public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Fix unified secrets backwards compatibility (#49719) (#50009)

Browse Source 
* Fix unified secrets backwards compatibility

* Add compatibility fix to AddDataSource function

* Allow updating password on fail to decrypt secrets

* If unified secret is corrupt try migrating

(cherry picked from commit 470be98588)

Co-authored-by: Guilherme Caulada <guilherme.caulada@grafana.com>
This commit is contained in:
Grot (@grafanabot)
2022-06-01 11:10:02 -03:00
committed by GitHub
co-authored by Guilherme Caulada
parent 3b5511db2b
commit 382eaaa773
1 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/datasources/service/datasource_service.go
+23 -8
View File
@@ -146,6 +146,12 @@ func (s *Service) GetDataSourcesByType(ctx context.Context, query *models.GetDat
func (s *Service) AddDataSource(ctx context.Context, cmd *models.AddDataSourceCommand) error { func (s *Service) AddDataSource(ctx context.Context, cmd *models.AddDataSourceCommand) error {
var err error var err error
// this is here for backwards compatibility
cmd.EncryptedSecureJsonData, err = s.SecretsService.EncryptJsonData(ctx, cmd.SecureJsonData, secrets.WithoutScope())
if err != nil {
return err
}
if err := s.SQLStore.AddDataSource(ctx, cmd); err != nil { if err := s.SQLStore.AddDataSource(ctx, cmd); err != nil {
return err return err
} }
@@ -287,11 +293,10 @@ func (s *Service) DecryptedValues(ctx context.Context, ds *models.DataSource) (m
} }
if exist { if exist {
err := json.Unmarshal([]byte(secret), &decryptedValues) err = json.Unmarshal([]byte(secret), &decryptedValues)
if err != nil { }
return nil, err
} if (!exist || err != nil) && len(ds.SecureJsonData) > 0 {
} else if len(ds.SecureJsonData) > 0 {
decryptedValues, err = s.MigrateSecrets(ctx, ds) decryptedValues, err = s.MigrateSecrets(ctx, ds)
if err != nil { if err != nil {
return nil, err return nil, err
@@ -302,9 +307,13 @@ func (s *Service) DecryptedValues(ctx context.Context, ds *models.DataSource) (m
} }
func (s *Service) MigrateSecrets(ctx context.Context, ds *models.DataSource) (map[string]string, error) { func (s *Service) MigrateSecrets(ctx context.Context, ds *models.DataSource) (map[string]string, error) {
secureJsonData, err := s.SecretsService.DecryptJsonData(ctx, ds.SecureJsonData) secureJsonData := make(map[string]string)
if err != nil { for k, v := range ds.SecureJsonData {
return nil, err decrypted, err := s.SecretsService.Decrypt(ctx, v)
if err != nil {
return nil, err
}
secureJsonData[k] = string(decrypted)
} }
jsonData, err := json.Marshal(secureJsonData) jsonData, err := json.Marshal(secureJsonData)
@@ -579,5 +588,11 @@ func (s *Service) fillWithSecureJSONData(ctx context.Context, cmd *models.Update
} }
} }
// this is here for backwards compatibility
cmd.EncryptedSecureJsonData, err = s.SecretsService.EncryptJsonData(ctx, cmd.SecureJsonData, secrets.WithoutScope())
if err != nil {
return err
}
return nil return nil
} }