Secrets Test Data

Seeds the Secrets API with test keepers and secure values for local development.

Quick Start

bash

# 1. Start Grafana with enterprise and feature flags
make enterprise-dev
GF_FEATURE_TOGGLES_secretsManagementAppPlatformUI=true GF_FEATURE_TOGGLES_secretsManagementAppPlatform=true GF_FEATURE_TOGGLES_secretsKeeperUI=true make run

# 2. Seed test data
cd devenv/secrets && go run secrets.go

The script creates keepers and secure values via Grafana's HTTP API. Resources are prefixed with gdev- so they can be cleanly removed later.

Usage

bash

go run secrets.go                    # Seed from secrets-config.yaml
go run secrets.go -generate 50       # Generate 50 keepers + 50 secrets for load testing
go run secrets.go -clean             # Remove all gdev- prefixed resources
go run secrets.go -test              # Run built-in self-tests (no server required)
go run secrets.go -help              # Show all flags

What Gets Created

Keepers:

Name	Type	Region
gdev-aws-production	AWS	us-east-1
gdev-aws-staging	AWS	eu-west-1

Secure Values:

Name	Description
gdev-database-password	Production database password
gdev-api-key	External monitoring service API key

Configuration

Edit secrets-config.yaml to add or modify test data. The keeper config structure mirrors the backend Go types at apps/secret/pkg/apis/secret/v1beta1/keeper_spec_gen.go.

yaml

keepers:
  my-keeper:
    description: My test keeper
    aws:
      region: us-west-2
      assumeRoleArn: arn:aws:iam::123:role/test
      externalID: my-external-id

secureValues:
  my-secret:
    description: A test secret
    value: super-secret
    decrypters:
      - secrets-manager-testing
    labels:
      env: test

Every keeper must have a provider config (e.g., aws). The "system" keeper type is built-in and cannot be created via the API.

Environment Variables

Variable	Default	Description
`GRAFANA_URL`	`http://localhost:3000`	Grafana base URL
`GRAFANA_USER`	`admin`	Grafana username
`GRAFANA_PASSWORD`	`admin`	Grafana password
`GRAFANA_NAMESPACE`	`default`	K8s namespace

Troubleshooting

"Could not reach Grafana"

Make sure Grafana is running. The script connects to http://localhost:3000 by default.

"Secrets API not found (HTTP 404)"

The Grafana server is running but the Secrets API is not available. This can happen if make run was started without the required feature flags, or if the secrets API server needs to be started separately.

If make run alone doesn't start the API server, you can run it manually:

bash

# Start the database
make devenv sources="mt-db"

# Start the API server
CFG_secret_key__v1__secret_key=hunter2 go run -tags "enterprise" ./pkg/cmd/grafana apiserver \
  --skip-auth=true \
  --runtime-config secret.grafana.app/v1beta1=true \
  --secure-port=6443 \
  --database.servers="default=superuser:password@tcp(localhost:13306)/secret_grafana_app" \
  --database.max_idle_conn=5 \
  --database.max_open_conn=5 \
  --database.conn_max_lifetime=14400 \
  --grafana.secrets-manager.encryption.provider=secret_key.v1

For more advanced setups (auth, port-forwarding, gRPC), see: grafana-enterprise/src/pkg/extensions/apiserver/dev-docs/secrets.md

"Authentication failed (HTTP 401/403)"

Check that GRAFANA_USER and GRAFANA_PASSWORD are correct (defaults: admin/admin), and that the user has the "Secrets Manager" role in Administration > Users.