public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

admin api: Fix reencryption of private_key in signing_key table, introduce test for reencryption (#105010)

Browse Source 
* Add integration test for reencrypting secrets.
Rotate keys before reencryption.
Test for setting table from enterprise repo.
This commit is contained in:
Peter Štibraný
2025-05-15 09:51:25 +02:00
committed by GitHub
parent 3b1008b7c9
commit 7268d6c1bc
9 changed files with 486 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/secrets/migrator/rollback.go
+30 -28
View File
@@ -19,7 +19,7 @@ func (s simpleSecret) Rollback(
encryptionSrv encryption.Internal,
sqlStore db.DB,
secretKey string,
) (anyFailure bool) {
) bool {
var rows []struct {
Id int
Secret []byte
@@ -28,10 +28,11 @@ func (s simpleSecret) Rollback(
if err := sqlStore.WithDbSession(ctx, func(sess *db.Session) error {
return sess.Table(s.tableName).Select(fmt.Sprintf("id, %s as secret", s.columnName)).Find(&rows)
}); err != nil {
logger.Warn("Could not find any secret to roll back", "table", s.tableName)
return true
logger.Warn("Could not find any secret to roll back", "table", s.tableName, "error", err)
return false
}
anyFailure := false
for _, row := range rows {
if len(row.Secret) == 0 {
continue
@@ -70,7 +71,7 @@ func (s simpleSecret) Rollback(
logger.Info(fmt.Sprintf("Column %s from %s has been rolled back successfully", s.columnName, s.tableName))
}
return anyFailure
return !anyFailure
}
func (s b64Secret) Rollback(
@@ -79,7 +80,7 @@ func (s b64Secret) Rollback(
encryptionSrv encryption.Internal,
sqlStore db.DB,
secretKey string,
) (anyFailure bool) {
) bool {
var rows []struct {
Id int
Secret string
@@ -89,9 +90,10 @@ func (s b64Secret) Rollback(
return sess.Table(s.tableName).Select(fmt.Sprintf("id, %s as secret", s.columnName)).Find(&rows)
}); err != nil {
logger.Warn("Could not find any secret to roll back", "table", s.tableName)
return true
return false
}
anyFailure := false
for _, row := range rows {
if len(row.Secret) == 0 {
continue
@@ -144,7 +146,7 @@ func (s b64Secret) Rollback(
logger.Info(fmt.Sprintf("Column %s from %s has been rolled back successfully", s.columnName, s.tableName))
}
return anyFailure
return !anyFailure
}
func (s jsonSecret) Rollback(
@@ -153,7 +155,7 @@ func (s jsonSecret) Rollback(
encryptionSrv encryption.Internal,
sqlStore db.DB,
secretKey string,
) (anyFailure bool) {
) bool {
var rows []struct {
Id int
SecureJsonData map[string][]byte
@@ -162,10 +164,11 @@ func (s jsonSecret) Rollback(
if err := sqlStore.WithDbSession(ctx, func(sess *db.Session) error {
return sess.Table(s.tableName).Cols("id", "secure_json_data").Find(&rows)
}); err != nil {
logger.Warn("Could not find any secret to roll back", "table", s.tableName)
return true
logger.Warn("Could not find any secret to roll back", "table", s.tableName, "error", err)
return false
}
anyFailure := false
for _, row := range rows {
if len(row.SecureJsonData) == 0 {
continue
@@ -208,7 +211,7 @@ func (s jsonSecret) Rollback(
logger.Info(fmt.Sprintf("Secure json data secrets from %s have been rolled back successfully", s.tableName))
}
return anyFailure
return !anyFailure
}
func (s alertingSecret) Rollback(
@@ -217,7 +220,7 @@ func (s alertingSecret) Rollback(
encryptionSrv encryption.Internal,
sqlStore db.DB,
secretKey string,
) (anyFailure bool) {
) bool {
var results []struct {
Id int
AlertmanagerConfiguration string
@@ -227,17 +230,16 @@ func (s alertingSecret) Rollback(
if err := sqlStore.WithDbSession(ctx, func(sess *db.Session) error {
return sess.SQL(selectSQL).Find(&results)
}); err != nil {
logger.Warn("Could not find any alert_configuration secret to roll back")
return true
logger.Warn("Could not find any alert_configuration secret to roll back", "error", err)
return false
}
anyFailure := false
for _, result := range results {
result := result
err := sqlStore.WithTransactionalDbSession(ctx, func(sess *db.Session) error {
postableUserConfig, err := notifier.Load([]byte(result.AlertmanagerConfiguration))
if err != nil {
logger.Warn("Could not load configuration (alert_configuration with id: %d) while rolling it back", result.Id, err)
logger.Warn("Could not load configuration while rolling it back", "id", result.Id, "error", err)
return err
}
@@ -246,19 +248,19 @@ func (s alertingSecret) Rollback(
for k, v := range gmr.SecureSettings {
decoded, err := base64.StdEncoding.DecodeString(v)
if err != nil {
logger.Warn("Could not decode base64-encoded secret (alert_configuration with id: %d, key)", k, result.Id, err)
logger.Warn("Could not decode base64-encoded secret", "id", result.Id, "key", k, "error", err)
return err
}
decrypted, err := secretsSrv.Decrypt(ctx, decoded)
if err != nil {
logger.Warn("Could not decrypt secret (alert_configuration with id: %d, key)", k, result.Id, err)
logger.Warn("Could not decrypt secret", "id", result.Id, "key", k, "error", err)
return err
}
reencrypted, err := encryptionSrv.Encrypt(ctx, decrypted, secretKey)
if err != nil {
logger.Warn("Could not re-encrypt secret (alert_configuration with id: %d, key)", k, result.Id, err)
logger.Warn("Could not re-encrypt secret", "id", result.Id, "key", k, "error", err)
return err
}
@@ -269,13 +271,13 @@ func (s alertingSecret) Rollback(
marshalled, err := json.Marshal(postableUserConfig)
if err != nil {
logger.Warn("Could not marshal configuration (alert_configuration with id: %d) while rolling it back", result.Id, err)
logger.Warn("Could not marshal configuration while rolling it back", "id", result.Id, "error", err)
return err
}
result.AlertmanagerConfiguration = string(marshalled)
if _, err := sess.Table("alert_configuration").Where("id = ?", result.Id).Update(&result); err != nil {
logger.Warn("Could not update secret (alert_configuration with id: %d) while rolling it back", result.Id, err)
logger.Warn("Could not update secret while rolling it back", "id", result.Id, "error", err)
return err
}
@@ -293,7 +295,7 @@ func (s alertingSecret) Rollback(
logger.Info("Alerting configuration secrets have been rolled back successfully")
}
return anyFailure
return !anyFailure
}
func (s ssoSettingsSecret) Rollback(
@@ -302,18 +304,18 @@ func (s ssoSettingsSecret) Rollback(
encryptionSrv encryption.Internal,
sqlStore db.DB,
secretKey string,
) (anyFailure bool) {
) bool {
results := make([]*models.SSOSettings, 0)
err := sqlStore.WithDbSession(ctx, func(sess *db.Session) error {
return sess.Find(&results)
})
if err != nil {
logger.Warn("Failed to fetch SSO settings to roll back")
return true
logger.Warn("Failed to fetch SSO settings to roll back", "error", err)
return false
}
anyFailure := false
for _, result := range results {
err := sqlStore.WithTransactionalDbSession(ctx, func(sess *db.Session) error {
result.Settings, err = s.reEncryptSecretsInMap(ctx, result.Settings, secretsSrv, encryptionSrv, secretKey)
@@ -345,5 +347,5 @@ func (s ssoSettingsSecret) Rollback(
logger.Info("SSO settings secrets have been rolled back successfully")
}
return anyFailure
return !anyFailure
}