feat(snap): add secretstore token for edgex-ekuiper snap

[MonicaisHer]

This PR adds edgex-ekuiper as an add-on service to secretStoreTokens and secretStoreKnownSecrets (for redisdb) lists.

The Vault token is required for the standalone deployment of eKuiper with snap, where a script queries the Redis credentials after authenticating with Vault. The snap receives the vault token using the edgex-secretstore-token content interface or via other means.

Signed-off-by: Mengyi Wang [email protected]

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/main/.github/Contributing.md

PR Checklist

Please check if your PR fulfills the following requirements:

• I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
• I am not introducing a new dependency (add notes below if you are)
• I have added unit tests for the new feature or bug fix (if not, why?)
• I have fully tested (add details below) this the new feature or bug fix (if not, why?)
• I have opened a PR for the related docs change (if not, why?)

Testing Instructions

New Dependency Instructions (If applicable)

[farshidtz]

This is a feature addition. Please change the PR title prefix.

Also, the commits need to have semantic prefixes.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[lenny-goodell]

eKuiper doesn't use secretStoreTokens and secretStoreKnownSecrets, we inject the Redis password into their config. This PR is not needed.

[farshidtz]

eKuiper doesn't use secretStoreTokens and secretStoreKnownSecrets, we inject the Redis password into their config. This PR is not needed.

@lenny-intel, the embedded eKuiper doesn't. This is for a standalone ekuiper snap. I've just updated the PR description to:

This PR adds edgex-ekuiper as an add-on service to secretStoreTokens and secretStoreKnownSecrets (for redisdb) lists.

The Vault token is required for the standalone deployment of eKuiper with snap, where a script queries the Redis credentials after authenticating with Vault. The snap receives the vault token using the edgex-secretstore-token content interface or via other means.

The standalone edgex-ekuiper snap is work in progress. But we are almost sure that using the vault token to query the redis credentials is the cleanest way forward. This makes the edgex-ekuiper's server configurations (mostly unrelated to security) decoupled from an internal security component of EdgeX. Moreover, this makes edgex-ekuiper's interaction with the platform similar to other services.

I think we could eventually have a component which does this both for snapped and dockerized ekuiper. For example an edgex-ekuiper-setup app that takes a vault token and config file templates, queries the redis credentials, and outputs the config files. What do you think?

[lenny-goodell]

LGTM