IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Encryption: Refactor secrets.Service initialization (#51091)

Browse Source 
* Encryption: Refactor secrets.Service initialization
This commit is contained in:
Joan López de la Franca Beltran 2022-07-07 09:48:25 +02:00 committed by GitHub
parent 9f2df8f8ee
commit 81753526bd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 37 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/services/kmsproviders/osskmsproviders/osskmsproviders.go
View File

@ -24,10 +24,6 @@ func ProvideService(enc encryption.Internal, settings setting.Provider, features
} }
func (s Service) Provide() (map[secrets.ProviderID]secrets.Provider, error) { func (s Service) Provide() (map[secrets.ProviderID]secrets.Provider, error) {
if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
return nil, nil
}
return map[secrets.ProviderID]secrets.Provider{ return map[secrets.ProviderID]secrets.Provider{
kmsproviders.Default: grafana.New(s.settings, s.enc), kmsproviders.Default: grafana.New(s.settings, s.enc),
}, nil }, nil

53
pkg/services/secrets/manager/manager.go
View File

@ -34,7 +34,10 @@ type SecretsService struct {
mtx sync.Mutex mtx sync.Mutex
dataKeyCache *dataKeyCache dataKeyCache *dataKeyCache
pOnce sync.Once
providers map[secrets.ProviderID]secrets.Provider providers map[secrets.ProviderID]secrets.Provider
kmsProvidersService kmsproviders.Service
currentProviderID secrets.ProviderID currentProviderID secrets.ProviderID
log log.Logger log log.Logger
@ -48,46 +51,56 @@ func ProvideSecretsService(
features featuremgmt.FeatureToggles, features featuremgmt.FeatureToggles,
usageStats usagestats.Service, usageStats usagestats.Service,
) (*SecretsService, error) { ) (*SecretsService, error) {
providers, err := kmsProvidersService.Provide() ttl := settings.KeyValue("security.encryption", "data_keys_cache_ttl").MustDuration(15 * time.Minute)
if err != nil {
return nil, err
}
logger := log.New("secrets")
enabled := !features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption)
currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID( currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID(
settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default), settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
)) ))
if _, ok := providers[currentProviderID]; enabled && !ok {
return nil, fmt.Errorf("missing configuration for current encryption provider %s", currentProviderID)
}
if !enabled && currentProviderID != kmsproviders.Default {
logger.Warn("Changing encryption provider requires enabling envelope encryption feature")
}
logger.Info("Envelope encryption state", "enabled", enabled, "current provider", currentProviderID)
ttl := settings.KeyValue("security.encryption", "data_keys_cache_ttl").MustDuration(15 * time.Minute)
s := &SecretsService{ s := &SecretsService{
store: store, store: store,
enc: enc, enc: enc,
settings: settings, settings: settings,
usageStats: usageStats, usageStats: usageStats,
providers: providers, kmsProvidersService: kmsProvidersService,
dataKeyCache: newDataKeyCache(ttl), dataKeyCache: newDataKeyCache(ttl),
currentProviderID: currentProviderID, currentProviderID: currentProviderID,
features: features, features: features,
log: logger, log: log.New("secrets"),
} }
enabled := !features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption)
if enabled {
err := s.InitProviders()
if err != nil {
return nil, err
}
}
if _, ok := s.providers[currentProviderID]; enabled && !ok {
return nil, fmt.Errorf("missing configuration for current encryption provider %s", currentProviderID)
}
if !enabled && currentProviderID != kmsproviders.Default {
s.log.Warn("Changing encryption provider requires enabling envelope encryption feature")
}
s.log.Info("Envelope encryption state", "enabled", enabled, "current provider", currentProviderID)
s.registerUsageMetrics() s.registerUsageMetrics()
return s, nil return s, nil
} }
func (s *SecretsService) InitProviders() (err error) {
s.pOnce.Do(func() {
s.providers, err = s.kmsProvidersService.Provide()
})
return
}
func (s *SecretsService) registerUsageMetrics() { func (s *SecretsService) registerUsageMetrics() {
s.usageStats.RegisterMetricsFunc(func(context.Context) (map[string]interface{}, error) { s.usageStats.RegisterMetricsFunc(func(context.Context) (map[string]interface{}, error) {
usageMetrics := make(map[string]interface{}) usageMetrics := make(map[string]interface{})