feat: implement conditional secret management

[fykaa]

Fixes: #2214

Key changes include:

1. Configuration updates:

   • EnableSecretManagement flag
   • modified ClusterRole and ConfigMap to manage secrets based on this flag
   • updated values.yaml and config.go to incorporate the new setting

2. API enhancements:

   • updated GetConfig endpoint to include SecretManagementEnabled status

3. Endpoint adjustments:

   • ensure endpoints for managing secrets return connect.CodeUnimplemented when secret management is disabled

cc: @krancour @rbreeze

[netlify]

✅ Deploy Preview for docs-kargo-akuity-io ready!

Name	Link
🔨 Latest commit	4225454
🔍 Latest deploy log	https://app.netlify.com/sites/docs-kargo-akuity-io/deploys/66e1c5350aa62d00084cc4bb
😎 Deploy Preview	https://deploy-preview-2517.kargo.akuity.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[hiddeco]

Suggested change

	{{- if .Values.api.enableSecretManagement }}
	{{- if .Values.api.secretManagement.enabled }}

maybe? To match .api.oidc.enabled, .api.adminAccount.enabled, etc.

[fykaa]

enableSecretManagement matches the enablePermissiveCORSPolicy imo; which should be good as long as we have not more than one field to be managed for secret management unlike oidc and adminAccount

wdyt? @hiddeco

[hiddeco]

I now notice there is a .api.rollouts.integrationEnabled, so I guess we have already lost this game.

I would prefer things to be uniform at some point, but will not let this block you now. So go for whatever you think is best.

[krancour]

Let's make an issue for improving the consistency pre-GA.

[fykaa]

#2518

[krancour]

It looks like a few unit tests that use the credential management endpoints may need an update. Their config needs secret management enabled.

[codecov]

Codecov Report

Attention: Patch coverage is 8.69565% with 21 lines in your changes missing coverage. Please review.

Project coverage is 48.26%. Comparing base (a64eb0e) to head (4225454).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/api/delete_credentials_v1alpha1.go	0.00%	5 Missing ⚠️
internal/api/get_credentials_v1alpha1.go	0.00%	4 Missing and 1 partial ⚠️
internal/api/list_credentials_v1alpha1.go	0.00%	5 Missing ⚠️
internal/api/update_credentials_v1alpha1.go	0.00%	5 Missing ⚠️
internal/api/config/config.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2517      +/-   ##
==========================================
- Coverage   48.32%   48.26%   -0.06%     
==========================================
  Files         254      254              
  Lines       18133    18155      +22     
==========================================
+ Hits         8762     8763       +1     
- Misses       8889     8909      +20     
- Partials      482      483       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[krancour]

@rbreeze any chance we can get you to amend this PR with the bits to hide credential-management functionality when the config endpoint says its not enabled?

[rbreeze]

@fykaa @krancour Sure thing, just pushed the update 👍🏻

[krancour]

Added a tiny fix in 92f07be

[krancour]

Thank you @fykaa! This is great!

[krancour]

And @rbreeze, thanks to you as well!