Enabling using secret values during a deployment #1755

karrgov · 2025-12-19T11:57:33Z

LMCROSSITXSADEPLOY-2301

vkalapov · 2025-12-30T09:32:27Z

...re/src/main/java/org/cloudfoundry/multiapps/controller/core/helpers/MtaDescriptorMerger.java


-    public DeploymentDescriptor merge(DeploymentDescriptor deploymentDescriptor, List<ExtensionDescriptor> extensionDescriptors) {
+    public DeploymentDescriptor merge(DeploymentDescriptor deploymentDescriptor, List<ExtensionDescriptor> extensionDescriptors,
+                                      List<String> parameterNamesToBeCensored) {


I think that parameterNamesToBeMasked, Hidden, Redacted, flow better here for the name.

vkalapov · 2025-12-30T09:50:14Z

...iapps-controller-core/src/main/java/org/cloudfoundry/multiapps/controller/core/Messages.java

    public static final String BUILDPACKS_NOT_ALLOWED_WITH_DOCKER = "Buildpacks must not be provided when lifecycle is set to 'docker'.";
    public static final String EXTENSION_DESCRIPTORS_COULD_NOT_BE_PARSED_TO_VALID_YAML = "Extension descriptor(s) could not be parsed as a valid YAML file. These descriptors may fail future deployments once stricter validation is enforced. Please review and correct them now to avoid future issues. Use at your own risk";
    public static final String UNSUPPORTED_FILE_FORMAT = "Unsupported file format! \"{0}\" detected";
+    public static final String ENCRYPTION_BOUNCY_CASTLE_AES256_HAS_FAILED = "Encryption with AES256 by Bouncy Castle has failed!";


This message is too specific, we should avoid leaking implementation details (algorithm and the provider). Consider using a more generic message.

...in/resources/org/cloudfoundry/multiapps/controller/persistence/db/changelog/db-changelog.xml

vkalapov · 2025-12-30T10:14:01Z

...rocess/src/main/java/org/cloudfoundry/multiapps/controller/process/steps/ProcessContext.java

+        Set<String> secretParameters = VariableHandling.get(execution, Variables.SECURE_EXTENSION_DESCRIPTOR_PARAMETER_NAMES);
+        DynamicSecureSerialization dynamicSecureSerialization = SecureSerializationFactory.ofAdditionalValues(secretParameters);


These two lines follow the same pattern and appear in several files (with minor variations). Might be worth extracting into a small utility or helper.

Fixed on all places, thanks :)

vkalapov · 2025-12-30T12:17:09Z

...er/process/security/resolver/MissingCredentialsFromUserProvidedServiceEncryptionRelated.java

@@ -0,0 +1,17 @@
+package org.cloudfoundry.multiapps.controller.process.security.resolver;
+
+public class MissingCredentialsFromUserProvidedServiceEncryptionRelated extends RuntimeException {


Name feels too long and missing a exception suffix. Consider shortening it.

vkalapov · 2026-01-05T11:18:44Z

...oudfoundry/multiapps/controller/persistence/query/providers/SqlSecretTokenQueryProvider.java

+                    if (resultSet.next()) {
+                        return resultSet.getLong(1);
+                    }
+                    throw new SQLException("INSERT secret_token did not return an id");


Could we include the process instance and variable name in the exception message?

vkalapov · 2026-01-05T11:26:56Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/MergeDescriptorsStep.java

+
+    private MultiValuedMap<String, String> getParametersNameValueMapFromExtensionDescriptors(
+        List<ExtensionDescriptor> extensionDescriptors) {
+        MultiValuedMap<String, String> parametersNameValueMapFromExtensionDescriptors = new ArrayListValuedHashMap<>();


parametersNameValueMapFromExtensionDescriptors and parametersNameValueMapFromDeploymentDescriptor seems to be very long. Consider a shorter, more descriptive name to improve clarity.

Fixed, since I have changed the logic to follow the Visitor pattern :)

vkalapov · 2026-01-05T11:31:47Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/MergeDescriptorsStep.java

+    private Set<String> getNestedParameterNamesToBeCensored(MultiValuedMap<String, String> parameterNameValueMap,
+                                                            Set<String> parameterNamesToBeCensored) {
+        Set<String> nestedParameterNamesToBeCensored = new HashSet<>();
+        for (Map.Entry<String, Collection<String>> parameterEntryInStringType : parameterNameValueMap.asMap()
+                                                                                                     .entrySet()) {
+            List<String> entryValuesToString = parameterEntryInStringType.getValue()
+                                                                         .stream()
+                                                                         .map(String::toString)
+                                                                         .toList();
+            for (String complexValue : entryValuesToString) {
+                for (String nameToBeCensored : parameterNamesToBeCensored) {
+                    if (complexValue.contains(nameToBeCensored)) {
+                        nestedParameterNamesToBeCensored.add(parameterEntryInStringType.getKey());
+                    }
+                }
+            }
+        }


The nested loops make the logic a bit hard to follow. Could we simplify by using streams or helper methods?

Fixed, since I have changed the logic to follow the Visitor pattern :)

vkalapov · 2026-01-05T11:38:54Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/MergeDescriptorsStep.java

+    private Map<String, String> getParametersStringCastedValue(ParametersContainer parametersContainer) {
+        return parametersContainer.getParameters()
+                                  .entrySet()
+                                  .stream()
+                                  .collect(Collectors.toMap(Map.Entry::getKey,
+                                                            currentParameter -> Objects.toString(currentParameter.getValue(), "")));
+    }
+
+    private Map<String, String> getPropertiesStringCastedValue(PropertiesContainer propertiesContainer) {
+        return propertiesContainer.getProperties()
+                                  .entrySet()
+                                  .stream()
+                                  .collect(Collectors.toMap(Map.Entry::getKey,
+                                                            currentProperty -> Objects.toString(currentProperty.getValue(), "")));
+    }


getParametersStringCastedValue and getPropertiesStringCastedValue share almost identical logic. Consider a generic helper method to reduce duplication.

Fixed, since I have changed the logic to follow the Visitor pattern :)

vkalapov · 2026-01-05T11:40:58Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/MergeDescriptorsStep.java

+    private void getParametersAndPropertiesPerModule(MultiValuedMap<String, String> multiValuedMap, Module module, boolean isRequired,
+                                                     boolean isWhole, boolean isProvided) {


Long boolean flag lists reduce readability. Consider replacing them with an enum or separate helper methods for each case.

Fixed, since I have changed the logic to follow the Visitor pattern :)

multiapps-controller-core/src/main/java/module-info.java

...n/java/org/cloudfoundry/multiapps/controller/core/security/encryption/AesEncryptionUtil.java

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

...n/java/org/cloudfoundry/multiapps/controller/core/security/encryption/AesEncryptionUtil.java

...ess/src/main/java/org/cloudfoundry/multiapps/controller/process/jobs/SecretTokenCleaner.java

...udfoundry/multiapps/controller/process/security/SecretTransformationStrategyContextImpl.java

...ntroller/process/security/resolver/MissingUserProvidedServiceEncryptionRelatedException.java

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

.../org/cloudfoundry/multiapps/controller/process/steps/ProcessMtaExtensionDescriptorsStep.java

...dfoundry/multiapps/controller/core/security/serialization/SecureSerializerConfiguration.java

IvanBorislavovDimitrov · 2026-01-23T09:20:18Z

...er-persistence/src/main/java/org/cloudfoundry/multiapps/controller/persistence/Messages.java

    public static final String BACKUP_DESCRIPTOR_WITH_ID_NOT_EXIST = "Backup descriptor with ID \"{0}\" does not exist";
+    public static final String SECRET_TOKEN_WITH_ID_NOT_EXIST = "Secret token with ID \"{0}\" does not exist";
    public static final String DATABASE_HEALTH_CHECK_FAILED = "Database health check failed";
+    public static final String INSERT_QUERY_NOT_RETURN_ID_FOR_VARIABLE_NAME_0_AND_PROCESS_WITH_ID_1 = "INSERT into secret_token table did not return an id for a variable name \"{0}\" and process with id \"{1}\"";


not used, delete it

...in/resources/org/cloudfoundry/multiapps/controller/persistence/db/changelog/db-changelog.xml

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/SecureProcessContext.java

...in/java/org/cloudfoundry/multiapps/controller/process/util/OperationInFinalStateHandler.java

...ontroller-process/src/main/java/org/cloudfoundry/multiapps/controller/process/Constants.java

multiapps-controller-process/src/main/java/module-info.java

vkalapov · 2026-01-23T13:21:27Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/MergeDescriptorsStep.java

    @Inject
    private UnsupportedParameterFinder unsupportedParameterFinder;

+    private SecretParametersCollectingVisitor secretParametersCollectingVisitor = new SecretParametersCollectingVisitor();


Can this be done through a field injection like the other fields?

fixed, thanks :)

vkalapov · 2026-01-23T13:24:38Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/SecureProcessContext.java

+        //        SecretTransformationStrategy secretTransformationStrategyContext = new SecretTransformationStrategyContextImpl(
+        //            secureParameterNames);
+        //        SecureSerializerConfiguration secureSerializerConfiguration = new SecureSerializerConfiguration();
+        //        secureSerializerConfiguration.setAdditionalSensitiveElementNames(secureParameterNames);


Remove these comments.

vkalapov · 2026-01-23T13:24:49Z

.../src/main/java/org/cloudfoundry/multiapps/controller/process/steps/SecureProcessContext.java

+    //    private SecretTransformationStrategy secretTransformationStrategy;
+
+    public SecureProcessContext(DelegateExecution execution, StepLogger stepLogger, CloudControllerClientProvider clientProvider,
+                                SecretTokenStore secretTokenStore) {
+        super(execution, stepLogger, clientProvider);
+        this.secretTokenStore = secretTokenStore;
+        //        this.secretTransformationStrategy = secretTransformationStrategy;


Remove these comments.

vkalapov · 2026-01-23T13:40:45Z

...va/org/cloudfoundry/multiapps/controller/core/security/encryption/AesEncryptionUtilTest.java

+        byte[] tampered = Arrays.copyOf(encrypted, encrypted.length);
+        tampered[tampered.length - 1] = (byte) (tampered[tampered.length - 1] ^ 0x01);
+
+        assertThrows(Exception.class, () -> AesEncryptionUtil.decrypt(tampered, KEY_FOR_256_32_BYTES));


Its better to assert the specific exception type (in this case SLException), than a generic Exception.

fixed, thanks :)

vkalapov · 2026-01-23T14:02:08Z

...in/java/org/cloudfoundry/multiapps/controller/process/steps/SecureProcessContextFactory.java

+    public SecureProcessContextFactory() {
+
+    }


We probably don’t need this explicit constructor, the generated builder is used for instantiation.

vkalapov · 2026-01-26T07:10:37Z

.../org/cloudfoundry/multiapps/controller/process/steps/ProcessMtaExtensionDescriptorsStep.java

+            boolean isSecureExtensionDescriptorPresent = extensionDescriptors.stream()
+                                                                             .anyMatch(extensionDescriptor -> extensionDescriptor.getId()
+                                                                                                                                 .equals(
+                                                                                                                                     Constants.SECURE_EXTENSION_DESCRIPTOR_ID));
+            if (isSecureExtensionDescriptorPresent) {
+                List<ExtensionDescriptor> extensionDescriptorsWithoutSecure = extensionDescriptors.stream()
+                                                                                                  .filter(
+                                                                                                      extensionDescriptor -> !extensionDescriptor.getId()
+                                                                                                                                                 .equals(
+                                                                                                                                                     Constants.SECURE_EXTENSION_DESCRIPTOR_ID))
+                                                                                                  .toList();
+                getStepLogger().debug(Messages.PROVIDED_EXTENSION_DESCRIPTORS, SecureSerialization.toJson(extensionDescriptorsWithoutSecure)
+                    + Messages.SECURE_EXTENSION_DESCRIPTOR_CONSTRUCTED_AND_APPLIED_FROM_ENVIRONMENT_VARIABLES);
+            } else {
+                getStepLogger().debug(Messages.PROVIDED_EXTENSION_DESCRIPTORS, SecureSerialization.toJson(extensionDescriptors));
+            }


The check against Constants.SECURE_EXTENSION_DESCRIPTOR_ID is duplicated in anyMatch and filter. We could compute the filtered list once and infer presence from the size difference:
boolean securePresent = extensionDescriptorsWithoutSecure.size() != extensionDescriptors.size();

thanks for the suggestion, fixed :)

vkalapov · 2026-01-26T07:16:11Z

...n/java/org/cloudfoundry/multiapps/controller/core/security/encryption/AesEncryptionUtil.java

+    private static Cipher setUpCipherObject(byte[] encryptionKey, byte[] gcmInitialisationVector, boolean shouldEncrypt)
+        throws InvalidAlgorithmParameterException, InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException,
+        NoSuchProviderException {
+        Cipher cipherObject = Cipher.getInstance(Constants.CIPHER_TRANSFORMATION_NAME, BouncyCastleFipsProvider.PROVIDER_NAME);
+        SecretKeySpec secretKeySpec = new SecretKeySpec(encryptionKey, Constants.ENCRYPTION_DECRYPTION_ALGORITHM_NAME);
+        GCMParameterSpec gcmParameterSpec = new GCMParameterSpec(Constants.GCM_AUTHENTICATION_TAG_LENGTH, gcmInitialisationVector);
+
+        if (shouldEncrypt) {
+            cipherObject.init(Cipher.ENCRYPT_MODE, secretKeySpec, gcmParameterSpec);
+        } else {
+            cipherObject.init(Cipher.DECRYPT_MODE, secretKeySpec, gcmParameterSpec);
+        }
+
+        return cipherObject;
+    }


Why not pass Cipher.ENCRYPT_MODE / Cipher.DECRYPT_MODE instead of a boolean shouldEncrypt in the method signature? It would make the call sites more explicit.

fixed, thanks for the suggestion

vkalapov · 2026-01-26T07:25:28Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+        String namespace = VariableHandling.get(execution, Variables.MTA_NAMESPACE);
+
+        if (mtaId == null) {
+            throw new SLException("Missing mtaId in encryption key resolver! Cannot continue from here!");


Extract this message in a constant.

vkalapov · 2026-01-26T07:29:17Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+    @Inject
+    public SecretTokenKeyResolverImpl(CloudControllerClientProvider cloudControllerClientProvider) {
+        this.cloudControllerClientProvider = cloudControllerClientProvider;
+    }
+
+    public SecretTokenKeyResolverImpl() {
+    }


Is there a reason this class has both an @Inject constructor and a no-args constructor? With the default constructor present, the dependency could be left uninitialized.

Accidentally must have left the no-args one, fixed, thanks :)

vkalapov · 2026-01-26T07:35:42Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+        SecretTokenKeyContainer secretTokenKeyContainer = null;
+        if (serviceInstanceID != null) {
+            secretTokenKeyContainer = cachedMap.get(serviceInstanceID.toString());
+        }
+        if (secretTokenKeyContainer != null) {
+            return secretTokenKeyContainer;
+        }


The cache lookup could be simplified using an early return:
if (serviceInstanceID != null) {
SecretTokenKeyContainer secretTokenKeyContainer = cachedMap.get(serviceInstanceID.toString());
if (secretTokenKeyContainer != null) return secretTokenKeyContainer;
}

LMCROSSITXSADEPLOY-2301

vkalapov · 2026-02-03T12:34:02Z

multiapps-controller-process/src/main/java/module-info.java

@@ -22,14 +26,17 @@
    requires org.cloudfoundry.client;
    requires com.fasterxml.jackson.core;
    requires com.fasterxml.jackson.databind;
+    requires com.google.common;
    requires flowable.bpmn.model;
    requires flowable.engine.common;
    requires flowable.engine.common.api;
    requires flowable.job.service;
    requires flowable.job.service.api;
    requires flowable.variable.service;
    requires flowable.variable.service.api;
+    requires jakarta.annotation;
    requires jakarta.persistence;
+    requires java.annotation;
    requires java.sql;
    requires jakarta.xml.bind;
    requires jakarta.inject;
@@ -39,23 +46,29 @@
    requires org.apache.commons.collections4;
    requires org.apache.commons.io;
    requires org.apache.commons.lang3;
+    requires org.bouncycastle.fips.core;
    requires org.cloudfoundry.multiapps.common;
    requires org.cloudfoundry.multiapps.controller.client;
    requires org.cloudfoundry.multiapps.controller.persistence;
    requires org.cloudfoundry.multiapps.mta;
    requires org.joda.time;
+    requires org.mybatis;
    requires org.slf4j;
    requires spring.beans;
    requires spring.context;
    requires spring.core;
    requires spring.security.oauth2.core;
    requires spring.web;
+    requires tools.jackson.databind;
    requires reactor.netty;
    requires io.netty.handler;
    requires io.netty.transport;

    requires static java.compiler;
    requires static org.immutables.value;
    requires org.cloudfoundry.multiapps.controller.shutdown.client;
+    requires org.checkerframework.checker.qual;
+    requires s3;
+    requires org.eclipse.persistence.jpa;


Do we need all of the newly added module dependencies, or can any of them be removed?

Tested without them, everything is fine, thanks :)

vkalapov · 2026-02-03T12:54:37Z

...va/org/cloudfoundry/multiapps/controller/core/security/encryption/AesEncryptionUtilTest.java

+        String plainText = "top secret";
+        byte[] encrypted = AesEncryptionUtil.encrypt(plainText, KEY_FOR_256_32_BYTES);
+
+        byte[] differentValidKey = "0123456789abcdef0123456789ABCDEF".getBytes(StandardCharsets.UTF_8);


Consider extracting this into a constant.

vkalapov · 2026-02-03T13:13:25Z

.../main/java/org/cloudfoundry/multiapps/controller/process/security/SecretTokenSerializer.java

+                   .map(element -> {
+                       if (element instanceof String) {
+                           String transformedJson = transformJson((String) element, censor);
+                           return getResultFromTransformedJson(transformedJson, element, false);
+                       } else if (element instanceof byte[]) {
+                           String transformedJson = transformJson(new String((byte[]) element), censor);
+                           return getResultFromTransformedJson(transformedJson, element, true);
+                       }
+                       return element;
+                   })


I think extracting the lambda logic would improve readability.

vkalapov · 2026-02-03T13:15:17Z

.../main/java/org/cloudfoundry/multiapps/controller/process/security/SecretTokenSerializer.java

+                return OBJECT_MAPPER.writeValueAsString(output);
+            }
+            return null;
+        } catch (Exception e) {


Do we need to catch generic exceptions or is it possible that we can narrow down into more JSON specific ones?

Fixed, thanks :) Added only JsonProcessingException since JsonMappingException is a child exception of JsonProcessingException

vkalapov · 2026-02-03T13:17:16Z

.../main/java/org/cloudfoundry/multiapps/controller/process/security/SecretTokenSerializer.java

+        return objectNode;
+    }
+
+    private void determineWhetherToCensorOrUncensor(JsonNode childNode, JsonNode processedNode, ObjectNode objectNode, String currentField,


Is censor/uncensor the most appropriate terminology for this case? Could something like encode/decode better reflect what’s happening?

Fixed, thanks for the suggestion!

vkalapov · 2026-02-04T08:16:36Z

...n/java/org/cloudfoundry/multiapps/controller/process/security/SecretParametersCollector.java

+        for (String secretParameter : secretParameters) {
+            if (!secretParameter.isEmpty() && value.contains(secretParameter)) {
+                nestedParameters.add(currentParameterName);
+            }
+        }


Once we add currentParameterName, would it make sense to return early?

vkalapov · 2026-02-04T08:17:49Z

...n/java/org/cloudfoundry/multiapps/controller/process/security/SecretParametersCollector.java

+        }
+    }
+
+    private void shouldBeAddedInNestedParameters(Set<String> secretParameters, Set<String> nestedParameters, String value,


secretParameters is already a class field, can the method just use the field directly?

vkalapov · 2026-02-04T08:47:25Z

...n/java/org/cloudfoundry/multiapps/controller/process/security/SecretParametersCollector.java

+@Component
+public class SecretParametersCollector extends Visitor {
+
+    private final Set<String> secretParameters = new HashSet<>();
+
+    private final MultiValuedMap<String, String> parametersNameValueMap = new ArrayListValuedHashMap<>();


Since this class uses @Component , should these fields be made method local or thread safe?

Fixed it by making it not a bean and adding it as a local object inside the method it is used instead of a field for the MergeDescriptorsStep

vkalapov · 2026-02-04T08:52:13Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+    }
+
+    @Override
+    public String resolve(DelegateExecution execution) {


This method can be broken down into smaller chunks.

vkalapov · 2026-02-04T08:54:16Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+        LOGGER.error("SecretTokenKeyResolver CACHE_MISSED instance={} correlationId={}", instance(), correlationId);
+
+        CloudControllerClient cloudControllerClient = createCloudControllerClient(execution, correlationId);
+        LOGGER.error("SecretTokenKeyResolver CLIENT_CREATED instance={} correlationId={} userGuid={} spaceGuid={}",
+                     instance(), correlationId, StepsUtil.determineCurrentUserGuid(execution),
+                     VariableHandling.get(execution, Variables.SPACE_GUID));
+
+        String userProvidedServiceName = getUserProvidedServiceName(execution);
+        LOGGER.error("SecretTokenKeyResolver UPS_NAME_CHOSEN instance={} correlationId={} upsName='{}'",
+                     instance(), correlationId, userProvidedServiceName);
+
+        CloudServiceInstance cloudServiceInstance = cloudControllerClient.getServiceInstance(userProvidedServiceName);
+        if (cloudServiceInstance == null) {
+            LOGGER.error("SecretTokenKeyResolver UPS_NOT_FOUND instance={} correlationId={} upsName='{}'",
+                         instance(), correlationId, userProvidedServiceName);
+            throw new SLException(Messages.COULD_NOT_RETRIEVE_USER_PROVIDED_SERVICE_INSTANCE_ENCRYPTION_RELATED);
+        }
+
+        UUID upsGuid = cloudServiceInstance.getGuid();
+        LOGGER.error("SecretTokenKeyResolver UPS_RESOLVED instance={} correlationId={} upsName='{}' guid={}",
+                     instance(), correlationId, userProvidedServiceName, upsGuid);
+
+        Map<String, Object> serviceInstanceCredentials = getUserProvidedServiceInstanceParameters(cloudServiceInstance,
+                                                                                                  cloudControllerClient);
+        if (serviceInstanceCredentials == null || serviceInstanceCredentials.isEmpty()) {
+            LOGGER.error("SecretTokenKeyResolver CREDENTIALS_EMPTY instance={} correlationId={} guid={}", instance(), correlationId,
+                         upsGuid);


Don't forget to remove these debugging logs.

LMCROSSITXSADEPLOY-2301

IvanBorislavovDimitrov · 2026-02-06T14:41:55Z

.../cloudfoundry/multiapps/controller/process/security/resolver/SecretTokenKeyResolverImpl.java

+
+    private final CloudControllerClientProvider cloudControllerClientProvider;
+
+    private final Duration containerExpirationTime = Duration.ofMinutes(Constants.TTL_CACHE_ENTRY);


Fix expiration time or the duration here.

IvanBorislavovDimitrov · 2026-02-06T15:04:12Z

.../java/org/cloudfoundry/multiapps/controller/process/security/store/SecretTokenStoreImpl.java

+        secretTokenService.createQuery()
+                          .processInstanceId(processInstanceId)
+                          .delete();
+        LOGGER.debug(MessageFormat.format(Messages.DELETED_SECRET_TOKENS_FOR_PROCESS_WITH_ID_0, processInstanceId));


track how many rows were affected

IvanBorislavovDimitrov · 2026-02-06T15:04:22Z

.../java/org/cloudfoundry/multiapps/controller/process/security/store/SecretTokenStoreImpl.java

+    }
+
+    @Override
+    public void deleteByProcessInstanceId(String processInstanceId) {


IvanBorislavovDimitrov · 2026-02-06T15:05:52Z

...cloudfoundry/multiapps/controller/process/security/store/SecretTokenStoreImplWithoutKey.java

+    @Override
+    public void deleteByProcessInstanceId(String processInstanceId) {
+        secretTokenService.createQuery()
+                          .processInstanceId(processInstanceId)
+                          .delete();
+        LOGGER.debug(MessageFormat.format(Messages.DELETED_SECRET_TOKENS_FOR_PROCESS_WITH_ID_0, processInstanceId));
+    }
+
+    @Override
+    public int deleteOlderThan(LocalDateTime expirationTime) {
+        int result = secretTokenService.createQuery()
+                                       .olderThan(expirationTime)
+                                       .delete();
+        LOGGER.debug(MessageFormat.format(Messages.DELETED_SECRET_TOKENS_WITH_EXPIRATION_DATE_0, expirationTime));
+        return result;
+    }


can you reuse the methods?
Rename SecretTokenStoreImplWithoutKey -> SecretTokenStoreForDeletion
SecretTokenStoreImpl extends SecretTokenStoreForDeletion

IvanBorislavovDimitrov · 2026-02-06T15:10:34Z

.../main/java/org/cloudfoundry/multiapps/controller/process/security/SecretTokenSerializer.java

+
+    @Override
+    public Object serialize(T value) {
+        Object encodedObject = serializer.serialize(value);


rename to serializedObject because it is still not encoded

IvanBorislavovDimitrov · 2026-02-06T15:47:33Z

...in/java/org/cloudfoundry/multiapps/controller/process/steps/SecureProcessContextFactory.java

+import org.immutables.value.Value;
+
+@Value.Immutable
+public abstract class SecureProcessContextFactory {


use interface with a default method for ofSecureProcessContext

IvanBorislavovDimitrov · 2026-02-06T15:48:37Z

...in/java/org/cloudfoundry/multiapps/controller/process/util/OperationInFinalStateHandler.java

+                                                                                    Variables.DISPOSABLE_USER_PROVIDED_SERVICE_NAME);
+            clientProvider.getControllerClient(userGuid, spaceGuid, correlationId)
+                          .deleteServiceInstance(disposableUserProvidedServiceInstanceName);
+            LOGGER.debug(


IvanBorislavovDimitrov · 2026-02-06T15:49:05Z

...in/java/org/cloudfoundry/multiapps/controller/process/util/OperationInFinalStateHandler.java


    }

+    private void deleteSecretTokensForProcess(Operation.State state, String correlationId, DelegateExecution execution) {


execution not used

IvanBorislavovDimitrov · 2026-02-06T15:49:24Z

...ontroller-process/src/main/java/org/cloudfoundry/multiapps/controller/process/Constants.java

    public static final Long UNSET_LAST_LOG_TIMESTAMP_MS = 0L;
    public static final int LOG_STALLED_TASK_MINUTE_INTERVAL = 5;
+    public static final long TTL_CACHE_ENTRY = 60_000L;
+    public static final int MAX_CACHE_ENTRIES = 256;


IvanBorislavovDimitrov · 2026-02-06T15:53:01Z

...test/java/org/cloudfoundry/multiapps/controller/process/steps/ProcessDescriptorStepTest.java

    private MtaDescriptorPropertiesResolver resolver;
    @Mock
    private ModuleToDeployHelper moduleToDeployHelper;
+    //    @Mock


karrgov force-pushed the passing_secrets_during_deployment_new branch from f0f4384 to 7208ebc Compare December 19, 2025 18:10

vkalapov requested changes Jan 5, 2026

View reviewed changes

IvanBorislavovDimitrov reviewed Jan 7, 2026

View reviewed changes

.../org/cloudfoundry/multiapps/controller/process/steps/ProcessMtaExtensionDescriptorsStep.java Outdated Show resolved Hide resolved

karrgov force-pushed the passing_secrets_during_deployment_new branch from 7208ebc to 148d46c Compare January 22, 2026 14:11

IvanBorislavovDimitrov reviewed Jan 23, 2026

View reviewed changes

vkalapov requested changes Jan 23, 2026

View reviewed changes

vkalapov requested changes Jan 26, 2026

View reviewed changes

karrgov added 4 commits January 30, 2026 13:13

Enabling using secret values during a deployment

2feafbd

LMCROSSITXSADEPLOY-2301

Fixings of comments

a6078e5

LMCROSSITXSADEPLOY-2301

Adding the Ali cloud exclusion of bouncy castle

4424077

LMCROSSITXSADEPLOY-2301

Fixing comments and adding additional new disposable UPS functionality

5fa31a4

LMCROSSITXSADEPLOY-2301

karrgov force-pushed the passing_secrets_during_deployment_new branch from cb60e46 to 5fa31a4 Compare February 2, 2026 18:29

Adding logging for testing purposes - flowable problem

ae8c16d

LMCROSSITXSADEPLOY-2301

vkalapov requested changes Feb 4, 2026

View reviewed changes

karrgov added 3 commits February 4, 2026 17:16

Adding fixes after disposable UPS functionality

0f099c6

LMCROSSITXSADEPLOY-2301

Fixing failing of Serializer and tests

d84ffcb

LMCROSSITXSADEPLOY-2301

Fixing missing mtaId, which caused problems during bg deploy

bc82639

LMCROSSITXSADEPLOY-2301

IvanBorislavovDimitrov reviewed Feb 6, 2026

View reviewed changes

		Set<String> secretParameters = VariableHandling.get(execution, Variables.SECURE_EXTENSION_DESCRIPTOR_PARAMETER_NAMES);
		DynamicSecureSerialization dynamicSecureSerialization = SecureSerializationFactory.ofAdditionalValues(secretParameters);

		@@ -0,0 +1,17 @@
		package org.cloudfoundry.multiapps.controller.process.security.resolver;

		public class MissingCredentialsFromUserProvidedServiceEncryptionRelated extends RuntimeException {

		private void getParametersAndPropertiesPerModule(MultiValuedMap<String, String> multiValuedMap, Module module, boolean isRequired,
		boolean isWhole, boolean isProvided) {


		private final CloudControllerClientProvider cloudControllerClientProvider;

		private final Duration containerExpirationTime = Duration.ofMinutes(Constants.TTL_CACHE_ENTRY);


		}

		private void deleteSecretTokensForProcess(Operation.State state, String correlationId, DelegateExecution execution) {

Enabling using secret values during a deployment #1755

Are you sure you want to change the base?

Enabling using secret values during a deployment #1755

Uh oh!

Conversation

karrgov commented Dec 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!