public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Encryption: Enable envelope encryption by default (#49301)

Browse Source 
* Encryption: Enable envelope encryption by default

* Stop relying on feature toggles from settings (deprecated)

* Database encryption docs (envelope encryption)

* Remove deprecated (and no longer used) FT

* Apply suggestions from code review

Co-authored-by: Tania <yalyna.ts@gmail.com>
This commit is contained in:
Joan López de la Franca Beltran
2022-05-24 10:34:47 +02:00
committed by GitHub
co-authored by Tania
parent 521b0202e2
commit 3e4b4dba46
12 changed files with 107 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/secrets/manager/manager_test.go
+10 -16
View File
@@ -190,32 +190,26 @@ func TestSecretsService_UseCurrentProvider(t *testing.T) {
raw, err := ini.Load([]byte(rawCfg))
require.NoError(t, err)
features := featuremgmt.WithFeatures(featuremgmt.FlagEnvelopeEncryption)
providerID := secrets.ProviderID("fakeProvider.v1")
settings := &setting.OSSImpl{
Cfg: &setting.Cfg{
Raw: raw,
IsFeatureToggleEnabled: features.IsEnabled,
},
}
encr := ossencryption.ProvideService()
kms := newFakeKMS(osskmsproviders.ProvideService(encr, settings, features))
encryptionService := ossencryption.ProvideService()
settings := &setting.OSSImpl{Cfg: &setting.Cfg{Raw: raw}}
features := featuremgmt.WithFeatures()
kms := newFakeKMS(osskmsproviders.ProvideService(encryptionService, settings, features))
secretStore := database.ProvideSecretsStore(sqlstore.InitTestDB(t))
svcEncrypt, err := ProvideSecretsService(
secretsService, err := ProvideSecretsService(
secretStore,
&kms,
encr,
encryptionService,
settings,
features,
&usagestats.UsageStatsMock{T: t},
)
require.NoError(t, err)
assert.Equal(t, providerID, svcEncrypt.currentProviderID)
assert.Equal(t, 2, len(svcEncrypt.GetProviders()))
assert.Equal(t, secrets.ProviderID("fakeProvider.v1"), secretsService.currentProviderID)
assert.Equal(t, 2, len(secretsService.GetProviders()))
encrypted, _ := svcEncrypt.Encrypt(context.Background(), []byte{}, secrets.WithoutScope())
encrypted, _ := secretsService.Encrypt(context.Background(), []byte{}, secrets.WithoutScope())
assert.True(t, kms.fake.encryptCalled)
// secret service tries to find a DEK in a cache first before calling provider's decrypt
@@ -223,7 +217,7 @@ func TestSecretsService_UseCurrentProvider(t *testing.T) {
svcDecrypt, err := ProvideSecretsService(
secretStore,
&kms,
encr,
encryptionService,
settings,
features,
&usagestats.UsageStatsMock{T: t},