public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Encryption: Enable envelope encryption by default (#49301)

Browse Source 
* Encryption: Enable envelope encryption by default

* Stop relying on feature toggles from settings (deprecated)

* Database encryption docs (envelope encryption)

* Remove deprecated (and no longer used) FT

* Apply suggestions from code review

Co-authored-by: Tania <yalyna.ts@gmail.com>
This commit is contained in:
Joan López de la Franca Beltran
2022-05-24 10:34:47 +02:00
committed by GitHub
co-authored by Tania
parent 521b0202e2
commit 3e4b4dba46
12 changed files with 107 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/secrets/manager/manager.go
+6 -6
View File
@@ -54,7 +54,7 @@ func ProvideSecretsService(
}
logger := log.New("secrets")
enabled := features.IsEnabled(featuremgmt.FlagEnvelopeEncryption)
enabled := !features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption)
currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID(
settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
))
@@ -94,7 +94,7 @@ func (s *SecretsService) registerUsageMetrics() {
// Enabled / disabled
usageMetrics["stats.encryption.envelope_encryption_enabled.count"] = 0
if s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
if !s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
usageMetrics["stats.encryption.envelope_encryption_enabled.count"] = 1
}
@@ -131,8 +131,8 @@ func (s *SecretsService) Encrypt(ctx context.Context, payload []byte, opt secret
}
func (s *SecretsService) EncryptWithDBSession(ctx context.Context, payload []byte, opt secrets.EncryptionOptions, sess *xorm.Session) ([]byte, error) {
// Use legacy encryption service if envelopeEncryptionFeatureToggle toggle is off
if !s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
return s.enc.Encrypt(ctx, payload, setting.SecretKey)
}
@@ -291,8 +291,8 @@ func newRandomDataKey() ([]byte, error) {
}
func (s *SecretsService) Decrypt(ctx context.Context, payload []byte) ([]byte, error) {
// Use legacy encryption service if featuremgmt.FlagEnvelopeEncryption toggle is off
if !s.features.IsEnabled(featuremgmt.FlagEnvelopeEncryption) {
// Use legacy encryption service if featuremgmt.FlagDisableEnvelopeEncryption toggle is on
if s.features.IsEnabled(featuremgmt.FlagDisableEnvelopeEncryption) {
return s.enc.Decrypt(ctx, payload, setting.SecretKey)
}