storage: add config option for enabling encryption-at-rest

[andyyang890]

This patch adds the ability to configure encryption-at-rest for
in-memory engines, which are used in tests.

Release note: None

[cockroach-teamcity]

This change is 

[jbowens]

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @andyyang890)

---

pkg/storage/open.go, line 112 at r1 (raw file):

// registry. It is used to configure encryption-at-rest for in-memory engines,
// which are used in tests.
func UseFileRegistry(useRegistry bool) ConfigOption {

Can we consolidate these into a single EncryptionAtRest(encryptionOptions []byte) option that turns on UseFileRegistry and sets EncryptionOptions?

---

pkg/storage/open.go, line 125 at r1 (raw file):

	return func(cfg *engineConfig) error {
		cfg.EncryptionOptions = make([]byte, len(b))
		copy(cfg.EncryptionOptions, b)

Does cfg.EncryptionOptions get mutated? Is the copy necessary? IF so, can you document where/why?

[andyyang890]

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @andyyang890 and @jbowens)

---

pkg/storage/open.go, line 125 at r1 (raw file):

Previously, jbowens (Jackson Owens) wrote…

Does cfg.EncryptionOptions get mutated? Is the copy necessary? IF so, can you document where/why?

I was thinking it would be safer to make a copy in case the caller modifies the slice afterwards. Is that not necessary here?

[andyyang890]

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @jbowens)

---

pkg/storage/open.go, line 112 at r1 (raw file):

Previously, jbowens (Jackson Owens) wrote…

Can we consolidate these into a single EncryptionAtRest(encryptionOptions []byte) option that turns on UseFileRegistry and sets EncryptionOptions?

Done.

[jbowens]

Reviewed 3 of 3 files at r2.
Reviewable status: complete! 1 of 0 LGTMs obtained (waiting on @andyyang890 and @jbowens)

---

pkg/storage/open.go, line 125 at r1 (raw file):

Previously, andyyang890 (Andy Yang) wrote…

I was thinking it would be safer to make a copy in case the caller modifies the slice afterwards. Is that not necessary here?

I suspect no callers modify the slice, but this is fine if we're unsure.

[andyyang890]

bors r=jbowens

[craig]

Build succeeded:

• GitHub CI (Cockroach)