IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Cloud migration: encryption key is a byte slice (#90739)

Browse Source 
* Cloud migrations: include metadata returned by CMS in the index file

* Cloud migrations: make EncryptionKey a []byte in structs

* test
This commit is contained in:
Bruno 2024-07-22 11:25:12 -03:00 committed by GitHub
parent 7fdf992dab
commit 8d8f2ba587
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 8 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/services/cloudmigration/cloudmigrationimpl/snapshot_mgmt.go
View File

@ -188,7 +188,7 @@ func (s *Service) buildSnapshot(ctx context.Context, signedInUser *user.SignedIn
// Use GMS public key + the grafana generated private private key to encrypt snapshot files.
snapshotWriter, err := snapshot.NewSnapshotWriter(contracts.AssymetricKeys{
Public: []byte(snapshotMeta.EncryptionKey),
Public: snapshotMeta.EncryptionKey,
Private: privateKey[:],
},
crypto.NewNacl(),

13
pkg/services/cloudmigration/cloudmigrationimpl/xorm_store.go
View File

@ -413,27 +413,22 @@ func (ss *sqlStore) decryptToken(ctx context.Context, cm *cloudmigration.CloudMi
}
func (ss *sqlStore) encryptKey(ctx context.Context, snapshot *cloudmigration.CloudMigrationSnapshot) error {
s, err := ss.secretsService.Encrypt(ctx, []byte(snapshot.EncryptionKey), secrets.WithoutScope())
s, err := ss.secretsService.Encrypt(ctx, snapshot.EncryptionKey, secrets.WithoutScope())
if err != nil {
return fmt.Errorf("encrypting key: %w", err)
}
snapshot.EncryptionKey = base64.StdEncoding.EncodeToString(s)
snapshot.EncryptionKey = s
return nil
}
func (ss *sqlStore) decryptKey(ctx context.Context, snapshot *cloudmigration.CloudMigrationSnapshot) error {
decoded, err := base64.StdEncoding.DecodeString(snapshot.EncryptionKey)
if err != nil {
return fmt.Errorf("key could not be decoded")
}
t, err := ss.secretsService.Decrypt(ctx, decoded)
t, err := ss.secretsService.Decrypt(ctx, snapshot.EncryptionKey)
if err != nil {
return fmt.Errorf("decrypting key: %w", err)
}
snapshot.EncryptionKey = string(t)
snapshot.EncryptionKey = t
return nil
}

2
pkg/services/cloudmigration/gmsclient/inmemory_client.go
View File

@ -57,7 +57,7 @@ func (c *memoryClientImpl) StartSnapshot(context.Context, cloudmigration.CloudMi
return nil, fmt.Errorf("nacl: generating public and private key: %w", err)
}
c.snapshot = &cloudmigration.StartSnapshotResponse{
EncryptionKey: fmt.Sprintf("%x", publicKey[:]),
EncryptionKey: publicKey[:],
SnapshotID: uuid.NewString(),
MaxItemsPerPartition: 10,
Algo: "nacl",

4
pkg/services/cloudmigration/model.go
View File

@ -37,7 +37,7 @@ type CloudMigrationSnapshot struct {
UID string `xorm:"uid"`
SessionUID string `xorm:"session_uid"`
Status SnapshotStatus
EncryptionKey string `xorm:"encryption_key"` // stored in the unified secrets table
EncryptionKey []byte `xorm:"encryption_key"` // stored in the unified secrets table
LocalDir string `xorm:"local_directory"`
GMSSnapshotUID string `xorm:"gms_snapshot_uid"`
ErrorString string `xorm:"error_string"`
@ -207,7 +207,7 @@ type StartSnapshotResponse struct {
SnapshotID string `json:"snapshotID"`
MaxItemsPerPartition uint32 `json:"maxItemsPerPartition"`
Algo string `json:"algo"`
EncryptionKey string `json:"encryptionKey"`
EncryptionKey []byte `json:"encryptionKey"`
Metadata []byte `json:"metadata"`
}