public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SecretsManager: Adding ability to disable all DEKs (#108444)

Browse Source 
* Adding dek deactivation and rename list dek

* disable data keys from manager

* separate interface and don't use in encryption manager
This commit is contained in:
Dana Axinte
2025-07-25 17:11:17 +01:00
committed by GitHub
parent f69f25be5d
commit b1b9cc43a8
11 changed files with 167 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/contracts/data_key.go
+6 -1
View File
@@ -29,7 +29,12 @@ type DataKeyStorage interface {
CreateDataKey(ctx context.Context, dataKey *SecretDataKey) error
GetDataKey(ctx context.Context, namespace, uid string) (*SecretDataKey, error)
GetCurrentDataKey(ctx context.Context, namespace, label string) (*SecretDataKey, error)
GetAllDataKeys(ctx context.Context, namespace string) ([]*SecretDataKey, error)
ListDataKeys(ctx context.Context, namespace string) ([]*SecretDataKey, error)
DisableDataKeys(ctx context.Context, namespace string) error
DeleteDataKey(ctx context.Context, namespace, uid string) error
}
// GlobalDataKeyStorage is an interface for namespace unbounded operations.
type GlobalDataKeyStorage interface {
DisableAllDataKeys(ctx context.Context) error
}
pkg/registry/apis/secret/encryption/manager/manager_test.go
+4 -4
View File
@@ -45,7 +45,7 @@ func TestEncryptionService_EnvelopeEncryption(t *testing.T) {
require.NoError(t, err)
assert.Equal(t, plaintext, decrypted)
keys, err := svc.store.GetAllDataKeys(ctx, namespace)
keys, err := svc.store.ListDataKeys(ctx, namespace)
require.NoError(t, err)
assert.Equal(t, len(keys), 1)
})
@@ -60,7 +60,7 @@ func TestEncryptionService_EnvelopeEncryption(t *testing.T) {
require.NoError(t, err)
assert.Equal(t, plaintext, decrypted)
keys, err := svc.store.GetAllDataKeys(ctx, namespace)
keys, err := svc.store.ListDataKeys(ctx, namespace)
require.NoError(t, err)
assert.Equal(t, len(keys), 1)
})
@@ -139,12 +139,12 @@ func TestEncryptionService_DataKeys(t *testing.T) {
})
t.Run("deleting DEK when no id provided must fail", func(t *testing.T) {
beforeDelete, err := store.GetAllDataKeys(ctx, namespace)
beforeDelete, err := store.ListDataKeys(ctx, namespace)
require.NoError(t, err)
err = store.DeleteDataKey(ctx, namespace, "")
require.Error(t, err)
afterDelete, err := store.GetAllDataKeys(ctx, namespace)
afterDelete, err := store.ListDataKeys(ctx, namespace)
require.NoError(t, err)
assert.Equal(t, beforeDelete, afterDelete)
})