IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-14 07:04:57 -05:00
Code Issues Packages Projects Releases Wiki Activity

Encryption: Enable envelope encryption by default (#49301)

Browse Source 
* Encryption: Enable envelope encryption by default

* Stop relying on feature toggles from settings (deprecated)

* Database encryption docs (envelope encryption)

* Remove deprecated (and no longer used) FT

* Apply suggestions from code review

Co-authored-by: Tania <yalyna.ts@gmail.com>
This commit is contained in:
Joan López de la Franca Beltran
2022-05-24 10:34:47 +02:00
committed by GitHub
co-authored by Tania
parent 521b0202e2
commit 3e4b4dba46
12 changed files with 107 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/secrets/manager/helpers.go
+1 -5
View File
@@ -9,7 +9,6 @@ import (
"github.com/grafana/grafana/pkg/services/kmsproviders/osskmsproviders"
"github.com/grafana/grafana/pkg/services/secrets"
"github.com/grafana/grafana/pkg/setting"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"gopkg.in/ini.v1"
)
@@ -29,14 +28,11 @@ func SetupTestService(tb testing.TB, store secrets.Store) *SecretsService {
data_keys_cache_cleanup_interval = 1ns`))
require.NoError(tb, err)
features := featuremgmt.WithFeatures(featuremgmt.FlagEnvelopeEncryption)
features := featuremgmt.WithFeatures()
cfg := &setting.Cfg{Raw: raw}
cfg.IsFeatureToggleEnabled = features.IsEnabled
settings := &setting.OSSImpl{Cfg: cfg}
assert.True(tb, settings.IsFeatureToggleEnabled(featuremgmt.FlagEnvelopeEncryption))
assert.True(tb, features.IsEnabled(featuremgmt.FlagEnvelopeEncryption))
encryption := ossencryption.ProvideService()
secretsService, err := ProvideSecretsService(
pkg/services/secrets/manager/manager.go
+6 -6
View File
@@ -54,7 +54,7 @@ func ProvideSecretsService(
}
logger := log.New("secrets")
enabled := features.IsEnabled(featuremgmt.FlagEnvelopeEncryption)
enabled := !features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption)
currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID(
settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
))
@@ -94,7 +94,7 @@ func (s *SecretsService) registerUsageMetrics() {
// Enabled / disabled
usageMetrics["stats.encryption.envelope_encryption_enabled.count"] = 0
if s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
if !s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
usageMetrics["stats.encryption.envelope_encryption_enabled.count"] = 1
}
@@ -131,8 +131,8 @@ func (s *SecretsService) Encrypt(ctx context.Context, payload []byte, opt secret
}
func (s *SecretsService) EncryptWithDBSession(ctx context.Context, payload []byte, opt secrets.EncryptionOptions, sess *xorm.Session) ([]byte, error) {
// Use legacy encryption service if envelopeEncryptionFeatureToggle toggle is off
if !s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
return s.enc.Encrypt(ctx, payload, setting.SecretKey)
}
@@ -291,8 +291,8 @@ func newRandomDataKey() ([]byte, error) {
}
func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) {
// Use legacy encryption service if featuremgmt.FlagEnvelopeEncryption toggle is off
if !s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
return s.enc.Decrypt(ctx, payload, setting.SecretKey)
}
pkg/services/secrets/manager/manager_test.go
+10 -16
View File
@@ -190,32 +190,26 @@ func TestSecretsService_UseCurrentProvider(t *testing.T) {
raw, err := ini.Load([]byte(rawCfg))
require.NoError(t, err)
features := featuremgmt.WithFeatures(featuremgmt.FlagEnvelopeEncryption)
providerID := secrets.ProviderID("fakeProvider.v1")
settings := &setting.OSSImpl{
Cfg: &setting.Cfg{
Raw: raw,
IsFeatureToggleEnabled: features.IsEnabled,
},
}
encr := ossencryption.ProvideService()
kms := newFakeKMS(osskmsproviders.ProvideService(encr, settings, features))
encryptionService := ossencryption.ProvideService()
settings := &setting.OSSImpl{Cfg: &setting.Cfg{Raw: raw}}
features := featuremgmt.WithFeatures()
kms := newFakeKMS(osskmsproviders.ProvideService(encryptionService, settings, features))
secretStore := database.ProvideSecretsStore(sqlstore.InitTestDB(t))
svcEncrypt, err := ProvideSecretsService(
secretsService, err := ProvideSecretsService(
secretStore,
&kms,
encr,
encryptionService,
settings,
features,
&usagestats.UsageStatsMock{T: t},
)
require.NoError(t, err)
assert.Equal(t, providerID, svcEncrypt.currentProviderID)
assert.Equal(t, 2, len(svcEncrypt.GetProviders()))
assert.Equal(t, secrets.ProviderID("fakeProvider.v1"), secretsService.currentProviderID)
assert.Equal(t, 2, len(secretsService.GetProviders()))
encrypted, _ := svcEncrypt.Encrypt(context.Background(), []byte{}, secrets.WithoutScope())
encrypted, _ := secretsService.Encrypt(context.Background(), []byte{}, secrets.WithoutScope())
assert.True(t, kms.fake.encryptCalled)
// secret service tries to find a DEK in a cache first before calling provider's decrypt
@@ -223,7 +217,7 @@ func TestSecretsService_UseCurrentProvider(t *testing.T) {
svcDecrypt, err := ProvideSecretsService(
secretStore,
&kms,
encr,
encryptionService,
settings,
features,
&usagestats.UsageStatsMock{T: t},