4604 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Flo4604 commented Dec 2, 2025

Uh oh!

coderabbitai bot commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Flo4604 commented Dec 2, 2025 •

edited

Loading

changeset-bot bot commented Dec 2, 2025 •

edited

Loading

vercel bot commented Dec 2, 2025 •

edited

Loading

coderabbitai bot commented Dec 2, 2025 •

edited

Loading

Flo4604 commented Dec 2, 2025 •

edited

Loading