Encryption: Add support for multiple data keys per day (#47765)

* Add database migrations

* Use short uids as data key ids

* Add support for manual data key rotation

* Fix duplicated mutex unlocks

* Fix migration

* Manage current data keys per name

* Adjust key re-encryption and test

* Modify rename column migration for MySQL compatibility

* Refactor secrets manager and data keys cache

* Multiple o11y adjustments

* Fix stats query

* Apply suggestions from code review

Co-authored-by: Tania <yalyna.ts@gmail.com>

* Fix linter

* Docs: Rotate data encryption keys API endpoint

Co-authored-by: Tania <yalyna.ts@gmail.com>
This commit is contained in:
Joan López de la Franca Beltran
2022-05-23 13:13:55 +02:00
committed by GitHub
co-authored by Tania
parent ae8c11bfa4
commit e43879e55d
21 changed files with 498 additions and 170 deletions
@@ -1,6 +1,10 @@
package migrations
import "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
import (
"fmt"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
)
func addSecretsMigration(mg *migrator.Migrator) {
dataKeysV1 := migrator.Table{
@@ -38,4 +42,23 @@ func addSecretsMigration(mg *migrator.Migrator) {
}
mg.AddMigration("create secrets table", migrator.NewAddTableMigration(secretsV1))
mg.AddMigration("rename data_keys name column to id", migrator.NewRenameColumnMigration(
dataKeysV1, "name", "id",
))
mg.AddMigration("add name column into data_keys", migrator.NewAddColumnMigration(
dataKeysV1,
&migrator.Column{
Name: "name",
Type: migrator.DB_NVarchar,
Length: 100,
Default: "''",
Nullable: false,
},
))
mg.AddMigration("copy data_keys id column values into name", migrator.NewRawSQLMigration(
fmt.Sprintf("UPDATE %s SET %s = %s", dataKeysV1.Name, "name", "id"),
))
}