refactor: move provider metric constants (#6883)

Preparation for v2: Cleanup code base
of provider content.

We could get rid of all provider constants present
in runtime (if I find others I will tackle those
separately), so I did it.

Yeah, each provider now carries its own constants.
I kept them exported in case some provider would
import some other providers.

Yes, I know it breaks the people importing
runtime/, but we explicitly said this was not
considering a _deployer breaking change_ so I am
not marking them as such.

it's a way to move forward for v2...

Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>
Co-authored-by: Alexander Chernov <alexander@chernov.it>

AGENTS.md

@@ -50,7 +50,7 @@ Build tags live in `pkg/register/<name>.go`.
 - `runtime/esutils.FetchCACertFromSource(ctx, esutils.CreateCertOpts{...})` for CA bundles.
 - `runtime/esutils.ValidateSecretSelector` / `ValidateReferentSecretSelector` / `ValidateServiceAccountSelector` for spec validation.
 - `runtime/esutils/metadata` for parsing `PushSecretMetadata` into a typed spec.
-- `runtime/constants` for metric label values.
+- `runtime/metrics.ObserveAPICall` for provider API metrics. Keep provider and call label constants in the provider package.
 
 ### `SecretsClient` contract
 

providers/v1/akeyless/akeyless_api.go

@@ -37,7 +37,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -89,7 +88,7 @@ func (a *akeylessBase) GetToken(ctx context.Context, accessID, accType, accTypeP
 	}
 
 	authOut, res, err := a.RestAPI.Auth(ctx).Body(*authBody).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMAuth, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMAuth, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return "", fmt.Errorf("authentication failed: %v", string(apiErr.Body()))
 	}
@@ -149,7 +148,7 @@ func (a *akeylessBase) DescribeItem(ctx context.Context, itemName string) (*akey
 		return nil, err
 	}
 	gsvOut, res, err := a.RestAPI.DescribeItem(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMDescribeItem, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMDescribeItem, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		if res.StatusCode == http.StatusNotFound {
 			return nil, ErrItemNotExists
@@ -178,7 +177,7 @@ func (a *akeylessBase) GetCertificate(ctx context.Context, certificateName strin
 		return "", err
 	}
 	gcvOut, res, err := a.RestAPI.GetCertificateValue(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMGetCertificateValue, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMGetCertificateValue, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return "", fmt.Errorf("can't get certificate value: %v", string(apiErr.Body()))
 	}
@@ -209,7 +208,7 @@ func (a *akeylessBase) GetRotatedSecrets(ctx context.Context, secretName string,
 		return "", err
 	}
 	gsvOut, res, err := a.RestAPI.GetRotatedSecretValue(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMGetRotatedSecretValue, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMGetRotatedSecretValue, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return "", fmt.Errorf("can't get rotated secret value: %v", string(apiErr.Body()))
 	}
@@ -250,7 +249,7 @@ func (a *akeylessBase) GetDynamicSecrets(ctx context.Context, secretName string)
 		return "", err
 	}
 	gsvOut, res, err := a.RestAPI.GetDynamicSecretValue(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMGetDynamicSecretValue, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMGetDynamicSecretValue, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return "", fmt.Errorf("can't get dynamic secret value: %v", string(apiErr.Body()))
 	}
@@ -279,7 +278,7 @@ func (a *akeylessBase) GetStaticSecret(ctx context.Context, secretName string, v
 		return "", err
 	}
 	gsvOut, res, err := a.RestAPI.GetSecretValue(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMGetSecretValue, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMGetSecretValue, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return "", fmt.Errorf("can't get secret value: %v", string(apiErr.Body()))
 	}
@@ -329,7 +328,7 @@ func (a *akeylessBase) ListSecrets(ctx context.Context, path, tag string) ([]str
 		return nil, err
 	}
 	lipOut, res, err := a.RestAPI.ListItems(ctx).Body(body).Execute()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMListItems, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMListItems, err)
 	if apiErr, ok := errors.AsType[akeyless.GenericOpenAPIError](err); ok {
 		return nil, fmt.Errorf("can't get secrets list: %v", string(apiErr.Body()))
 	}
@@ -365,7 +364,7 @@ func (a *akeylessBase) CreateSecret(ctx context.Context, remoteKey, data string)
 	defer func() {
 		_ = res.Body.Close()
 	}()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMCreateSecret, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMCreateSecret, err)
 	return err
 }
 
@@ -381,7 +380,7 @@ func (a *akeylessBase) UpdateSecret(ctx context.Context, remoteKey, data string)
 	defer func() {
 		_ = res.Body.Close()
 	}()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMUpdateSecretVal, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMUpdateSecretVal, err)
 	return err
 }
 
@@ -396,7 +395,7 @@ func (a *akeylessBase) DeleteSecret(ctx context.Context, remoteKey string) error
 	defer func() {
 		_ = res.Body.Close()
 	}()
-	metrics.ObserveAPICall(constants.ProviderAKEYLESSSM, constants.CallAKEYLESSSMDeleteItem, err)
+	metrics.ObserveAPICall(ProviderAKEYLESSSM, CallAKEYLESSSMDeleteItem, err)
 	return err
 }
 

providers/v1/akeyless/constants.go

@@ -0,0 +1,32 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package akeyless
+
+// Metrics constants identify the Akeyless provider and API calls.
+const (
+	ProviderAKEYLESSSM                  = "AKEYLESSLESS/SecretsManager"
+	CallAKEYLESSSMGetSecretValue        = "GetSecretValue"
+	CallAKEYLESSSMDescribeItem          = "DescribeItem"
+	CallAKEYLESSSMListItems             = "ListItems"
+	CallAKEYLESSSMAuth                  = "Auth"
+	CallAKEYLESSSMGetRotatedSecretValue = "GetRotatedSecretValue"
+	CallAKEYLESSSMGetCertificateValue   = "GetCertificateValue"
+	CallAKEYLESSSMGetDynamicSecretValue = "GetDynamicSecretsValue"
+	CallAKEYLESSSMCreateSecret          = "CreateSecret"
+	CallAKEYLESSSMUpdateSecretVal       = "UpdateSecretVal"
+	CallAKEYLESSSMDeleteItem            = "DeleteItem"
+)

providers/v1/aws/certificatemanager/certificatemanager.go

@@ -44,7 +44,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	awsutil "github.com/external-secrets/external-secrets/providers/v1/aws/util"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -241,7 +240,7 @@ func (cm *CertificateManager) reimportCertificate(ctx context.Context, arn strin
 	log.Info("re-importing existing ACM certificate", "arn", arn, "remoteKey", remoteKey)
 
 	_, err = cm.client.ImportCertificate(ctx, input)
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMImportCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMImportCertificate, err)
 	if err != nil {
 		return fmt.Errorf("failed to import certificate: %w", awsutil.SanitizeErr(err))
 	}
@@ -267,7 +266,7 @@ func (cm *CertificateManager) importNewCertificate(ctx context.Context, b certBu
 	log.Info("importing new ACM certificate", "remoteKey", remoteKey)
 
 	out, err := cm.client.ImportCertificate(ctx, input)
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMImportCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMImportCertificate, err)
 	if err != nil {
 		return fmt.Errorf("failed to import certificate: %w", awsutil.SanitizeErr(err))
 	}
@@ -327,7 +326,7 @@ func (cm *CertificateManager) DeleteSecret(ctx context.Context, remoteRef esv1.P
 	_, err = cm.client.DeleteCertificate(ctx, &acm.DeleteCertificateInput{
 		CertificateArn: aws.String(arn),
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMDeleteCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMDeleteCertificate, err)
 	if err != nil {
 		return fmt.Errorf("failed to delete certificate %s: %w", arn, awsutil.SanitizeErr(err))
 	}
@@ -357,7 +356,7 @@ func (cm *CertificateManager) GetSecret(ctx context.Context, ref esv1.ExternalSe
 	descCertOut, err := cm.client.DescribeCertificate(ctx, &acm.DescribeCertificateInput{
 		CertificateArn: aws.String(certARN),
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMDescribeCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMDescribeCertificate, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to describe certificate %s: %w", certARN, awsutil.SanitizeErr(err))
 	}
@@ -376,7 +375,7 @@ func (cm *CertificateManager) GetSecret(ctx context.Context, ref esv1.ExternalSe
 		CertificateArn: aws.String(certARN),
 		Passphrase:     passphrase,
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMExportCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMExportCertificate, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to export certificate %s: %w", certARN, awsutil.SanitizeErr(err))
 	}
@@ -451,7 +450,7 @@ func (cm *CertificateManager) searchCertificatesByTag(ctx context.Context, remot
 	var arns []string
 	for paginator.HasMorePages() {
 		out, err := paginator.NextPage(ctx)
-		metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMGetResources, err)
+		metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMGetResources, err)
 		if err != nil {
 			return "", awsutil.SanitizeErr(err)
 		}
@@ -478,7 +477,7 @@ func (cm *CertificateManager) getCertificate(ctx context.Context, arn string) (*
 	out, err := cm.client.GetCertificate(ctx, &acm.GetCertificateInput{
 		CertificateArn: aws.String(arn),
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMGetCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMGetCertificate, err)
 	if err != nil {
 		var aerr smithy.APIError
 		if errors.As(err, &aerr) && aerr.ErrorCode() == errResourceNotFound {
@@ -493,7 +492,7 @@ func (cm *CertificateManager) listTags(ctx context.Context, arn string) ([]types
 	out, err := cm.client.ListTagsForCertificate(ctx, &acm.ListTagsForCertificateInput{
 		CertificateArn: aws.String(arn),
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMListTagsForCertificate, err)
+	metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMListTagsForCertificate, err)
 	if err != nil {
 		var aerr smithy.APIError
 		if errors.As(err, &aerr) && aerr.ErrorCode() == errResourceNotFound {
@@ -517,7 +516,7 @@ func (cm *CertificateManager) syncTags(ctx context.Context, arn string, desiredT
 			CertificateArn: aws.String(arn),
 			Tags:           toRemove,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMRemoveTagsFromCertificate, err)
+		metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMRemoveTagsFromCertificate, err)
 		if err != nil {
 			return awsutil.SanitizeErr(err)
 		}
@@ -528,7 +527,7 @@ func (cm *CertificateManager) syncTags(ctx context.Context, arn string, desiredT
 			CertificateArn: aws.String(arn),
 			Tags:           toAdd,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSACM, constants.CallAWSACMAddTagsToCertificate, err)
+		metrics.ObserveAPICall(ProviderAWSACM, CallAWSACMAddTagsToCertificate, err)
 		if err != nil {
 			return awsutil.SanitizeErr(err)
 		}

providers/v1/aws/certificatemanager/constants.go

@@ -0,0 +1,32 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificatemanager
+
+// Metrics constants identify the AWS Certificate Manager provider and API calls.
+const (
+	ProviderAWSACM                      = "AWS/CertificateManager"
+	CallAWSACMImportCertificate         = "ImportCertificate"
+	CallAWSACMDeleteCertificate         = "DeleteCertificate"
+	CallAWSACMListCertificates          = "ListCertificates"
+	CallAWSACMAddTagsToCertificate      = "AddTagsToCertificate"
+	CallAWSACMListTagsForCertificate    = "ListTagsForCertificate"
+	CallAWSACMRemoveTagsFromCertificate = "RemoveTagsFromCertificate"
+	CallAWSACMDescribeCertificate       = "DescribeCertificate"
+	CallAWSACMExportCertificate         = "ExportCertificate"
+	CallAWSACMGetCertificate            = "GetCertificate"
+	CallAWSACMGetResources              = "GetResources"
+)

providers/v1/aws/parameterstore/constants.go

@@ -0,0 +1,30 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parameterstore
+
+// Metrics constants identify the AWS Parameter Store provider and API calls.
+const (
+	ProviderAWSPS                = "AWS/ParameterStore"
+	CallAWSPSGetParameter        = "GetParameter"
+	CallAWSPSGetParametersByPath = "GetParametersByPath"
+	CallAWSPSPutParameter        = "PutParameter"
+	CallAWSPSDeleteParameter     = "DeleteParameter"
+	CallAWSPSDescribeParameter   = "DescribeParameter"
+	CallAWSPSRemoveTagsParameter = "RemoveTagsFromResource"
+	CallAWSPSAddTagsParameter    = "AddTagsToResource"
+	CallAWSPSListTagsForResource = "ListTagsForResource"
+)

providers/v1/aws/parameterstore/parameterstore.go

@@ -35,7 +35,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	awsutil "github.com/external-secrets/external-secrets/providers/v1/aws/util"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/find"
@@ -113,7 +112,7 @@ func (pm *ParameterStore) getTagsByName(ctx context.Context, ref *ssm.GetParamet
 	}
 
 	data, err := pm.client.ListTagsForResource(ctx, &parameterTags)
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSListTagsForResource, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSListTagsForResource, err)
 	if err != nil {
 		return nil, fmt.Errorf("error listing tags %w", err)
 	}
@@ -133,7 +132,7 @@ func (pm *ParameterStore) DeleteSecret(ctx context.Context, remoteRef esv1.PushS
 		Name: &secretName,
 	}
 	existing, err := pm.client.GetParameter(ctx, &secretValue)
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSGetParameter, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSGetParameter, err)
 	var parameterNotFoundErr *ssmTypes.ParameterNotFound
 	ok := errors.As(err, &parameterNotFoundErr)
 	if err != nil && !ok {
@@ -155,7 +154,7 @@ func (pm *ParameterStore) DeleteSecret(ctx context.Context, remoteRef esv1.PushS
 			Name: &secretName,
 		}
 		_, err = pm.client.DeleteParameter(ctx, deleteInput)
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSDeleteParameter, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSDeleteParameter, err)
 		if err != nil {
 			return fmt.Errorf("could not delete parameter %v: %w", secretName, err)
 		}
@@ -246,7 +245,7 @@ func (pm *ParameterStore) PushSecret(ctx context.Context, secret *corev1.Secret,
 	}
 
 	existing, err := pm.client.GetParameter(ctx, &secretValue)
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSGetParameter, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSGetParameter, err)
 	var parameterNotFoundErr *ssmTypes.ParameterNotFound
 	ok := errors.As(err, &parameterNotFoundErr)
 	if err != nil && !ok {
@@ -314,7 +313,7 @@ func (pm *ParameterStore) setExisting(ctx context.Context, existing *ssm.GetPara
 			ResourceType: ssmTypes.ResourceTypeForTaggingParameter,
 			TagKeys:      tagKeysToRemove,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSRemoveTagsParameter, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSRemoveTagsParameter, err)
 		if err != nil {
 			return err
 		}
@@ -327,7 +326,7 @@ func (pm *ParameterStore) setExisting(ctx context.Context, existing *ssm.GetPara
 			ResourceType: ssmTypes.ResourceTypeForTaggingParameter,
 			Tags:         tagsToUpdate,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSAddTagsParameter, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSAddTagsParameter, err)
 		if err != nil {
 			return err
 		}
@@ -349,7 +348,7 @@ func (pm *ParameterStore) setManagedRemoteParameter(ctx context.Context, secretR
 	}
 
 	_, err := pm.client.PutParameter(ctx, &secretRequest)
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSPutParameter, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSPutParameter, err)
 	if err != nil {
 		return fmt.Errorf("unexpected error pushing parameter %v: %w", secretRequest.Name, err)
 	}
@@ -387,7 +386,7 @@ func (pm *ParameterStore) findByName(ctx context.Context, ref esv1.ExternalSecre
 				Recursive:      aws.Bool(true),
 				WithDecryption: aws.Bool(true),
 			})
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSGetParametersByPath, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSGetParametersByPath, err)
 		if err != nil {
 			var apiErr smithy.APIError
 			if errors.As(err, &apiErr) && apiErr.ErrorCode() == errCodeAccessDeniedException {
@@ -437,7 +436,7 @@ func (pm *ParameterStore) fallbackFindByName(ctx context.Context, ref esv1.Exter
 				NextToken:        nextToken,
 				ParameterFilters: pathFilter,
 			})
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSDescribeParameter, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSDescribeParameter, err)
 		if err != nil {
 			return nil, err
 		}
@@ -486,7 +485,7 @@ func (pm *ParameterStore) findByTags(ctx context.Context, ref esv1.ExternalSecre
 				ParameterFilters: filters,
 				NextToken:        nextToken,
 			})
-		metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSDescribeParameter, err)
+		metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSDescribeParameter, err)
 		if err != nil {
 			return nil, err
 		}
@@ -510,7 +509,7 @@ func (pm *ParameterStore) fetchAndSet(ctx context.Context, data map[string][]byt
 		Name:           new(name),
 		WithDecryption: aws.Bool(true),
 	})
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSGetParameter, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSGetParameter, err)
 	if err != nil {
 		return awsutil.SanitizeErr(err)
 	}
@@ -528,7 +527,7 @@ func (pm *ParameterStore) GetSecret(ctx context.Context, ref esv1.ExternalSecret
 	} else {
 		out, err = pm.getParameterValue(ctx, ref)
 	}
-	metrics.ObserveAPICall(constants.ProviderAWSPS, constants.CallAWSPSGetParameter, err)
+	metrics.ObserveAPICall(ProviderAWSPS, CallAWSPSGetParameter, err)
 	nsf := esv1.NoSecretError{}
 	var nf *ssmTypes.ParameterNotFound
 	if errors.As(err, &nf) || errors.As(err, &nsf) {

providers/v1/aws/secretsmanager/constants.go

@@ -0,0 +1,36 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package secretsmanager
+
+// Metrics constants identify the AWS Secrets Manager provider and API calls.
+const (
+	ProviderAWSSM                         = "AWS/SecretsManager"
+	CallAWSSMGetSecretValue               = "GetSecretValue"
+	CallAWSSMDescribeSecret               = "DescribeSecret"
+	CallAWSSMDeleteSecret                 = "DeleteSecret"
+	CallAWSSMCreateSecret                 = "CreateSecret"
+	CallAWSSMPutSecretValue               = "PutSecretValue"
+	CallAWSSMListSecrets                  = "ListSecrets"
+	CallAWSSMBatchGetSecretValue          = "BatchGetSecretValue"
+	CallAWSSMUntagResource                = "UntagResource"
+	CallAWSSMTagResource                  = "TagResource"
+	CallAWSSMPutResourcePolicy            = "PutResourcePolicy"
+	CallAWSSMGetResourcePolicy            = "GetResourcePolicy"
+	CallAWSSMDeleteResourcePolicy         = "DeleteResourcePolicy"
+	CallAWSSMReplicateSecretToRegions     = "ReplicateSecretToRegions"
+	CallAWSSMRemoveRegionsFromReplication = "RemoveRegionsFromReplication"
+)

providers/v1/aws/secretsmanager/secretsmanager.go

@@ -40,7 +40,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	awsutil "github.com/external-secrets/external-secrets/providers/v1/aws/util"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/find"
@@ -180,7 +179,7 @@ func (sm *SecretsManager) DeleteSecret(ctx context.Context, remoteRef esv1.PushS
 		SecretId: &secretName,
 	}
 	awsSecret, err := sm.client.GetSecretValue(ctx, &secretValue)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMGetSecretValue, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMGetSecretValue, err)
 	var aerr smithy.APIError
 	if err != nil {
 		if ok := errors.As(err, &aerr); !ok {
@@ -192,7 +191,7 @@ func (sm *SecretsManager) DeleteSecret(ctx context.Context, remoteRef esv1.PushS
 		return err
 	}
 	data, err := sm.client.DescribeSecret(ctx, &secretInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMDescribeSecret, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMDescribeSecret, err)
 	if err != nil {
 		return err
 	}
@@ -222,7 +221,7 @@ func (sm *SecretsManager) DeleteSecret(ctx context.Context, remoteRef esv1.PushS
 		return err
 	}
 	_, err = sm.client.DeleteSecret(ctx, deleteInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMDeleteSecret, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMDeleteSecret, err)
 	return err
 }
 
@@ -260,7 +259,7 @@ func (sm *SecretsManager) PushSecret(ctx context.Context, secret *corev1.Secret,
 	secretName := sm.prefix + psd.GetRemoteKey()
 	describeSecretInput := awssm.DescribeSecretInput{SecretId: &secretName}
 	describeSecretOutput, err := sm.client.DescribeSecret(ctx, &describeSecretInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMDescribeSecret, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMDescribeSecret, err)
 	var aerr smithy.APIError
 	if err != nil {
 		if ok := errors.As(err, &aerr); !ok {
@@ -288,7 +287,7 @@ func (sm *SecretsManager) PushSecret(ctx context.Context, secret *corev1.Secret,
 
 	getSecretValueInput := awssm.GetSecretValueInput{SecretId: &secretName}
 	getSecretValueOutput, err := sm.client.GetSecretValue(ctx, &getSecretValueInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMGetSecretValue, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMGetSecretValue, err)
 	if err != nil {
 		return err
 	}
@@ -393,7 +392,7 @@ func (sm *SecretsManager) findByName(ctx context.Context, ref esv1.ExternalSecre
 			Filters:   filters,
 			NextToken: nextToken,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMListSecrets, err)
+		metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMListSecrets, err)
 		if err != nil {
 			return nil, err
 		}
@@ -601,7 +600,7 @@ func (sm *SecretsManager) createSecretWithContext(ctx context.Context, secretNam
 	}
 
 	createOutput, err := sm.client.CreateSecret(ctx, input)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMCreateSecret, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMCreateSecret, err)
 	if err != nil {
 		return err
 	}
@@ -622,7 +621,7 @@ func (sm *SecretsManager) createSecretWithContext(ctx context.Context, secretNam
 		}
 
 		_, err = sm.client.PutResourcePolicy(ctx, putPolicyInput)
-		metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMPutResourcePolicy, err)
+		metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMPutResourcePolicy, err)
 		if err != nil {
 			return fmt.Errorf("failed to put resource policy: %w", err)
 		}
@@ -682,7 +681,7 @@ func (sm *SecretsManager) putSecretValueWithContext(
 	}
 
 	_, err = sm.client.PutSecretValue(ctx, input)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMPutSecretValue, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMPutSecretValue, err)
 	return err
 }
 
@@ -706,7 +705,7 @@ func (sm *SecretsManager) patchTags(ctx context.Context, rawMetadata *apiextensi
 			SecretId: secretID,
 			TagKeys:  tagKeysToRemove,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMUntagResource, err)
+		metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMUntagResource, err)
 		if err != nil {
 			return err
 		}
@@ -718,7 +717,7 @@ func (sm *SecretsManager) patchTags(ctx context.Context, rawMetadata *apiextensi
 			SecretId: secretID,
 			Tags:     tagsToUpdate,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMTagResource, err)
+		metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMTagResource, err)
 		if err != nil {
 			return err
 		}
@@ -735,7 +734,7 @@ func (sm *SecretsManager) fetchWithBatch(ctx context.Context, filters []types.Fi
 			Filters:   filters,
 			NextToken: nextToken,
 		})
-		metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMBatchGetSecretValue, err)
+		metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMBatchGetSecretValue, err)
 		if err != nil {
 			return nil, err
 		}
@@ -805,7 +804,7 @@ func (sm *SecretsManager) constructSecretValue(ctx context.Context, key, ver str
 		}
 	}
 	secretOut, err := sm.client.GetSecretValue(ctx, getSecretValueInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMGetSecretValue, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMGetSecretValue, err)
 	var (
 		nf *types.ResourceNotFoundException
 		ie *types.InvalidParameterException
@@ -920,7 +919,7 @@ func (sm *SecretsManager) deleteResourcePolicy(ctx context.Context, secretID *st
 		SecretId: secretID,
 	}
 	_, err := sm.client.DeleteResourcePolicy(ctx, deletePolicyInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMDeleteResourcePolicy, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMDeleteResourcePolicy, err)
 
 	var nf *types.ResourceNotFoundException
 	if err != nil && !errors.As(err, &nf) {
@@ -954,7 +953,7 @@ func (sm *SecretsManager) manageResourcePolicy(ctx context.Context, metadata *ap
 		SecretId: secretID,
 	}
 	currentPolicyOutput, err := sm.client.GetResourcePolicy(ctx, getCurrentPolicyInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMGetResourcePolicy, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMGetResourcePolicy, err)
 
 	var nf *types.ResourceNotFoundException
 	if err != nil && !errors.As(err, &nf) {
@@ -989,7 +988,7 @@ func (sm *SecretsManager) manageResourcePolicy(ctx context.Context, metadata *ap
 	}
 
 	_, err = sm.client.PutResourcePolicy(ctx, putPolicyInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMPutResourcePolicy, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMPutResourcePolicy, err)
 	if err != nil {
 		return fmt.Errorf("failed to put resource policy: %w", err)
 	}
@@ -1053,7 +1052,7 @@ func (sm *SecretsManager) replicateExistingSecretToRegions(ctx context.Context,
 		SecretId:          secretID,
 	}
 	_, err := sm.client.ReplicateSecretToRegions(ctx, replicateSecretToRegionsInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMReplicateSecretToRegions, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMReplicateSecretToRegions, err)
 	if err != nil {
 		return fmt.Errorf("failed to replicate existing secret to regions: %w", err)
 	}
@@ -1066,7 +1065,7 @@ func (sm *SecretsManager) removeRegionsFromReplication(ctx context.Context, secr
 		SecretId:             secretID,
 	}
 	_, err := sm.client.RemoveRegionsFromReplication(ctx, removeRegionsFromReplicationInput)
-	metrics.ObserveAPICall(constants.ProviderAWSSM, constants.CallAWSSMRemoveRegionsFromReplication, err)
+	metrics.ObserveAPICall(ProviderAWSSM, CallAWSSMRemoveRegionsFromReplication, err)
 	if err != nil {
 		return fmt.Errorf("failed to remove regions from secret replication: %w", err)
 	}

providers/v1/azure/keyvault/constants.go

@@ -0,0 +1,32 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package keyvault
+
+// Metrics constants identify the Azure Key Vault provider and API calls.
+const (
+	ProviderAzureKV              = "Azure/KeyVault"
+	CallAzureKVGetKey            = "GetKey"
+	CallAzureKVDeleteKey         = "DeleteKey"
+	CallAzureKVImportKey         = "ImportKey"
+	CallAzureKVGetSecret         = "GetSecret"
+	CallAzureKVGetSecrets        = "GetSecrets"
+	CallAzureKVSetSecret         = "SetSecret"
+	CallAzureKVDeleteSecret      = "DeleteSecret"
+	CallAzureKVGetCertificate    = "GetCertificate"
+	CallAzureKVDeleteCertificate = "DeleteCertificate"
+	CallAzureKVImportCertificate = "ImportCertificate"
+)

providers/v1/azure/keyvault/keyvault.go

@@ -61,7 +61,6 @@ import (
 	gopkcs12 "software.sslmate.com/src/go-pkcs12"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
@@ -373,14 +372,14 @@ func canDelete(tags map[string]*string, err error) (bool, error) {
 
 func (a *Azure) deleteKeyVaultKey(ctx context.Context, keyName string) error {
 	value, err := a.baseClient.GetKey(ctx, *a.provider.VaultURL, keyName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 	ok, err := canDelete(value.Tags, err)
 	if err != nil {
 		return fmt.Errorf("error getting key %v: %w", keyName, err)
 	}
 	if ok {
 		_, err = a.baseClient.DeleteKey(ctx, *a.provider.VaultURL, keyName)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteKey, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteKey, err)
 		if err != nil {
 			return fmt.Errorf("error deleting key %v: %w", keyName, err)
 		}
@@ -390,14 +389,14 @@ func (a *Azure) deleteKeyVaultKey(ctx context.Context, keyName string) error {
 
 func (a *Azure) deleteKeyVaultSecret(ctx context.Context, secretName string) error {
 	value, err := a.baseClient.GetSecret(ctx, *a.provider.VaultURL, secretName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 	ok, err := canDelete(value.Tags, err)
 	if err != nil {
 		return fmt.Errorf("error getting secret %v: %w", secretName, err)
 	}
 	if ok {
 		_, err = a.baseClient.DeleteSecret(ctx, *a.provider.VaultURL, secretName)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteSecret, err)
 		if err != nil {
 			return fmt.Errorf("error deleting secret %v: %w", secretName, err)
 		}
@@ -407,14 +406,14 @@ func (a *Azure) deleteKeyVaultSecret(ctx context.Context, secretName string) err
 
 func (a *Azure) deleteKeyVaultCertificate(ctx context.Context, certName string) error {
 	value, err := a.baseClient.GetCertificate(ctx, *a.provider.VaultURL, certName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 	ok, err := canDelete(value.Tags, err)
 	if err != nil {
 		return fmt.Errorf("error getting certificate %v: %w", certName, err)
 	}
 	if ok {
 		_, err = a.baseClient.DeleteCertificate(ctx, *a.provider.VaultURL, certName)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteCertificate, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteCertificate, err)
 		if err != nil {
 			return fmt.Errorf("error deleting certificate %v: %w", certName, err)
 		}
@@ -576,7 +575,7 @@ func legacySecretUnchanged(secret keyvault.SecretBundle, value []byte, expires *
 
 func (a *Azure) setKeyVaultSecret(ctx context.Context, secretName string, value []byte, expires *date.UnixTime, contentType *string, tags map[string]string) error {
 	secret, err := a.baseClient.GetSecret(ctx, *a.provider.VaultURL, secretName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 	ok, err := canCreate(secret.Tags, err)
 	if err != nil {
 		return fmt.Errorf("cannot get secret %v: %w", secretName, err)
@@ -614,7 +613,7 @@ func (a *Azure) setKeyVaultSecret(ctx context.Context, secretName string, value
 	}
 
 	_, err = a.baseClient.SetSecret(ctx, *a.provider.VaultURL, secretName, secretParams)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVSetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVSetSecret, err)
 	if err != nil {
 		return fmt.Errorf("could not set secret %v: %w", secretName, err)
 	}
@@ -628,7 +627,7 @@ func (a *Azure) setKeyVaultCertificate(ctx context.Context, secretName string, v
 		return fmt.Errorf("value from secret is not a valid certificate: %w", err)
 	}
 	cert, err := a.baseClient.GetCertificate(ctx, *a.provider.VaultURL, secretName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 	ok, err := canCreate(cert.Tags, err)
 	if err != nil {
 		return fmt.Errorf("cannot get certificate %v: %w", secretName, err)
@@ -652,7 +651,7 @@ func (a *Azure) setKeyVaultCertificate(ctx context.Context, secretName string, v
 	}
 
 	_, err = a.baseClient.ImportCertificate(ctx, *a.provider.VaultURL, secretName, params)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVImportCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVImportCertificate, err)
 	if err != nil {
 		return fmt.Errorf("could not import certificate %v: %w", secretName, err)
 	}
@@ -689,7 +688,7 @@ func (a *Azure) setKeyVaultKey(ctx context.Context, secretName string, value []b
 		return fmt.Errorf("error unmarshalling key: %w", err)
 	}
 	keyFromVault, err := a.baseClient.GetKey(ctx, *a.provider.VaultURL, secretName, "")
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 	ok, err := canCreate(keyFromVault.Tags, err)
 	if err != nil {
 		return fmt.Errorf("cannot get key %v: %w", secretName, err)
@@ -712,7 +711,7 @@ func (a *Azure) setKeyVaultKey(ctx context.Context, secretName string, value []b
 		params.Tags[k] = &v
 	}
 	_, err = a.baseClient.ImportKey(ctx, *a.provider.VaultURL, secretName, params)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVImportKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVImportKey, err)
 	if err != nil {
 		return fmt.Errorf("could not import key %v: %w", secretName, err)
 	}
@@ -814,7 +813,7 @@ func (a *Azure) getAllSecretsWithLegacySDK(ctx context.Context, ref esv1.Externa
 	checkName := ref.Name != nil && ref.Name.RegExp != ""
 
 	secretListIter, err := basicClient.GetSecretsComplete(ctx, *a.provider.VaultURL, nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecrets, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecrets, err)
 	err = parseError(err)
 	if err != nil {
 		return nil, err
@@ -831,7 +830,7 @@ func (a *Azure) getAllSecretsWithLegacySDK(ctx context.Context, ref esv1.Externa
 			continue
 		}
 		secretResp, err := basicClient.GetSecret(ctx, *a.provider.VaultURL, secretName, "")
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 		err = parseError(err)
 		if err != nil {
 			return nil, err
@@ -977,7 +976,7 @@ func (a *Azure) getSecretTags(ctx context.Context, ref esv1.ExternalSecretDataRe
 func (a *Azure) getSecretTagsWithLegacySDK(ctx context.Context, ref esv1.ExternalSecretDataRemoteRef) (map[string]*string, error) {
 	_, secretName := getObjType(ref)
 	secretResp, err := a.baseClient.GetSecret(ctx, *a.provider.VaultURL, secretName, ref.Version)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 	err = parseError(err)
 	if err != nil {
 		return nil, err
@@ -1497,7 +1496,7 @@ func (a *Azure) getSecretWithLegacySDK(ctx context.Context, ref esv1.ExternalSec
 		// returns a SecretBundle with the secret value
 		// https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#SecretBundle
 		secretResp, err := a.baseClient.GetSecret(ctx, *a.provider.VaultURL, secretName, ref.Version)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 		err = parseError(err)
 		if err != nil {
 			return nil, err
@@ -1511,7 +1510,7 @@ func (a *Azure) getSecretWithLegacySDK(ctx context.Context, ref esv1.ExternalSec
 		// returns a CertBundle. We return CER contents of x509 certificate
 		// see: https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#CertificateBundle
 		certResp, err := a.baseClient.GetCertificate(ctx, *a.provider.VaultURL, secretName, ref.Version)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 		err = parseError(err)
 		if err != nil {
 			return nil, err
@@ -1525,7 +1524,7 @@ func (a *Azure) getSecretWithLegacySDK(ctx context.Context, ref esv1.ExternalSec
 		// returns a KeyBundle
 		// https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#KeyBundle
 		keyResp, err := a.baseClient.GetKey(ctx, *a.provider.VaultURL, secretName, ref.Version)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 		err = parseError(err)
 		if err != nil {
 			return nil, err

providers/v1/azure/keyvault/keyvault_new_sdk.go

@@ -38,7 +38,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -72,7 +71,7 @@ func newSDKSecretUnchanged(existingValue, existingContentType *string, value []b
 // New SDK implementations for setter methods.
 func (a *Azure) setKeyVaultSecretWithNewSDK(ctx context.Context, secretName string, value []byte, contentType *string, tags map[string]string) error {
 	existingSecret, err := a.secretsClient.GetSecret(ctx, secretName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 
 	if err != nil && !isNotFoundErr(err) {
 		return fmt.Errorf("cannot get secret %v: %w", secretName, parseNewSDKError(err))
@@ -113,7 +112,7 @@ func (a *Azure) setKeyVaultSecretWithNewSDK(ctx context.Context, secretName stri
 	// This is a limitation compared to the legacy SDK - expiration would need to be handled differently
 
 	_, err = a.secretsClient.SetSecret(ctx, secretName, params, nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVSetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVSetSecret, err)
 	if err != nil {
 		return fmt.Errorf("could not set secret %v: %w", secretName, parseNewSDKError(err))
 	}
@@ -129,7 +128,7 @@ func (a *Azure) setKeyVaultCertificateWithNewSDK(ctx context.Context, secretName
 
 	// Check if certificate exists
 	cert, err := a.certsClient.GetCertificate(ctx, secretName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 
 	if err != nil {
 		var respErr *azcore.ResponseError
@@ -165,7 +164,7 @@ func (a *Azure) setKeyVaultCertificateWithNewSDK(ctx context.Context, secretName
 	}
 
 	_, err = a.certsClient.ImportCertificate(ctx, secretName, params, nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVImportCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVImportCertificate, err)
 	if err != nil {
 		return fmt.Errorf("could not import certificate %v: %w", secretName, parseNewSDKError(err))
 	}
@@ -194,7 +193,7 @@ func (a *Azure) setKeyVaultKeyWithNewSDK(ctx context.Context, secretName string,
 
 	// Check if key exists
 	keyFromVault, err := a.keysClient.GetKey(ctx, secretName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 
 	if err != nil {
 		var respErr *azcore.ResponseError
@@ -228,7 +227,7 @@ func (a *Azure) setKeyVaultKeyWithNewSDK(ctx context.Context, secretName string,
 	}
 
 	_, err = a.keysClient.ImportKey(ctx, secretName, params, nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVImportKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVImportKey, err)
 	if err != nil {
 		return fmt.Errorf("could not import key %v: %w", secretName, parseNewSDKError(err))
 	}
@@ -291,7 +290,7 @@ func (a *Azure) processSecretsPage(ctx context.Context, secrets []*azsecrets.Sec
 
 		// Get the secret value
 		secretResp, err := a.secretsClient.GetSecret(ctx, secretName, "", nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 		if err != nil {
 			return parseNewSDKError(err)
 		}
@@ -309,7 +308,7 @@ func (a *Azure) getAllSecretsWithNewSDK(ctx context.Context, ref esv1.ExternalSe
 
 	for pager.More() {
 		page, err := pager.NextPage(ctx)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecrets, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecrets, err)
 		if err != nil {
 			return nil, parseNewSDKError(err)
 		}
@@ -324,7 +323,7 @@ func (a *Azure) getAllSecretsWithNewSDK(ctx context.Context, ref esv1.ExternalSe
 func (a *Azure) getSecretTagsWithNewSDK(ctx context.Context, ref esv1.ExternalSecretDataRemoteRef) (map[string]*string, error) {
 	_, secretName := getObjType(ref)
 	secretResp, err := a.secretsClient.GetSecret(ctx, secretName, ref.Version, nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 	if err != nil {
 		return nil, parseNewSDKError(err)
 	}
@@ -622,7 +621,7 @@ func canDeleteWithNewSDK(tags map[string]*string, err error) (bool, error) {
 // Delete methods using new Azure SDK.
 func (a *Azure) deleteKeyVaultSecretWithNewSDK(ctx context.Context, secretName string) error {
 	secret, err := a.secretsClient.GetSecret(ctx, secretName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 
 	ok, err := canDeleteWithNewSDK(secret.Tags, err)
 	if err != nil {
@@ -631,7 +630,7 @@ func (a *Azure) deleteKeyVaultSecretWithNewSDK(ctx context.Context, secretName s
 
 	if ok {
 		_, err = a.secretsClient.DeleteSecret(ctx, secretName, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteSecret, err)
 		if err != nil {
 			return fmt.Errorf("error deleting secret %v: %w", secretName, err)
 		}
@@ -641,7 +640,7 @@ func (a *Azure) deleteKeyVaultSecretWithNewSDK(ctx context.Context, secretName s
 
 func (a *Azure) deleteKeyVaultCertificateWithNewSDK(ctx context.Context, certName string) error {
 	cert, err := a.certsClient.GetCertificate(ctx, certName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 
 	ok, err := canDeleteWithNewSDK(cert.Tags, err)
 	if err != nil {
@@ -650,7 +649,7 @@ func (a *Azure) deleteKeyVaultCertificateWithNewSDK(ctx context.Context, certNam
 
 	if ok {
 		_, err = a.certsClient.DeleteCertificate(ctx, certName, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteCertificate, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteCertificate, err)
 		if err != nil {
 			return fmt.Errorf("error deleting certificate %v: %w", certName, err)
 		}
@@ -660,7 +659,7 @@ func (a *Azure) deleteKeyVaultCertificateWithNewSDK(ctx context.Context, certNam
 
 func (a *Azure) deleteKeyVaultKeyWithNewSDK(ctx context.Context, keyName string) error {
 	key, err := a.keysClient.GetKey(ctx, keyName, "", nil)
-	metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+	metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 
 	ok, err := canDeleteWithNewSDK(key.Tags, err)
 	if err != nil {
@@ -669,7 +668,7 @@ func (a *Azure) deleteKeyVaultKeyWithNewSDK(ctx context.Context, keyName string)
 
 	if ok {
 		_, err = a.keysClient.DeleteKey(ctx, keyName, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVDeleteKey, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVDeleteKey, err)
 		if err != nil {
 			return fmt.Errorf("error deleting key %v: %w", keyName, err)
 		}
@@ -685,7 +684,7 @@ func (a *Azure) getSecretWithNewSDK(ctx context.Context, ref esv1.ExternalSecret
 	case defaultObjType:
 		// Get secret using new SDK
 		resp, err := a.secretsClient.GetSecret(ctx, secretName, ref.Version, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 		if err != nil {
 			return nil, parseNewSDKError(err)
 		}
@@ -697,7 +696,7 @@ func (a *Azure) getSecretWithNewSDK(ctx context.Context, ref esv1.ExternalSecret
 	case objectTypeCert:
 		// Get certificate using new SDK
 		resp, err := a.certsClient.GetCertificate(ctx, secretName, ref.Version, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 		if err != nil {
 			return nil, parseNewSDKError(err)
 		}
@@ -709,7 +708,7 @@ func (a *Azure) getSecretWithNewSDK(ctx context.Context, ref esv1.ExternalSecret
 	case objectTypeKey:
 		// Get key using new SDK
 		resp, err := a.keysClient.GetKey(ctx, secretName, ref.Version, nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 		if err != nil {
 			return nil, parseNewSDKError(err)
 		}
@@ -735,13 +734,13 @@ func (a *Azure) secretExistsWithNewSDK(ctx context.Context, remoteRef esv1.PushS
 	switch objectType {
 	case defaultObjType:
 		_, err = a.secretsClient.GetSecret(ctx, secretName, "", nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetSecret, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetSecret, err)
 	case objectTypeCert:
 		_, err = a.certsClient.GetCertificate(ctx, secretName, "", nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetCertificate, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetCertificate, err)
 	case objectTypeKey:
 		_, err = a.keysClient.GetKey(ctx, secretName, "", nil)
-		metrics.ObserveAPICall(constants.ProviderAzureKV, constants.CallAzureKVGetKey, err)
+		metrics.ObserveAPICall(ProviderAzureKV, CallAzureKVGetKey, err)
 	default:
 		errMsg := fmt.Sprintf("secret type '%v' is not supported", objectType)
 		return false, errors.New(errMsg)

providers/v1/gcp/secretmanager/client.go

@@ -41,7 +41,6 @@ import (
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/find"
@@ -117,7 +116,7 @@ func (c *Client) DeleteSecret(ctx context.Context, remoteRef esv1.PushSecretRemo
 	gcpSecret, err := c.smClient.GetSecret(ctx, &secretmanagerpb.GetSecretRequest{
 		Name: name,
 	})
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGetSecret, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGetSecret, err)
 	if err != nil {
 		if status.Code(err) == codes.NotFound {
 			return nil
@@ -134,7 +133,7 @@ func (c *Client) DeleteSecret(ctx context.Context, remoteRef esv1.PushSecretRemo
 		Etag: gcpSecret.Etag,
 	}
 	err = c.smClient.DeleteSecret(ctx, deleteSecretVersionReq)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMDeleteSecret, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMDeleteSecret, err)
 	return err
 }
 
@@ -182,7 +181,7 @@ func (c *Client) PushSecret(ctx context.Context, secret *corev1.Secret, pushSecr
 	gcpSecret, err := c.smClient.GetSecret(ctx, &secretmanagerpb.GetSecretRequest{
 		Name: secretName,
 	})
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGetSecret, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGetSecret, err)
 
 	if err != nil {
 		if status.Code(err) != codes.NotFound {
@@ -238,7 +237,7 @@ func (c *Client) PushSecret(ctx context.Context, secret *corev1.Secret, pushSecr
 			SecretId: pushSecretData.GetRemoteKey(),
 			Secret:   scrt,
 		})
-		metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMCreateSecret, err)
+		metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMCreateSecret, err)
 		if err != nil {
 			return err
 		}
@@ -290,7 +289,7 @@ func (c *Client) PushSecret(ctx context.Context, secret *corev1.Secret, pushSecr
 				Paths: []string{"labels", "annotations"},
 			},
 		})
-		metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMUpdateSecret, err)
+		metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMUpdateSecret, err)
 		if err != nil {
 			return err
 		}
@@ -305,7 +304,7 @@ func (c *Client) PushSecret(ctx context.Context, secret *corev1.Secret, pushSecr
 	gcpVersion, err := c.smClient.AccessSecretVersion(ctx, &secretmanagerpb.AccessSecretVersionRequest{
 		Name: fmt.Sprintf("%s/versions/latest", secretName),
 	})
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMAccessSecretVersion, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMAccessSecretVersion, err)
 
 	if err != nil && status.Code(err) != codes.NotFound {
 		return err
@@ -335,7 +334,7 @@ func (c *Client) PushSecret(ctx context.Context, secret *corev1.Secret, pushSecr
 	}
 
 	_, err = c.smClient.AddSecretVersion(ctx, addSecretVersionReq)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMAddSecretVersion, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMAddSecretVersion, err)
 	return err
 }
 
@@ -368,7 +367,7 @@ func (c *Client) findByName(ctx context.Context, ref esv1.ExternalSecretFind) (m
 	it := c.smClient.ListSecrets(ctx, req)
 	secretMap := make(map[string][]byte)
 	var resp *secretmanagerpb.Secret
-	defer metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMListSecrets, err)
+	defer metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMListSecrets, err)
 	for {
 		resp, err = it.Next()
 		if errors.Is(err, iterator.Done) {
@@ -427,7 +426,7 @@ func (c *Client) findByTags(ctx context.Context, ref esv1.ExternalSecretFind) (m
 	it := c.smClient.ListSecrets(ctx, req)
 	var resp *secretmanagerpb.Secret
 	var err error
-	defer metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMListSecrets, err)
+	defer metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMListSecrets, err)
 	secretMap := make(map[string][]byte)
 	for {
 		resp, err = it.Next()
@@ -489,7 +488,7 @@ func (c *Client) GetSecret(ctx context.Context, ref esv1.ExternalSecretDataRemot
 		Name: name,
 	}
 	result, err := c.smClient.AccessSecretVersion(ctx, req)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMAccessSecretVersion, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMAccessSecretVersion, err)
 	if err != nil && c.store.SecretVersionSelectionPolicy == esv1.SecretVersionSelectionPolicyLatestOrFetch &&
 		ref.Version == "" && isErrSecretDestroyedOrDisabled(err) {
 		// if the secret is destroyed or disabled, and we are configured to get the latest enabled secret,
@@ -738,7 +737,7 @@ func getLatestEnabledVersion(ctx context.Context, client GoogleSecretManagerClie
 		Name: versionName,
 	}
 	version, err := client.AccessSecretVersion(ctx, req)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMAccessSecretVersion, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMAccessSecretVersion, err)
 	if err != nil {
 		return nil, err
 	}

providers/v1/gcp/secretmanager/constants.go

@@ -0,0 +1,32 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package secretmanager
+
+// Metrics constants identify the GCP Secret Manager provider and API calls.
+const (
+	ProviderGCPSM                = "GCP/SecretManager"
+	CallGCPSMGetSecret           = "GetSecret"
+	CallGCPSMDeleteSecret        = "DeleteSecret"
+	CallGCPSMCreateSecret        = "CreateSecret"
+	CallGCPSMUpdateSecret        = "UpdateSecret"
+	CallGCPSMAccessSecretVersion = "AccessSecretVersion"
+	CallGCPSMAddSecretVersion    = "AddSecretVersion"
+	CallGCPSMListSecrets         = "ListSecrets"
+	CallGCPSMGenerateSAToken     = "GenerateServiceAccountToken"
+	CallGCPSMGenerateIDBindToken = "GenerateIDBindToken"
+	CallGCPSMGenerateAccessToken = "GenerateAccessToken"
+)

providers/v1/gcp/secretmanager/workload_identity.go

@@ -45,7 +45,6 @@ import (
 	ctrlcfg "sigs.k8s.io/controller-runtime/pkg/client/config"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -201,13 +200,13 @@ func (w *workloadIdentity) TokenSource(ctx context.Context, auth esv1.GCPSMAuth,
 	gcpSA := sa.Annotations[gcpSAAnnotation]
 
 	resp, err := w.saTokenGenerator.Generate(ctx, audiences, saKey.Name, saKey.Namespace)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGenerateSAToken, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGenerateSAToken, err)
 	if err != nil {
 		return nil, fmt.Errorf(errFetchPodToken, err)
 	}
 
 	idBindToken, err := w.idBindTokenGenerator.Generate(ctx, http.DefaultClient, resp.Status.Token, idPool, idProvider)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGenerateIDBindToken, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGenerateIDBindToken, err)
 	if err != nil {
 		return nil, fmt.Errorf(errFetchIBToken, err)
 	}
@@ -222,7 +221,7 @@ func (w *workloadIdentity) TokenSource(ctx context.Context, auth esv1.GCPSMAuth,
 		Name:  fmt.Sprintf("projects/-/serviceAccounts/%s", gcpSA),
 		Scope: gsmapiv1.DefaultAuthScopes(),
 	}, gax.WithGRPCOptions(grpc.PerRPCCredentials(oauth.TokenSource{TokenSource: oauth2.StaticTokenSource(idBindToken)})))
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGenerateAccessToken, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGenerateAccessToken, err)
 	if err != nil {
 		return nil, fmt.Errorf(errGenAccessToken, err)
 	}

providers/v1/gcp/secretmanager/workload_identity_federation.go

@@ -33,7 +33,6 @@ import (
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -463,7 +462,7 @@ func (r *k8sSATokenReader) SubjectToken(ctx context.Context, options externalacc
 	}
 
 	resp, err := r.saTokenGenerator.Generate(ctx, r.saAudience, r.serviceAccount.Name, r.serviceAccount.Namespace)
-	metrics.ObserveAPICall(constants.ProviderGCPSM, constants.CallGCPSMGenerateSAToken, err)
+	metrics.ObserveAPICall(ProviderGCPSM, CallGCPSMGenerateSAToken, err)
 	if err != nil {
 		return "", fmt.Errorf(errFetchPodToken, err)
 	}

providers/v1/gitlab/constants.go

@@ -0,0 +1,27 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gitlab
+
+// Metrics constants identify the GitLab provider and API calls.
+const (
+	ProviderGitLab                 = "GitLab"
+	CallGitLabListProjectsGroups   = "ListProjectsGroups"
+	CallGitLabProjectVariableGet   = "ProjectVariableGet"
+	CallGitLabProjectListVariables = "ProjectVariablesList"
+	CallGitLabGroupGetVariable     = "GroupVariableGet"
+	CallGitLabGroupListVariables   = "GroupVariablesList"
+)

providers/v1/gitlab/gitlab.go

@@ -34,7 +34,6 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/find"
@@ -162,7 +161,7 @@ func (g *gitlabBase) fetchProjectVariables(effectiveEnvironment string, matcher
 	for projectPage := int64(1); ; projectPage++ {
 		popts.Page = projectPage
 		projectData, response, err := g.projectVariablesClient.ListVariables(g.store.ProjectID, popts)
-		metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabProjectListVariables, err)
+		metrics.ObserveAPICall(ProviderGitLab, CallGitLabProjectListVariables, err)
 		if err != nil {
 			return err
 		}
@@ -220,7 +219,7 @@ func (g *gitlabBase) setVariablesForGroupID(
 	for groupPage := int64(1); ; groupPage++ {
 		gopts.Page = groupPage
 		groupVars, response, err := g.groupVariablesClient.ListVariables(groupID, gopts)
-		metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabGroupListVariables, err)
+		metrics.ObserveAPICall(ProviderGitLab, CallGitLabGroupListVariables, err)
 		if err != nil {
 			return err
 		}
@@ -267,7 +266,7 @@ func ExtractTag(tags map[string]string) (string, error) {
 
 func (g *gitlabBase) getGroupVariables(groupID string, ref esv1.ExternalSecretDataRemoteRef, gopts *gitlab.GetGroupVariableOptions) (*gitlab.GroupVariable, *gitlab.Response, error) {
 	groupVar, resp, err := g.groupVariablesClient.GetVariable(groupID, ref.Key, gopts)
-	metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabGroupGetVariable, err)
+	metrics.ObserveAPICall(ProviderGitLab, CallGitLabGroupGetVariable, err)
 	if err != nil {
 		if resp != nil && resp.StatusCode == http.StatusNotFound && !isEmptyOrWildcard(g.store.Environment) {
 			if gopts == nil {
@@ -278,7 +277,7 @@ func (g *gitlabBase) getGroupVariables(groupID string, ref esv1.ExternalSecretDa
 			}
 			gopts.Filter.EnvironmentScope = "*"
 			groupVar, resp, err = g.groupVariablesClient.GetVariable(groupID, ref.Key, gopts)
-			metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabGroupGetVariable, err)
+			metrics.ObserveAPICall(ProviderGitLab, CallGitLabGroupGetVariable, err)
 			if err != nil || resp == nil {
 				return nil, resp, fmt.Errorf("error getting group variable %s from GitLab: %w", ref.Key, err)
 			}
@@ -416,7 +415,7 @@ func (g *gitlabBase) Close(_ context.Context) error {
 func (g *gitlabBase) ResolveGroupIDs() error {
 	if g.store.InheritFromGroups {
 		projectGroups, resp, err := g.projectsClient.ListProjectsGroups(g.store.ProjectID, nil)
-		metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabListProjectsGroups, err)
+		metrics.ObserveAPICall(ProviderGitLab, CallGitLabListProjectsGroups, err)
 		if resp.StatusCode >= 400 && err != nil {
 			return err
 		}
@@ -434,7 +433,7 @@ func (g *gitlabBase) ResolveGroupIDs() error {
 func (g *gitlabBase) Validate() (esv1.ValidationResult, error) {
 	if g.store.ProjectID != "" {
 		_, resp, err := g.projectVariablesClient.ListVariables(g.store.ProjectID, nil)
-		metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabProjectListVariables, err)
+		metrics.ObserveAPICall(ProviderGitLab, CallGitLabProjectListVariables, err)
 		if err != nil {
 			return esv1.ValidationResultError, fmt.Errorf(errList, err)
 		} else if resp == nil || resp.StatusCode != http.StatusOK {
@@ -451,7 +450,7 @@ func (g *gitlabBase) Validate() (esv1.ValidationResult, error) {
 	if len(g.store.GroupIDs) > 0 {
 		for _, groupID := range g.store.GroupIDs {
 			_, resp, err := g.groupVariablesClient.ListVariables(groupID, nil)
-			metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabGroupListVariables, err)
+			metrics.ObserveAPICall(ProviderGitLab, CallGitLabGroupListVariables, err)
 			if err != nil {
 				return esv1.ValidationResultError, fmt.Errorf(errList, err)
 			} else if resp == nil || resp.StatusCode != http.StatusOK {

providers/v1/gitlab/provider.go

@@ -30,7 +30,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -136,7 +135,7 @@ func (g *gitlabBase) getClient(ctx context.Context, provider *esv1.GitlabProvide
 func (g *gitlabBase) getVariables(ref esv1.ExternalSecretDataRemoteRef, vopts *gitlab.GetProjectVariableOptions) (*gitlab.ProjectVariable, error) {
 	// First attempt to get the variable
 	data, _, err := g.projectVariablesClient.GetVariable(g.store.ProjectID, ref.Key, vopts)
-	metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabProjectVariableGet, err)
+	metrics.ObserveAPICall(ProviderGitLab, CallGitLabProjectVariableGet, err)
 
 	// If successful, return immediately
 	if err == nil {
@@ -151,7 +150,7 @@ func (g *gitlabBase) getVariables(ref esv1.ExternalSecretDataRemoteRef, vopts *g
 	// Retry with wildcard environment scope
 	opts := &gitlab.GetProjectVariableOptions{Filter: &gitlab.VariableFilter{EnvironmentScope: "*"}}
 	data, _, err = g.projectVariablesClient.GetVariable(g.store.ProjectID, ref.Key, opts)
-	metrics.ObserveAPICall(constants.ProviderGitLab, constants.CallGitLabProjectVariableGet, err)
+	metrics.ObserveAPICall(ProviderGitLab, CallGitLabProjectVariableGet, err)
 
 	if err != nil {
 		return nil, fmt.Errorf("error getting variable %s from GitLab (including wildcard retry): %w", ref.Key, err)

providers/v1/ibm/constants.go

@@ -0,0 +1,25 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ibm
+
+// Metrics constants identify the IBM Secrets Manager provider and API calls.
+const (
+	ProviderIBMSM                = "IBM/SecretsManager"
+	CallIBMSMGetSecret           = "GetSecret"
+	CallIBMSMListSecrets         = "ListSecrets"
+	CallIBMSMGetSecretByNameType = "GetSecretByNameType"
+)

providers/v1/ibm/provider.go

@@ -36,7 +36,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
@@ -408,7 +407,7 @@ func getSecretData(ibm *providerIBM, secretName *string, secretType, secretGroup
 				SecretGroupName: &secretGroupName,
 				SecretType:      &secretType,
 			})
-		metrics.ObserveAPICall(constants.ProviderIBMSM, constants.CallIBMSMGetSecretByNameType, err)
+		metrics.ObserveAPICall(ProviderIBMSM, CallIBMSMGetSecretByNameType, err)
 		if err != nil {
 			return nil, err
 		}
@@ -422,7 +421,7 @@ func getSecretData(ibm *providerIBM, secretName *string, secretType, secretGroup
 		&sm.GetSecretOptions{
 			ID: secretName,
 		})
-	metrics.ObserveAPICall(constants.ProviderIBMSM, constants.CallIBMSMGetSecret, err)
+	metrics.ObserveAPICall(ProviderIBMSM, CallIBMSMGetSecret, err)
 	if err != nil {
 		return nil, err
 	}

providers/v1/keepersecurity/client.go

@@ -29,7 +29,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -150,7 +149,7 @@ func (c *Client) findByIDWithNameFallback(key string) (*Secret, error) {
 
 	if record == nil && c.getByTitleFallback {
 		records, err := c.ksmClient.GetSecretsByTitle(key)
-		metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityGetSecretsByTitle, err)
+		metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityGetSecretsByTitle, err)
 		if err != nil {
 			return nil, err
 		}
@@ -267,7 +266,7 @@ func (c *Client) DeleteSecret(_ context.Context, remoteRef esv1.PushSecretRemote
 		return fmt.Errorf(errInvalidSecretType, externalSecretType, secret.Title(), secret.Type())
 	}
 	_, err = c.ksmClient.DeleteSecrets([]string{secret.Uid})
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityDeleteSecrets, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityDeleteSecrets, err)
 	return err
 }
 
@@ -315,7 +314,7 @@ func (c *Client) createSecret(name, key string, value []byte) (string, error) {
 	}
 
 	uid, err := c.ksmClient.CreateSecretWithRecordData("", c.folderID, externalSecretRecord)
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityCreateSecretWithRecordData, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityCreateSecretWithRecordData, err)
 	return uid, err
 }
 
@@ -346,7 +345,7 @@ func (c *Client) updateSecret(secret *ksm.Record, key string, value []byte) erro
 	}
 
 	err := c.ksmClient.Save(secret)
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecuritySave, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecuritySave, err)
 	return err
 }
 
@@ -367,7 +366,7 @@ func (c *Client) getValidKeeperSecret(secret *ksm.Record) (*Secret, error) {
 
 func (c *Client) findSecrets() ([]*ksm.Record, error) {
 	records, err := c.ksmClient.GetSecrets([]string{})
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityGetSecrets, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityGetSecrets, err)
 	if err != nil {
 		return nil, fmt.Errorf(errKeeperSecuritySecretsNotFound, err)
 	}
@@ -377,7 +376,7 @@ func (c *Client) findSecrets() ([]*ksm.Record, error) {
 
 func (c *Client) findSecretByID(id string) (*ksm.Record, error) {
 	records, err := c.ksmClient.GetSecrets([]string{id})
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityGetSecrets, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityGetSecrets, err)
 	if err != nil {
 		return nil, fmt.Errorf(errKeeperSecuritySecretNotFound, id, err)
 	}
@@ -391,7 +390,7 @@ func (c *Client) findSecretByID(id string) (*ksm.Record, error) {
 
 func (c *Client) findSecretByName(name string) (*ksm.Record, error) {
 	records, err := c.ksmClient.GetSecretsByTitle(name)
-	metrics.ObserveAPICall(constants.ProviderKeeperSecurity, constants.CallKeeperSecurityGetSecretsByTitle, err)
+	metrics.ObserveAPICall(ProviderKeeperSecurity, CallKeeperSecurityGetSecretsByTitle, err)
 	if err != nil {
 		return nil, err
 	}

providers/v1/keepersecurity/constants.go

@@ -0,0 +1,27 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package keepersecurity
+
+// Metrics constants identify the Keeper Security provider and API calls.
+const (
+	ProviderKeeperSecurity                       = "KeeperSecurity"
+	CallKeeperSecurityGetSecrets                 = "GetSecrets"
+	CallKeeperSecurityGetSecretsByTitle          = "GetSecretsByTitle"
+	CallKeeperSecurityCreateSecretWithRecordData = "CreateSecretWithRecordData"
+	CallKeeperSecuritySave                       = "Save"
+	CallKeeperSecurityDeleteSecrets              = "DeleteSecrets"
+)

providers/v1/kubernetes/client.go

@@ -33,7 +33,6 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/find"
@@ -84,7 +83,7 @@ func (c *Client) GetSecret(ctx context.Context, ref esv1.ExternalSecretDataRemot
 // It requires a property to be specified in the RemoteRef.
 func (c *Client) DeleteSecret(ctx context.Context, remoteRef esv1.PushSecretRemoteRef) error {
 	extSecret, getErr := c.userSecretClient.Get(ctx, remoteRef.GetRemoteKey(), metav1.GetOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesGetSecret, getErr)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesGetSecret, getErr)
 	if getErr != nil {
 		if apierrors.IsNotFound(getErr) {
 			// return gracefully if no secret exists
@@ -108,7 +107,7 @@ func (c *Client) DeleteSecret(ctx context.Context, remoteRef esv1.PushSecretRemo
 // SecretExists checks if a secret exists in Kubernetes.
 func (c *Client) SecretExists(ctx context.Context, ref esv1.PushSecretRemoteRef) (bool, error) {
 	secret, err := c.userSecretClient.Get(ctx, ref.GetRemoteKey(), metav1.GetOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesGetSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesGetSecret, err)
 	if err != nil {
 		if apierrors.IsNotFound(err) {
 			return false, nil
@@ -203,7 +202,7 @@ func (c *Client) mergePushSecretData(remoteRef esv1.PushSecretData, pushMeta *me
 
 func (c *Client) createOrUpdate(ctx context.Context, secretClient KClient, targetSecret *v1.Secret, f func() error) error {
 	target, err := secretClient.Get(ctx, targetSecret.Name, metav1.GetOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesGetSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesGetSecret, err)
 	if err != nil {
 		if !apierrors.IsNotFound(err) {
 			return err
@@ -212,7 +211,7 @@ func (c *Client) createOrUpdate(ctx context.Context, secretClient KClient, targe
 			return err
 		}
 		_, err := secretClient.Create(ctx, targetSecret, metav1.CreateOptions{})
-		metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesCreateSecret, err)
+		metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesCreateSecret, err)
 		if err != nil {
 			return err
 		}
@@ -230,7 +229,7 @@ func (c *Client) createOrUpdate(ctx context.Context, secretClient KClient, targe
 	}
 
 	_, err = secretClient.Update(ctx, targetSecret, metav1.UpdateOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesUpdateSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesUpdateSecret, err)
 	if err != nil {
 		return err
 	}
@@ -256,7 +255,7 @@ func (c *Client) marshalData(secret *v1.Secret) ([]byte, error) {
 // The secret data is converted to a map of key/value pairs.
 func (c *Client) GetSecretMap(ctx context.Context, ref esv1.ExternalSecretDataRemoteRef) (map[string][]byte, error) {
 	secret, err := c.userSecretClient.Get(ctx, ref.Key, metav1.GetOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesGetSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesGetSecret, err)
 	if apierrors.IsNotFound(err) {
 		return nil, esv1.NoSecretError{}
 	}
@@ -373,7 +372,7 @@ func (c *Client) findByTags(ctx context.Context, ref esv1.ExternalSecretFind) (m
 		return nil, fmt.Errorf("unable to validate selector tags: %w", err)
 	}
 	secrets, err := c.userSecretClient.List(ctx, metav1.ListOptions{LabelSelector: sel.String()})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesListSecrets, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesListSecrets, err)
 	if err != nil {
 		return nil, fmt.Errorf("unable to list secrets: %w", err)
 	}
@@ -390,7 +389,7 @@ func (c *Client) findByTags(ctx context.Context, ref esv1.ExternalSecretFind) (m
 
 func (c *Client) findByName(ctx context.Context, ref esv1.ExternalSecretFind) (map[string][]byte, error) {
 	secrets, err := c.userSecretClient.List(ctx, metav1.ListOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesListSecrets, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesListSecrets, err)
 	if err != nil {
 		return nil, fmt.Errorf("unable to list secrets: %w", err)
 	}
@@ -428,7 +427,7 @@ func convertMap(in map[string][]byte) map[string]string {
 // fullDelete removes remote secret completely.
 func (c *Client) fullDelete(ctx context.Context, secretName string) error {
 	err := c.userSecretClient.Delete(ctx, secretName, metav1.DeleteOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesDeleteSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesDeleteSecret, err)
 
 	// gracefully return on not found
 	if apierrors.IsNotFound(err) {
@@ -441,7 +440,7 @@ func (c *Client) fullDelete(ctx context.Context, secretName string) error {
 func (c *Client) removeProperty(ctx context.Context, extSecret *v1.Secret, remoteRef esv1.PushSecretRemoteRef) error {
 	delete(extSecret.Data, remoteRef.GetProperty())
 	_, err := c.userSecretClient.Update(ctx, extSecret, metav1.UpdateOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesUpdateSecret, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesUpdateSecret, err)
 	return err
 }
 

providers/v1/kubernetes/constants.go

@@ -0,0 +1,28 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubernetes
+
+// Metrics constants identify the Kubernetes provider and API calls.
+const (
+	ProviderKubernetes                         = "Kubernetes"
+	CallKubernetesGetSecret                    = "GetSecret"
+	CallKubernetesListSecrets                  = "ListSecrets"
+	CallKubernetesCreateSecret                 = "CreateSecret"
+	CallKubernetesDeleteSecret                 = "DeleteSecret"
+	CallKubernetesUpdateSecret                 = "UpdateSecret"
+	CallKubernetesCreateSelfSubjectRulesReview = "CreateSelfSubjectRulesReview"
+)

providers/v1/kubernetes/validate.go

@@ -27,7 +27,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -56,7 +55,7 @@ func (c *Client) Validate() (esv1.ValidationResult, error) {
 		},
 	}
 	authReview, err := c.userReviewClient.Create(ctx, &t, metav1.CreateOptions{})
-	metrics.ObserveAPICall(constants.ProviderKubernetes, constants.CallKubernetesCreateSelfSubjectRulesReview, err)
+	metrics.ObserveAPICall(ProviderKubernetes, CallKubernetesCreateSelfSubjectRulesReview, err)
 	if err != nil {
 		return esv1.ValidationResultUnknown, fmt.Errorf("could not verify if client is valid: %w", err)
 	}

providers/v1/nebius/mysterybox/constants.go

@@ -0,0 +1,25 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mysterybox
+
+// Metrics constants identify the Nebius Mysterybox provider and API calls.
+const (
+	ProviderNebiusMysterybox           = "Nebius/Mysterybox"
+	CallNebiusMysteryboxGetSecret      = "GetSecret"
+	CallNebiusMysteryboxGetSecretByKey = "GetSecretByKey"
+	CallNebiusMysteryboxAuth           = "Auth"
+)

providers/v1/nebius/mysterybox/provider.go

@@ -39,7 +39,6 @@ import (
 	"github.com/external-secrets/external-secrets/providers/v1/nebius/common/auth"
 	"github.com/external-secrets/external-secrets/providers/v1/nebius/common/sdk/iam"
 	"github.com/external-secrets/external-secrets/providers/v1/nebius/common/sdk/mysterybox"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/feature"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
@@ -301,7 +300,7 @@ func (p *Provider) initTokenGetter() error {
 	c := clock.RealClock{}
 	tokenExchangerLogger := ctrl.Log.WithName("provider").WithName("nebius").WithName("iam").WithName("grpctokenexchanger")
 	tokenExchangeObserveFunction := func(err error) {
-		metrics.ObserveAPICall(constants.ProviderNebiusMysterybox, constants.CallNebiusMysteryboxAuth, err)
+		metrics.ObserveAPICall(ProviderNebiusMysterybox, CallNebiusMysteryboxAuth, err)
 	}
 	var tokenGetter TokenGetter
 	tokenGetter, err = NewCachedTokenGetter(

providers/v1/nebius/mysterybox/secrets_client.go

@@ -28,7 +28,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	"github.com/external-secrets/external-secrets/providers/v1/nebius/common/sdk/mysterybox"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -53,7 +52,7 @@ func (c *SecretsClient) GetSecret(ctx context.Context, ref esv1.ExternalSecretDa
 	secretKey := ref.Property
 	if secretKey == "" {
 		payload, err := c.mysteryboxClient.GetSecret(ctx, c.token, ref.Key, ref.Version)
-		metrics.ObserveAPICall(constants.ProviderNebiusMysterybox, constants.CallNebiusMysteryboxGetSecret, err)
+		metrics.ObserveAPICall(ProviderNebiusMysterybox, CallNebiusMysteryboxGetSecret, err)
 		if err != nil {
 			return nil, handleGetSecretError(err, ref)
 		}
@@ -69,7 +68,7 @@ func (c *SecretsClient) GetSecret(ctx context.Context, ref esv1.ExternalSecretDa
 		return out, nil
 	}
 	payloadEntry, err := c.mysteryboxClient.GetSecretByKey(ctx, c.token, ref.Key, ref.Version, secretKey)
-	metrics.ObserveAPICall(constants.ProviderNebiusMysterybox, constants.CallNebiusMysteryboxGetSecretByKey, err)
+	metrics.ObserveAPICall(ProviderNebiusMysterybox, CallNebiusMysteryboxGetSecretByKey, err)
 	if err != nil {
 		return nil, handleGetSecretByKeyError(err, ref)
 	}
@@ -79,7 +78,7 @@ func (c *SecretsClient) GetSecret(ctx context.Context, ref esv1.ExternalSecretDa
 // GetSecretMap retrieves a map of secret key-value pairs from Mysterybox using the provided reference.
 func (c *SecretsClient) GetSecretMap(ctx context.Context, ref esv1.ExternalSecretDataRemoteRef) (map[string][]byte, error) {
 	payload, err := c.mysteryboxClient.GetSecret(ctx, c.token, ref.Key, ref.Version)
-	metrics.ObserveAPICall(constants.ProviderNebiusMysterybox, constants.CallNebiusMysteryboxGetSecret, err)
+	metrics.ObserveAPICall(ProviderNebiusMysterybox, CallNebiusMysteryboxGetSecret, err)
 	if err != nil {
 		return nil, handleGetSecretError(err, ref)
 	}

providers/v1/onepasswordsdk/client.go

@@ -30,7 +30,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/metadata"
 	"github.com/external-secrets/external-secrets/runtime/find"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
@@ -96,7 +95,7 @@ func (p *SecretsClient) GetSecret(ctx context.Context, ref esv1.ExternalSecretDa
 	}
 
 	secret, err := p.client.Secrets().Resolve(ctx, key)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKResolve, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKResolve, err)
 	if err != nil {
 		return nil, err
 	}
@@ -146,7 +145,7 @@ func (p *SecretsClient) fetchEnvironmentVariables(ctx context.Context) ([]onepas
 	}
 
 	resp, err := p.client.Environments().GetVariables(ctx, p.targetID)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKEnvironmentsGetVars, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKEnvironmentsGetVars, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get environment variables: %w", err)
 	}
@@ -230,7 +229,7 @@ func (p *SecretsClient) DeleteSecret(ctx context.Context, ref esv1.PushSecretRem
 
 	if len(providerItem.Fields) == 0 && len(providerItem.Files) == 0 && len(providerItem.Sections) == 0 {
 		err = p.client.Items().Delete(ctx, providerItem.VaultID, providerItem.ID)
-		metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsDelete, err)
+		metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsDelete, err)
 		if err != nil {
 			return fmt.Errorf("failed to delete item: %w", err)
 		}
@@ -238,7 +237,7 @@ func (p *SecretsClient) DeleteSecret(ctx context.Context, ref esv1.PushSecretRem
 	}
 
 	_, err = p.client.Items().Put(ctx, providerItem)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsPut, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsPut, err)
 	if err != nil {
 		return fmt.Errorf(errMsgUpdateItem, err)
 	}
@@ -403,7 +402,7 @@ func (p *SecretsClient) listItems(ctx context.Context) ([]onepassword.ItemOvervi
 
 	// Vault item list not found in cache - fetch from the API
 	items, err := p.client.Items().List(ctx, p.targetID)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsList, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsList, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to list items: %w", err)
 	}
@@ -480,7 +479,7 @@ func (p *SecretsClient) fetchFile(ctx context.Context, itemID, fieldID string, a
 		return cached, nil
 	}
 	contents, err := p.client.Items().Files().Read(ctx, p.targetID, fieldID, attributes)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKFilesRead, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKFilesRead, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read file: %w", err)
 	}
@@ -612,7 +611,7 @@ func (p *SecretsClient) createItem(ctx context.Context, val []byte, ref esv1.Pus
 		},
 		Tags: tags,
 	})
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsCreate, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsCreate, err)
 	if err != nil {
 		return fmt.Errorf(errMsgCreateItem, err)
 	}
@@ -749,7 +748,7 @@ func (p *SecretsClient) PushSecret(ctx context.Context, secret *corev1.Secret, r
 	}
 
 	_, err = p.client.Items().Put(ctx, providerItem)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsPut, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsPut, err)
 	if err != nil {
 		return fmt.Errorf(errMsgUpdateItem, err)
 	}
@@ -772,7 +771,7 @@ func (p *SecretsClient) createAllKeysItem(ctx context.Context, secret *corev1.Se
 		Fields:   fields,
 		Tags:     tags,
 	})
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsCreate, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsCreate, err)
 	if err != nil {
 		return fmt.Errorf(errMsgCreateItem, err)
 	}
@@ -826,7 +825,7 @@ func (p *SecretsClient) pushAllKeys(ctx context.Context, secret *corev1.Secret,
 	}
 	providerItem.Fields = kept
 	_, err = p.client.Items().Put(ctx, providerItem)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsPut, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsPut, err)
 	if err != nil {
 		return fmt.Errorf(errMsgUpdateItem, err)
 	}
@@ -837,7 +836,7 @@ func (p *SecretsClient) pushAllKeys(ctx context.Context, secret *corev1.Secret,
 // GetVault retrieves a vault by its title or UUID from 1Password.
 func (p *SecretsClient) GetVault(ctx context.Context, titleOrUUID string) (string, error) {
 	vaults, err := p.client.VaultsAPI.List(ctx)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKVaultsList, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKVaultsList, err)
 	if err != nil {
 		return "", fmt.Errorf("failed to list vaults: %w", err)
 	}
@@ -862,7 +861,7 @@ func (p *SecretsClient) fetchItemByID(ctx context.Context, id string) (onepasswo
 	}
 
 	item, err := p.client.Items().Get(ctx, p.targetID, id)
-	metrics.ObserveAPICall(constants.ProviderOnePasswordSDK, constants.CallOnePasswordSDKItemsGet, err)
+	metrics.ObserveAPICall(ProviderOnePasswordSDK, CallOnePasswordSDKItemsGet, err)
 	if err != nil {
 		return onepassword.Item{}, err
 	}

providers/v1/onepasswordsdk/constants.go

@@ -0,0 +1,31 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package onepasswordsdk
+
+// Metrics constants identify the 1Password SDK provider and API calls.
+const (
+	ProviderOnePasswordSDK                = "1Password/SDK"
+	CallOnePasswordSDKResolve             = "Resolve"
+	CallOnePasswordSDKItemsList           = "ItemsList"
+	CallOnePasswordSDKItemsGet            = "ItemsGet"
+	CallOnePasswordSDKItemsCreate         = "ItemsCreate"
+	CallOnePasswordSDKItemsPut            = "ItemsPut"
+	CallOnePasswordSDKItemsDelete         = "ItemsDelete"
+	CallOnePasswordSDKFilesRead           = "FilesRead"
+	CallOnePasswordSDKVaultsList          = "VaultsList"
+	CallOnePasswordSDKEnvironmentsGetVars = "EnvironmentsGetVariables"
+)

providers/v1/vault/auth.go

@@ -32,7 +32,6 @@ import (
 	esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
 	vaultiamauth "github.com/external-secrets/external-secrets/providers/v1/vault/iamauth"
 	vaultutil "github.com/external-secrets/external-secrets/providers/v1/vault/util"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -169,7 +168,7 @@ func createServiceAccountToken(
 func checkToken(ctx context.Context, token vaultutil.Token) (bool, *time.Time, error) {
 	// https://www.vaultproject.io/api-docs/auth/token#lookup-a-token-self
 	resp, err := token.LookupSelfWithContext(ctx)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLookupSelf, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLookupSelf, err)
 	if err != nil {
 		return false, nil, err
 	}
@@ -229,7 +228,7 @@ func revokeTokenIfValid(ctx context.Context, client vaultutil.Client) error {
 	}
 	if valid {
 		err = client.AuthToken().RevokeSelfWithContext(ctx, client.Token())
-		metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultRevokeSelf, err)
+		metrics.ObserveAPICall(ProviderHCVault, CallHCVaultRevokeSelf, err)
 		if err != nil {
 			return fmt.Errorf(errVaultRevokeToken, err)
 		}

providers/v1/vault/auth_approle.go

@@ -24,7 +24,6 @@ import (
 	"github.com/hashicorp/vault/api/auth/approle"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -71,7 +70,7 @@ func (c *client) requestTokenWithAppRoleRef(ctx context.Context, appRole *esv1.V
 		return err
 	}
 	_, err = c.auth.Login(ctx, appRoleClient)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_cert.go

@@ -26,7 +26,6 @@ import (
 	vault "github.com/hashicorp/vault/api"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -87,7 +86,7 @@ func (c *client) requestTokenWithCertAuth(ctx context.Context, certAuth *esv1.Va
 
 	url := strings.Join([]string{"auth", path, "login"}, "/")
 	vaultResult, err := c.logical.WriteWithContext(ctx, url, loginData)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return fmt.Errorf(errVaultRequest, err)
 	}

providers/v1/vault/auth_gcp.go

@@ -27,7 +27,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	gcpsm "github.com/external-secrets/external-secrets/providers/v1/gcp/secretmanager"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -86,7 +85,7 @@ func (c *client) requestTokenWithGcpAuth(ctx context.Context, gcpAuth *esv1.Vaul
 
 	// Authenticate with Vault using GCP auth
 	_, err = c.auth.Login(ctx, gcpAuthClient)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_iam.go

@@ -33,7 +33,6 @@ import (
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	vaultiamauth "github.com/external-secrets/external-secrets/providers/v1/vault/iamauth"
 	vaultutil "github.com/external-secrets/external-secrets/providers/v1/vault/util"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
 
@@ -152,7 +151,7 @@ func (c *client) requestTokenWithIamAuth(
 	}
 
 	_, err = c.auth.Login(ctx, awsAuthClient)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_jwt.go

@@ -23,7 +23,6 @@ import (
 	"strings"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -81,7 +80,7 @@ func (c *client) requestTokenWithJwtAuth(ctx context.Context, jwtAuth *esv1.Vaul
 	}
 	url := strings.Join([]string{"auth", jwtAuth.Path, "login"}, "/")
 	vaultResult, err := c.logical.WriteWithContext(ctx, url, parameters)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultWriteSecretData, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultWriteSecretData, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_kubernetes.go

@@ -27,7 +27,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -63,7 +62,7 @@ func (c *client) requestTokenWithKubernetesAuth(ctx context.Context, kubernetesA
 		return err
 	}
 	_, err = c.auth.Login(ctx, k)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_ldap.go

@@ -23,7 +23,6 @@ import (
 	authldap "github.com/hashicorp/vault/api/auth/ldap"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -52,7 +51,7 @@ func (c *client) requestTokenWithLdapAuth(ctx context.Context, ldapAuth *esv1.Va
 		return err
 	}
 	_, err = c.auth.Login(ctx, l)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/auth_userpass.go

@@ -23,7 +23,6 @@ import (
 	authuserpass "github.com/hashicorp/vault/api/auth/userpass"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils/resolvers"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -52,7 +51,7 @@ func (c *client) requestTokenWithUserPassAuth(ctx context.Context, userPassAuth
 		return err
 	}
 	_, err = c.auth.Login(ctx, l)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultLogin, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultLogin, err)
 	if err != nil {
 		return err
 	}

providers/v1/vault/client_get.go

@@ -26,7 +26,6 @@ import (
 	"github.com/tidwall/gjson"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -133,7 +132,7 @@ func (c *client) readSecret(ctx context.Context, path, version string) (map[stri
 		params["version"] = []string{version}
 	}
 	vaultSecret, err := c.logical.ReadWithDataWithContext(ctx, dataPath, params)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultReadSecretData, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultReadSecretData, err)
 	if err != nil {
 		return nil, fmt.Errorf(errReadSecret, err)
 	}
@@ -195,7 +194,7 @@ func (c *client) readSecretMetadata(ctx context.Context, path string) (map[strin
 		return nil, err
 	}
 	secret, err := c.logical.ReadWithDataWithContext(ctx, url, nil)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultReadSecretData, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultReadSecretData, err)
 	if err != nil {
 		return nil, fmt.Errorf(errReadSecret, err)
 	}

providers/v1/vault/client_get_all_secrets.go

@@ -23,7 +23,6 @@ import (
 	"strings"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/find"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -115,7 +114,7 @@ func (c *client) listSecrets(ctx context.Context, path string) ([]string, error)
 		return nil, err
 	}
 	secret, err := c.logical.ListWithContext(ctx, url)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultListSecrets, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultListSecrets, err)
 	if err != nil {
 		return nil, fmt.Errorf(errReadSecret, err)
 	}

providers/v1/vault/client_push.go

@@ -27,7 +27,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 )
@@ -149,14 +148,14 @@ func (c *client) PushSecret(ctx context.Context, secret *corev1.Secret, data esv
 	// Secret metadata should be pushed separately only for KV2
 	if c.store.Version == esv1.VaultKVStoreV2 {
 		_, err = c.logical.WriteWithContext(ctx, metaPath, label)
-		metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultWriteSecretData, err)
+		metrics.ObserveAPICall(ProviderHCVault, CallHCVaultWriteSecretData, err)
 		if err != nil {
 			return err
 		}
 	}
 	// Otherwise, create or update the version.
 	_, err = c.logical.WriteWithContext(ctx, path, secretToPush)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultWriteSecretData, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultWriteSecretData, err)
 	return err
 }
 
@@ -198,18 +197,18 @@ func (c *client) DeleteSecret(ctx context.Context, remoteRef esv1.PushSecretRemo
 				}
 			}
 			_, err = c.logical.WriteWithContext(ctx, path, secretToPush)
-			metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultDeleteSecret, err)
+			metrics.ObserveAPICall(ProviderHCVault, CallHCVaultDeleteSecret, err)
 			return err
 		}
 	}
 	_, err = c.logical.DeleteWithContext(ctx, path)
-	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultDeleteSecret, err)
+	metrics.ObserveAPICall(ProviderHCVault, CallHCVaultDeleteSecret, err)
 	if err != nil {
 		return fmt.Errorf("could not delete secret %v: %w", remoteRef.GetRemoteKey(), err)
 	}
 	if c.store.Version == esv1.VaultKVStoreV2 {
 		_, err = c.logical.DeleteWithContext(ctx, metaPath)
-		metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultDeleteSecret, err)
+		metrics.ObserveAPICall(ProviderHCVault, CallHCVaultDeleteSecret, err)
 		if err != nil {
 			return fmt.Errorf("could not delete secret metadata %v: %w", remoteRef.GetRemoteKey(), err)
 		}

providers/v1/vault/constants.go

@@ -0,0 +1,29 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package vault
+
+// Metrics constants identify the HashiCorp Vault provider and API calls.
+const (
+	ProviderHCVault            = "HashiCorp/Vault"
+	CallHCVaultLogin           = "Login"
+	CallHCVaultRevokeSelf      = "RevokeSelf"
+	CallHCVaultLookupSelf      = "LookupSelf"
+	CallHCVaultReadSecretData  = "ReadSecretData"
+	CallHCVaultWriteSecretData = "WriteSecretData"
+	CallHCVaultDeleteSecret    = "DeleteSecret"
+	CallHCVaultListSecrets     = "ListSecrets"
+)

providers/v1/webhook/pkg/webhook/constants.go

@@ -0,0 +1,23 @@
+/*
+Copyright © The ESO Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhook
+
+// Metrics constants identify the Webhook provider and API calls.
+const (
+	ProviderWebhook    = "Webhook"
+	CallWebhookHTTPReq = "HTTPRequest"
+)

providers/v1/webhook/pkg/webhook/webhook.go

@@ -36,7 +36,6 @@ import (
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
-	"github.com/external-secrets/external-secrets/runtime/constants"
 	"github.com/external-secrets/external-secrets/runtime/esutils"
 	"github.com/external-secrets/external-secrets/runtime/metrics"
 	"github.com/external-secrets/external-secrets/runtime/template/v2"
@@ -298,7 +297,7 @@ func (w *Webhook) executeRequest(ctx context.Context, provider *Spec, data []byt
 	}
 
 	resp, err := w.HTTP.Do(req)
-	metrics.ObserveAPICall(constants.ProviderWebhook, constants.CallWebhookHTTPReq, err)
+	metrics.ObserveAPICall(ProviderWebhook, CallWebhookHTTPReq, err)
 	if err != nil {
 		return nil, fmt.Errorf("failed to call endpoint: %w", err)
 	}

runtime/constants/constants.go

@@ -17,137 +17,8 @@ limitations under the License.
 // Package constants holds constant values for the project.
 package constants
 
-// These constants are used for identifying providers and calls to them.
+// Status and label constants define shared status values and Kubernetes labels.
 const (
-	ProviderAWSACM                      = "AWS/CertificateManager"
-	CallAWSACMImportCertificate         = "ImportCertificate"
-	CallAWSACMDeleteCertificate         = "DeleteCertificate"
-	CallAWSACMListCertificates          = "ListCertificates"
-	CallAWSACMAddTagsToCertificate      = "AddTagsToCertificate"
-	CallAWSACMListTagsForCertificate    = "ListTagsForCertificate"
-	CallAWSACMRemoveTagsFromCertificate = "RemoveTagsFromCertificate"
-	CallAWSACMDescribeCertificate       = "DescribeCertificate"
-	CallAWSACMExportCertificate         = "ExportCertificate"
-	CallAWSACMGetCertificate            = "GetCertificate"
-	CallAWSACMGetResources              = "GetResources"
-
-	ProviderAWSSM                         = "AWS/SecretsManager"
-	CallAWSSMGetSecretValue               = "GetSecretValue"
-	CallAWSPSGetParametersByPath          = "GetParametersByPath"
-	CallAWSSMDescribeSecret               = "DescribeSecret"
-	CallAWSSMDeleteSecret                 = "DeleteSecret"
-	CallAWSSMCreateSecret                 = "CreateSecret"
-	CallAWSSMPutSecretValue               = "PutSecretValue"
-	CallAWSSMListSecrets                  = "ListSecrets"
-	CallAWSSMBatchGetSecretValue          = "BatchGetSecretValue"
-	CallAWSSMUntagResource                = "UntagResource"
-	CallAWSSMTagResource                  = "TagResource"
-	CallAWSSMPutResourcePolicy            = "PutResourcePolicy"
-	CallAWSSMGetResourcePolicy            = "GetResourcePolicy"
-	CallAWSSMDeleteResourcePolicy         = "DeleteResourcePolicy"
-	CallAWSSMReplicateSecretToRegions     = "ReplicateSecretToRegions"
-	CallAWSSMRemoveRegionsFromReplication = "RemoveRegionsFromReplication"
-
-	ProviderAWSPS                = "AWS/ParameterStore"
-	CallAWSPSGetParameter        = "GetParameter"
-	CallAWSPSPutParameter        = "PutParameter"
-	CallAWSPSDeleteParameter     = "DeleteParameter"
-	CallAWSPSDescribeParameter   = "DescribeParameter"
-	CallAWSPSRemoveTagsParameter = "RemoveTagsFromResource"
-	CallAWSPSAddTagsParameter    = "AddTagsToResource"
-	CallAWSPSListTagsForResource = "ListTagsForResource"
-
-	ProviderAzureKV              = "Azure/KeyVault"
-	CallAzureKVGetKey            = "GetKey"
-	CallAzureKVDeleteKey         = "DeleteKey"
-	CallAzureKVImportKey         = "ImportKey"
-	CallAzureKVGetSecret         = "GetSecret"
-	CallAzureKVGetSecrets        = "GetSecrets"
-	CallAzureKVSetSecret         = "SetSecret"
-	CallAzureKVDeleteSecret      = "DeleteSecret"
-	CallAzureKVGetCertificate    = "GetCertificate"
-	CallAzureKVDeleteCertificate = "DeleteCertificate"
-	CallAzureKVImportCertificate = "ImportCertificate"
-
-	ProviderGCPSM                = "GCP/SecretManager"
-	CallGCPSMGetSecret           = "GetSecret"
-	CallGCPSMDeleteSecret        = "DeleteSecret"
-	CallGCPSMCreateSecret        = "CreateSecret"
-	CallGCPSMUpdateSecret        = "UpdateSecret"
-	CallGCPSMAccessSecretVersion = "AccessSecretVersion"
-	CallGCPSMAddSecretVersion    = "AddSecretVersion"
-	CallGCPSMListSecrets         = "ListSecrets"
-	CallGCPSMGenerateSAToken     = "GenerateServiceAccountToken"
-	CallGCPSMGenerateIDBindToken = "GenerateIDBindToken"
-	CallGCPSMGenerateAccessToken = "GenerateAccessToken"
-
-	ProviderHCVault            = "HashiCorp/Vault"
-	CallHCVaultLogin           = "Login"
-	CallHCVaultRevokeSelf      = "RevokeSelf"
-	CallHCVaultLookupSelf      = "LookupSelf"
-	CallHCVaultReadSecretData  = "ReadSecretData"
-	CallHCVaultWriteSecretData = "WriteSecretData"
-	CallHCVaultDeleteSecret    = "DeleteSecret"
-	CallHCVaultListSecrets     = "ListSecrets"
-
-	ProviderKubernetes                         = "Kubernetes"
-	CallKubernetesGetSecret                    = "GetSecret"
-	CallKubernetesListSecrets                  = "ListSecrets"
-	CallKubernetesCreateSecret                 = "CreateSecret"
-	CallKubernetesDeleteSecret                 = "DeleteSecret"
-	CallKubernetesUpdateSecret                 = "UpdateSecret"
-	CallKubernetesCreateSelfSubjectRulesReview = "CreateSelfSubjectRulesReview"
-
-	ProviderIBMSM                = "IBM/SecretsManager"
-	CallIBMSMGetSecret           = "GetSecret"
-	CallIBMSMListSecrets         = "ListSecrets"
-	CallIBMSMGetSecretByNameType = "GetSecretByNameType"
-
-	ProviderWebhook    = "Webhook"
-	CallWebhookHTTPReq = "HTTPRequest"
-
-	ProviderGitLab                 = "GitLab"
-	CallGitLabListProjectsGroups   = "ListProjectsGroups"
-	CallGitLabProjectVariableGet   = "ProjectVariableGet"
-	CallGitLabProjectListVariables = "ProjectVariablesList"
-	CallGitLabGroupGetVariable     = "GroupVariableGet"
-	CallGitLabGroupListVariables   = "GroupVariablesList"
-
-	ProviderAKEYLESSSM                  = "AKEYLESSLESS/SecretsManager"
-	CallAKEYLESSSMGetSecretValue        = "GetSecretValue"
-	CallAKEYLESSSMDescribeItem          = "DescribeItem"
-	CallAKEYLESSSMListItems             = "ListItems"
-	CallAKEYLESSSMAuth                  = "Auth"
-	CallAKEYLESSSMGetRotatedSecretValue = "GetRotatedSecretValue"
-	CallAKEYLESSSMGetCertificateValue   = "GetCertificateValue"
-	CallAKEYLESSSMGetDynamicSecretValue = "GetDynamicSecretsValue"
-	CallAKEYLESSSMCreateSecret          = "CreateSecret"
-	CallAKEYLESSSMUpdateSecretVal       = "UpdateSecretVal"
-	CallAKEYLESSSMDeleteItem            = "DeleteItem"
-
-	ProviderOnePasswordSDK                = "1Password/SDK"
-	CallOnePasswordSDKResolve             = "Resolve"
-	CallOnePasswordSDKItemsList           = "ItemsList"
-	CallOnePasswordSDKItemsGet            = "ItemsGet"
-	CallOnePasswordSDKItemsCreate         = "ItemsCreate"
-	CallOnePasswordSDKItemsPut            = "ItemsPut"
-	CallOnePasswordSDKItemsDelete         = "ItemsDelete"
-	CallOnePasswordSDKFilesRead           = "FilesRead"
-	CallOnePasswordSDKVaultsList          = "VaultsList"
-	CallOnePasswordSDKEnvironmentsGetVars = "EnvironmentsGetVariables"
-
-	ProviderNebiusMysterybox           = "Nebius/Mysterybox"
-	CallNebiusMysteryboxGetSecret      = "GetSecret"
-	CallNebiusMysteryboxGetSecretByKey = "GetSecretByKey"
-	CallNebiusMysteryboxAuth           = "Auth"
-
-	ProviderKeeperSecurity                       = "KeeperSecurity"
-	CallKeeperSecurityGetSecrets                 = "GetSecrets"
-	CallKeeperSecurityGetSecretsByTitle          = "GetSecretsByTitle"
-	CallKeeperSecurityCreateSecretWithRecordData = "CreateSecretWithRecordData"
-	CallKeeperSecuritySave                       = "Save"
-	CallKeeperSecurityDeleteSecrets              = "DeleteSecrets"
-
 	StatusError   = "error"
 	StatusSuccess = "success"