Skip to content

Commit 349a1ba

Browse files
stainless-app[bot]stainless-app[bot]
committed
feat(api): add credential_proxy to secrets, remove format from environment spec
1 parent 2dc3c8d commit 349a1ba

8 files changed

Lines changed: 94 additions & 21 deletions

File tree

‎.stats.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
configured_endpoints: 193
2-
openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/gitpod/gitpod-771a93472886d9a5ad2f4322a3585a6006eeea484e04d9e610a6b6f5afc12c7b.yml
3-
openapi_spec_hash: f44f26ac4d487d9831848a729032dc51
2+
openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/gitpod/gitpod-22142c64382973b366500f7fd197f8baa74d441cc7418b74306700c23031ff21.yml
3+
openapi_spec_hash: 2d481c6c65d22f4de3c52beb496cb0bd
44
config_hash: a5dff404dcc41293fdc9d3a131a6f2e3

‎src/gitpod/resources/secrets.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ def create(
5656
*,
5757
api_only: bool | Omit = omit,
5858
container_registry_basic_auth_host: str | Omit = omit,
59+
credential_proxy: secret_create_params.CredentialProxy | Omit = omit,
5960
environment_variable: bool | Omit = omit,
6061
file_path: str | Omit = omit,
6162
name: str | Omit = omit,
@@ -122,6 +123,13 @@ def create(
122123
container_registry_basic_auth_host: secret will be mounted as a docker config in the environment VM, mount will have
123124
the docker registry host
124125
126+
credential_proxy: credential_proxy configures transparent credential injection when environments
127+
materialize this secret. When set, the credential proxy intercepts HTTPS traffic
128+
to the target hosts and replaces the dummy mounted value with the real value in
129+
the specified HTTP header. The real secret value is never exposed in the
130+
environment. This field is orthogonal to mount — a secret can be both mounted
131+
and proxied at the same time.
132+
125133
environment_variable: secret will be created as an Environment Variable with the same name as the
126134
secret
127135
@@ -152,6 +160,7 @@ def create(
152160
{
153161
"api_only": api_only,
154162
"container_registry_basic_auth_host": container_registry_basic_auth_host,
163+
"credential_proxy": credential_proxy,
155164
"environment_variable": environment_variable,
156165
"file_path": file_path,
157166
"name": name,
@@ -432,6 +441,7 @@ async def create(
432441
*,
433442
api_only: bool | Omit = omit,
434443
container_registry_basic_auth_host: str | Omit = omit,
444+
credential_proxy: secret_create_params.CredentialProxy | Omit = omit,
435445
environment_variable: bool | Omit = omit,
436446
file_path: str | Omit = omit,
437447
name: str | Omit = omit,
@@ -498,6 +508,13 @@ async def create(
498508
container_registry_basic_auth_host: secret will be mounted as a docker config in the environment VM, mount will have
499509
the docker registry host
500510
511+
credential_proxy: credential_proxy configures transparent credential injection when environments
512+
materialize this secret. When set, the credential proxy intercepts HTTPS traffic
513+
to the target hosts and replaces the dummy mounted value with the real value in
514+
the specified HTTP header. The real secret value is never exposed in the
515+
environment. This field is orthogonal to mount — a secret can be both mounted
516+
and proxied at the same time.
517+
501518
environment_variable: secret will be created as an Environment Variable with the same name as the
502519
secret
503520
@@ -528,6 +545,7 @@ async def create(
528545
{
529546
"api_only": api_only,
530547
"container_registry_basic_auth_host": container_registry_basic_auth_host,
548+
"credential_proxy": credential_proxy,
531549
"environment_variable": environment_variable,
532550
"file_path": file_path,
533551
"name": name,

‎src/gitpod/types/environment_spec.py‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -144,12 +144,6 @@ class SecretCredentialProxy(BaseModel):
144144
as a git credential) and proxied at the same time.
145145
"""
146146

147-
format: Optional[Literal["FORMAT_UNSPECIFIED", "FORMAT_PLAIN", "FORMAT_BASE64"]] = None
148-
"""format describes how the secret value is encoded.
149-
150-
The proxy uses this to decode the value before injecting it into the header.
151-
"""
152-
153147
header: Optional[str] = None
154148
"""header is the HTTP header name to inject (e.g. "Authorization")."""
155149

‎src/gitpod/types/environment_spec_param.py‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -152,12 +152,6 @@ class SecretCredentialProxy(TypedDict, total=False):
152152
as a git credential) and proxied at the same time.
153153
"""
154154

155-
format: Literal["FORMAT_UNSPECIFIED", "FORMAT_PLAIN", "FORMAT_BASE64"]
156-
"""format describes how the secret value is encoded.
157-
158-
The proxy uses this to decode the value before injecting it into the header.
159-
"""
160-
161155
header: str
162156
"""header is the HTTP header name to inject (e.g. "Authorization")."""
163157

‎src/gitpod/types/secret.py‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
22

3-
from typing import Optional
3+
from typing import List, Optional
44
from datetime import datetime
55

66
from pydantic import Field as FieldInfo
@@ -9,7 +9,28 @@
99
from .secret_scope import SecretScope
1010
from .shared.subject import Subject
1111

12-
__all__ = ["Secret"]
12+
__all__ = ["Secret", "CredentialProxy"]
13+
14+
15+
class CredentialProxy(BaseModel):
16+
"""
17+
credential_proxy configures transparent credential injection via the
18+
credential proxy. When set, the credential proxy intercepts HTTPS
19+
traffic to the target hosts and replaces the dummy mounted value with
20+
the real value in the specified HTTP header. The real secret value is
21+
never exposed in the environment.
22+
This field is orthogonal to mount — a secret can be both mounted and
23+
proxied at the same time.
24+
"""
25+
26+
header: Optional[str] = None
27+
"""header is the HTTP header name to inject (e.g. "Authorization")."""
28+
29+
target_hosts: Optional[List[str]] = FieldInfo(alias="targetHosts", default=None)
30+
"""
31+
target_hosts lists the hostnames to intercept (for example "github.com" or
32+
"\\**.github.com"). Wildcards are subdomain-only and do not match the apex domain.
33+
"""
1334

1435

1536
class Secret(BaseModel):
@@ -116,6 +137,16 @@ class Secret(BaseModel):
116137
creator: Optional[Subject] = None
117138
"""creator is the identity of the creator of the secret"""
118139

140+
credential_proxy: Optional[CredentialProxy] = FieldInfo(alias="credentialProxy", default=None)
141+
"""
142+
credential_proxy configures transparent credential injection via the credential
143+
proxy. When set, the credential proxy intercepts HTTPS traffic to the target
144+
hosts and replaces the dummy mounted value with the real value in the specified
145+
HTTP header. The real secret value is never exposed in the environment. This
146+
field is orthogonal to mount — a secret can be both mounted and proxied at the
147+
same time.
148+
"""
149+
119150
environment_variable: Optional[bool] = FieldInfo(alias="environmentVariable", default=None)
120151
"""
121152
secret will be created as an Environment Variable with the same name as the

‎src/gitpod/types/secret_create_params.py‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@
44

55
from typing_extensions import Annotated, TypedDict
66

7+
from .._types import SequenceNotStr
78
from .._utils import PropertyInfo
89
from .secret_scope_param import SecretScopeParam
910

10-
__all__ = ["SecretCreateParams"]
11+
__all__ = ["SecretCreateParams", "CredentialProxy"]
1112

1213

1314
class SecretCreateParams(TypedDict, total=False):
@@ -24,6 +25,16 @@ class SecretCreateParams(TypedDict, total=False):
2425
the docker registry host
2526
"""
2627

28+
credential_proxy: Annotated[CredentialProxy, PropertyInfo(alias="credentialProxy")]
29+
"""
30+
credential_proxy configures transparent credential injection when environments
31+
materialize this secret. When set, the credential proxy intercepts HTTPS traffic
32+
to the target hosts and replaces the dummy mounted value with the real value in
33+
the specified HTTP header. The real secret value is never exposed in the
34+
environment. This field is orthogonal to mount — a secret can be both mounted
35+
and proxied at the same time.
36+
"""
37+
2738
environment_variable: Annotated[bool, PropertyInfo(alias="environmentVariable")]
2839
"""
2940
secret will be created as an Environment Variable with the same name as the
@@ -52,3 +63,24 @@ class SecretCreateParams(TypedDict, total=False):
5263

5364
value: str
5465
"""value is the plaintext value of the secret"""
66+
67+
68+
class CredentialProxy(TypedDict, total=False):
69+
"""
70+
credential_proxy configures transparent credential injection when
71+
environments materialize this secret. When set, the credential proxy
72+
intercepts HTTPS traffic to the target hosts and replaces the dummy
73+
mounted value with the real value in the specified HTTP header. The real
74+
secret value is never exposed in the environment.
75+
This field is orthogonal to mount — a secret can be both mounted and
76+
proxied at the same time.
77+
"""
78+
79+
header: str
80+
"""header is the HTTP header name to inject (e.g. "Authorization")."""
81+
82+
target_hosts: Annotated[SequenceNotStr[str], PropertyInfo(alias="targetHosts")]
83+
"""
84+
target_hosts lists the hostnames to intercept (for example "github.com" or
85+
"\\**.github.com"). Wildcards are subdomain-only and do not match the apex domain.
86+
"""

‎tests/api_resources/test_environments.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@ def test_method_create_with_all_params(self, client: Gitpod) -> None:
108108
"api_only": True,
109109
"container_registry_basic_auth_host": "containerRegistryBasicAuthHost",
110110
"credential_proxy": {
111-
"format": "FORMAT_UNSPECIFIED",
112111
"header": "header",
113112
"target_hosts": ["string"],
114113
},
@@ -487,7 +486,6 @@ def test_method_create_from_project_with_all_params(self, client: Gitpod) -> Non
487486
"api_only": True,
488487
"container_registry_basic_auth_host": "containerRegistryBasicAuthHost",
489488
"credential_proxy": {
490-
"format": "FORMAT_UNSPECIFIED",
491489
"header": "header",
492490
"target_hosts": ["string"],
493491
},
@@ -808,7 +806,6 @@ async def test_method_create_with_all_params(self, async_client: AsyncGitpod) ->
808806
"api_only": True,
809807
"container_registry_basic_auth_host": "containerRegistryBasicAuthHost",
810808
"credential_proxy": {
811-
"format": "FORMAT_UNSPECIFIED",
812809
"header": "header",
813810
"target_hosts": ["string"],
814811
},
@@ -1187,7 +1184,6 @@ async def test_method_create_from_project_with_all_params(self, async_client: As
11871184
"api_only": True,
11881185
"container_registry_basic_auth_host": "containerRegistryBasicAuthHost",
11891186
"credential_proxy": {
1190-
"format": "FORMAT_UNSPECIFIED",
11911187
"header": "header",
11921188
"target_hosts": ["string"],
11931189
},

‎tests/api_resources/test_secrets.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ def test_method_create_with_all_params(self, client: Gitpod) -> None:
3434
secret = client.secrets.create(
3535
api_only=True,
3636
container_registry_basic_auth_host="containerRegistryBasicAuthHost",
37+
credential_proxy={
38+
"header": "header",
39+
"target_hosts": ["string"],
40+
},
3741
environment_variable=True,
3842
file_path="filePath",
3943
name="DATABASE_URL",
@@ -247,6 +251,10 @@ async def test_method_create_with_all_params(self, async_client: AsyncGitpod) ->
247251
secret = await async_client.secrets.create(
248252
api_only=True,
249253
container_registry_basic_auth_host="containerRegistryBasicAuthHost",
254+
credential_proxy={
255+
"header": "header",
256+
"target_hosts": ["string"],
257+
},
250258
environment_variable=True,
251259
file_path="filePath",
252260
name="DATABASE_URL",

0 commit comments

Comments
 (0)