auth: Stop mentioning 'global' secrets in API.

auth: Stop mentioning 'global' secrets in API.

There's no global secrets anymore, they are always local.

R=iannucci@chromium.org
BUG=712507
Review-Url: https://codereview.chromium.org/2854853005
Committed: https://github.com/luci/luci-py/commit/48827429b285dc91ba2fe1bc3dcb2ad55b76f972

[Vadim Sh., 2017-05-03 20:48:43]

PTAL, just code removal

https://codereview.chromium.org/2854853005/diff/1/appengine/components/compon...
File appengine/components/components/auth/api.py (right):

https://codereview.chromium.org/2854853005/diff/1/appengine/components/compon...
appengine/components/components/auth/api.py:117: SecretKey =
collections.namedtuple('SecretKey', ['name'])
I decided to keep it since it gives a nice type clue into what code to search
for

e.g. compare 
secret_key = "some_stuff" 
vs 
secret_key = auth.SecretKey("some_stuff").

https://codereview.chromium.org/2854853005/diff/1/appengine/components/compon...
File appengine/components/components/auth/model.py (right):

https://codereview.chromium.org/2854853005/diff/1/appengine/components/compon...
appengine/components/components/auth/model.py:944: # TODO(vadimsh): Move secrets
outside of AuthGlobalConfig entity group and
this entities will be moved elsewhere in future CLs, they don't have to be in
this entity group anymore (and in fact, it will be harmful in the future when I
introduce secrets rotation).

I plan to keep all secrets into single big entity (well... I'm pretty sure it
will be <1Kb in size), and encrypt this entity with Cloud KMS. When GAE
instances start, they'll load and decrypt this entity and keep it in memory
(periodically refreshing it).

There'll be separate cron that periodically rotates secrets there and reencypts
it with fresh KMS keys (that are rotated automatically by Cloud KMS).

[Vadim Sh., 2017-05-03 20:49:35]

The CQ bit was checked by vadimsh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-05-03 20:49:46]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-03 20:53:35]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-03 20:53:36]

Dry run: This issue passed the CQ dry run.

[iannucci, 2017-05-04 21:22:04]

lgtm

[Vadim Sh., 2017-05-08 21:05:32]

The CQ bit was checked by vadimsh@chromium.org

[commit-bot: I haz the power, 2017-05-08 21:05:36]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-08 21:10:09]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1494277532018200, "parent_rev":
"5696c8ab3dec134e955a606bd552798f8fe8f8c1", "commit_rev":
"48827429b285dc91ba2fe1bc3dcb2ad55b76f972"}

[commit-bot: I haz the power, 2017-05-08 21:10:12]

Description was changed from

==========
auth: Stop mentioning 'global' secrets in API.

There's no global secrets anymore, they are always local.

R=iannucci@chromium.org
BUG=712507
==========

to

==========
auth: Stop mentioning 'global' secrets in API.

There's no global secrets anymore, they are always local.

R=iannucci@chromium.org
BUG=712507

Review-Url: https://codereview.chromium.org/2854853005
Committed:
https://github.com/luci/luci-py/commit/48827429b285dc91ba2fe1bc3dcb2ad55b76f972
==========

[commit-bot: I haz the power, 2017-05-08 21:10:13]

Committed patchset #1 (id:1) as
https://github.com/luci/luci-py/commit/48827429b285dc91ba2fe1bc3dcb2ad55b76f972