IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Secrets: Add unified secrets table to reencryption (#48582)

Browse Source 
* Add secrets table to reencryption

* Add updated column check for b64Secret reencryption

* Use field values for b64Secret to clarify booleans
This commit is contained in:
Guilherme Caulada
2022-05-02 18:15:46 -03:00
committed by GitHub
parent 815fc42da3
commit 2e9c38c951
3 changed files with 25 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/cmd/grafana-cli/commands/secretsmigrations/reencrypt_secrets.go
View File

@@ -104,8 +104,13 @@ func (s b64Secret) reencrypt(secretsSrv *manager.SecretsService, sess *xorm.Sess
} }
encoded := base64.StdEncoding.EncodeToString(encrypted) encoded := base64.StdEncoding.EncodeToString(encrypted)
if s.hasUpdatedColumn {
updateSQL := fmt.Sprintf("UPDATE %s SET %s = ?, updated = ? WHERE id = ?", s.tableName, s.columnName)
_, err = sess.Exec(updateSQL, encoded, nowInUTC(), row.Id)
} else {
updateSQL := fmt.Sprintf("UPDATE %s SET %s = ? WHERE id = ?", s.tableName, s.columnName) updateSQL := fmt.Sprintf("UPDATE %s SET %s = ? WHERE id = ?", s.tableName, s.columnName)
_, err = sess.Exec(updateSQL, encoded, row.Id) _, err = sess.Exec(updateSQL, encoded, row.Id)
}
if err != nil { if err != nil {
anyFailure = true anyFailure = true
@@ -256,9 +261,10 @@ func ReEncryptSecrets(_ utils.CommandLine, runner runner.Runner) error {
reencrypt(*manager.SecretsService, *xorm.Session) reencrypt(*manager.SecretsService, *xorm.Session)
}{ }{
simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"}, simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}},
b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true},
jsonSecret{tableName: "data_source"}, jsonSecret{tableName: "data_source"},
jsonSecret{tableName: "plugin_setting"}, jsonSecret{tableName: "plugin_setting"},
alertingSecret{}, alertingSecret{},

16
pkg/cmd/grafana-cli/commands/secretsmigrations/rollback_secrets.go
View File

@@ -112,8 +112,15 @@ func (s b64Secret) rollback(
} }
encoded := base64.StdEncoding.EncodeToString(encrypted) encoded := base64.StdEncoding.EncodeToString(encrypted)
if s.hasUpdatedColumn {
updateSQL := fmt.Sprintf("UPDATE %s SET %s = ?, updated = ? WHERE id = ?", s.tableName, s.columnName)
_, err = sess.Exec(updateSQL, encoded, nowInUTC(), row.Id)
} else {
updateSQL := fmt.Sprintf("UPDATE %s SET %s = ? WHERE id = ?", s.tableName, s.columnName) updateSQL := fmt.Sprintf("UPDATE %s SET %s = ? WHERE id = ?", s.tableName, s.columnName)
if _, err := sess.Exec(updateSQL, encoded, row.Id); err != nil { _, err = sess.Exec(updateSQL, encoded, row.Id)
}
if err != nil {
anyFailure = true anyFailure = true
logger.Warn("Could not update secret while rolling it back", "table", s.tableName, "id", row.Id, "error", err) logger.Warn("Could not update secret while rolling it back", "table", s.tableName, "id", row.Id, "error", err)
continue continue
@@ -272,9 +279,10 @@ func RollBackSecrets(_ utils.CommandLine, runner runner.Runner) error {
rollback(*manager.SecretsService, encryption.Internal, *xorm.Session, string) bool rollback(*manager.SecretsService, encryption.Internal, *xorm.Session, string) bool
}{ }{
simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"}, simpleSecret{tableName: "dashboard_snapshot", columnName: "dashboard_encrypted"},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_access_token"}},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_refresh_token"}},
b64Secret{simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}}, b64Secret{simpleSecret: simpleSecret{tableName: "user_auth", columnName: "o_auth_token_type"}},
b64Secret{simpleSecret: simpleSecret{tableName: "secrets", columnName: "value"}, hasUpdatedColumn: true},
jsonSecret{tableName: "data_source"}, jsonSecret{tableName: "data_source"},
jsonSecret{tableName: "plugin_setting"}, jsonSecret{tableName: "plugin_setting"},
alertingSecret{}, alertingSecret{},

1
pkg/cmd/grafana-cli/commands/secretsmigrations/secretsmigrations.go
View File

@@ -13,6 +13,7 @@ type simpleSecret struct {
type b64Secret struct { type b64Secret struct {
simpleSecret simpleSecret
hasUpdatedColumn bool
} }
type jsonSecret struct { type jsonSecret struct {