public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Encryption: Use secrets service (#40251)

Browse Source 
* Use secrets service in pluginproxy

* Use secrets service in pluginxontext

* Use secrets service in pluginsettings

* Use secrets service in provisioning

* Use secrets service in authinfoservice

* Use secrets service in api

* Use secrets service in sqlstore

* Use secrets service in dashboardshapshots

* Use secrets service in tsdb

* Use secrets service in datasources

* Use secrets service in alerting

* Use secrets service in ngalert

* Break cyclic dependancy

* Refactor service

* Break cyclic dependancy

* Add FakeSecretsStore

* Setup Secrets Service in sqlstore

* Fix

* Continue secrets service refactoring

* Fix cyclic dependancy in sqlstore tests

* Fix secrets service references

* Fix linter errors

* Add fake secrets service for tests

* Refactor SetupTestSecretsService

* Update setting up secret service in tests

* Fix missing secrets service in multiorg_alertmanager_test

* Use fake db in tests and sort imports

* Use fake db in datasources tests

* Fix more tests

* Fix linter issues

* Attempt to fix plugin proxy tests

* Pass secrets service to getPluginProxiedRequest in pluginproxy tests

* Fix pluginproxy tests

* Revert using secrets service in alerting and provisioning

* Update decryptFn in alerting migration

* Rename defaultProvider to currentProvider

* Use fake secrets service in alert channels tests

* Refactor secrets service test helper

* Update setting up secrets service in tests

* Revert alerting changes in api

* Add comments

* Remove secrets service from background services

* Convert global encryption functions into vars

* Revert "Convert global encryption functions into vars"

This reverts commit 498eb19859.

* Add feature toggle for envelope encryption

* Rename toggle

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>
This commit is contained in:
Tania B
2021-11-04 18:47:21 +02:00
committed by GitHub
co-authored by Emil Tullstedt Joan López de la Franca Beltran
parent 9e29484c80
commit 5652bde447
58 changed files with 441 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/pluginsettings/service.go
+11 -12
View File
@@ -8,15 +8,14 @@ import (
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/encryption"
"github.com/grafana/grafana/pkg/services/secrets"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
)
type Service struct {
Bus bus.Bus
SQLStore *sqlstore.SQLStore
EncryptionService encryption.Service
Bus bus.Bus
SQLStore *sqlstore.SQLStore
SecretsService secrets.Service
logger log.Logger
pluginSettingDecryptionCache secureJSONDecryptionCache
@@ -32,12 +31,12 @@ type secureJSONDecryptionCache struct {
sync.Mutex
}
func ProvideService(bus bus.Bus, store *sqlstore.SQLStore, encryptionService encryption.Service) *Service {
func ProvideService(bus bus.Bus, store *sqlstore.SQLStore, secretsService secrets.Service) *Service {
s := &Service{
Bus: bus,
SQLStore: store,
EncryptionService: encryptionService,
logger: log.New("pluginsettings"),
Bus: bus,
SQLStore: store,
SecretsService: secretsService,
logger: log.New("pluginsettings"),
pluginSettingDecryptionCache: secureJSONDecryptionCache{
cache: make(map[int64]cachedDecryptedJSON),
},
@@ -56,7 +55,7 @@ func (s *Service) GetPluginSettingById(ctx context.Context, query *models.GetPlu
func (s *Service) UpdatePluginSetting(ctx context.Context, cmd *models.UpdatePluginSettingCmd) error {
var err error
cmd.EncryptedSecureJsonData, err = s.EncryptionService.EncryptJsonData(ctx, cmd.SecureJsonData, setting.SecretKey)
cmd.EncryptedSecureJsonData, err = s.SecretsService.EncryptJsonData(ctx, cmd.SecureJsonData, secrets.WithoutScope())
if err != nil {
return err
}
@@ -76,7 +75,7 @@ func (s *Service) DecryptedValues(ps *models.PluginSetting) map[string]string {
return item.json
}
json, err := s.EncryptionService.DecryptJsonData(context.Background(), ps.SecureJsonData, setting.SecretKey)
json, err := s.SecretsService.DecryptJsonData(context.Background(), ps.SecureJsonData)
if err != nil {
s.logger.Error("Failed to decrypt secure json data", "error", err)
return map[string]string{}
pkg/services/pluginsettings/service_test.go
+16 -14
View File
@@ -7,8 +7,10 @@ import (
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/encryption/ossencryption"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/services/secrets"
"github.com/grafana/grafana/pkg/services/secrets/fakes"
secretsManager "github.com/grafana/grafana/pkg/services/secrets/manager"
"github.com/stretchr/testify/require"
)
@@ -16,14 +18,14 @@ func TestService_DecryptedValuesCache(t *testing.T) {
t.Run("When plugin settings hasn't been updated, encrypted JSON should be fetched from cache", func(t *testing.T) {
ctx := context.Background()
encryptionService := ossencryption.ProvideService()
psService := ProvideService(bus.New(), nil, encryptionService)
secretsService := secretsManager.SetupTestService(t, fakes.NewFakeSecretsStore())
psService := ProvideService(bus.New(), nil, secretsService)
encryptedJsonData, err := encryptionService.EncryptJsonData(
encryptedJsonData, err := secretsService.EncryptJsonData(
ctx,
map[string]string{
"password": "password",
}, setting.SecretKey)
}, secrets.WithoutScope())
require.NoError(t, err)
ps := models.PluginSetting{
@@ -37,11 +39,11 @@ func TestService_DecryptedValuesCache(t *testing.T) {
require.Equal(t, "password", password)
require.True(t, ok)
encryptedJsonData, err = encryptionService.EncryptJsonData(
encryptedJsonData, err = secretsService.EncryptJsonData(
ctx,
map[string]string{
"password": "",
}, setting.SecretKey)
}, secrets.WithoutScope())
require.NoError(t, err)
ps.SecureJsonData = encryptedJsonData
@@ -54,14 +56,14 @@ func TestService_DecryptedValuesCache(t *testing.T) {
t.Run("When plugin settings is updated, encrypted JSON should not be fetched from cache", func(t *testing.T) {
ctx := context.Background()
encryptionService := ossencryption.ProvideService()
psService := ProvideService(bus.New(), nil, encryptionService)
secretsService := secretsManager.SetupTestService(t, fakes.NewFakeSecretsStore())
psService := ProvideService(bus.New(), nil, secretsService)
encryptedJsonData, err := encryptionService.EncryptJsonData(
encryptedJsonData, err := secretsService.EncryptJsonData(
ctx,
map[string]string{
"password": "password",
}, setting.SecretKey)
}, secrets.WithoutScope())
require.NoError(t, err)
ps := models.PluginSetting{
@@ -75,11 +77,11 @@ func TestService_DecryptedValuesCache(t *testing.T) {
require.Equal(t, "password", password)
require.True(t, ok)
encryptedJsonData, err = encryptionService.EncryptJsonData(
encryptedJsonData, err = secretsService.EncryptJsonData(
ctx,
map[string]string{
"password": "",
}, setting.SecretKey)
}, secrets.WithoutScope())
require.NoError(t, err)
ps.SecureJsonData = encryptedJsonData