Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ROX-18428: implement KMS encryption and decryption #1178

Merged
merged 10 commits into from
Aug 3, 2023
Merged

ROX-18428: implement KMS encryption and decryption #1178

merged 10 commits into from
Aug 3, 2023

Conversation

johannes94
Copy link
Contributor

@johannes94 johannes94 commented Jul 28, 2023 •
edited
Loading

Description

Adding implementation and tests for En/Decryption of data using AWS KMS.

Change "RUN_AWS_RDS_TESTS" to a more generic test suite "RUN_AWS_INTEGRATION". Also changed the github action workflow so that it now executes both KMS and RDS Integration tests.

Checklist (Definition of Done)

  • Unit and integration tests added
  • Added test description under Test manual
  • Documentation added if necessary (i.e. changes to dev setup, test execution, ...)
  • CI and all relevant tests are passing
  • Add the ticket number to the PR title if available, i.e. ROX-12345: ...
  • Discussed security and business related topics privately. Will move any security and business related topics that arise to private communication channel.
  • [] Add secret to app-interface Vault or Secrets Manager if necessary
  • [ ] RDS changes were e2e tested manually
  • [ ] Check AWS limits are reasonable for changes provisioning new resources

Test manual

Integration tests are sufficient since this is not yet integrated into fleetshard-sync

# To run tests locally run:
make db/teardown db/setup db/migrate
make ocm/setup OCM_OFFLINE_TOKEN=<ocm-offline-token> OCM_ENV=development
make verify lint binary test test/integration

@johannes94 johannes94 requested review from ludydoo, vladbologa and a team July 28, 2023 07:33
@johannes94 johannes94 temporarily deployed to development July 28, 2023 07:33 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 28, 2023 07:33 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 08:30 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 08:30 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 14:18 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 14:51 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 14:51 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development July 31, 2023 14:51 — with GitHub Actions Inactive
@johannes94
Copy link
Contributor Author

/retest

@johannes94 johannes94 force-pushed the jmalsam/ROX-18428-kms-cipher branch from 9147719 to d25a2ce Compare August 1, 2023 08:18
@johannes94 johannes94 temporarily deployed to development August 1, 2023 08:18 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 1, 2023 08:18 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 1, 2023 08:18 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 1, 2023 20:44 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 1, 2023 20:44 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 1, 2023 20:44 — with GitHub Actions Inactive
kurlov
kurlov approved these changes Aug 2, 2023
View reviewed changes
Copy link
Member

@kurlov kurlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

Makefile
# Runs the AWS integration tests.
test/aws: $(GOTESTSUM_BIN)
RUN_AWS_INTEGRATION=true \
$(GOTESTSUM_BIN) --junitfile data/results/aws-integration-tests.xml --format $(GOTESTSUM_FORMAT) -- -p 1 -v -timeout 45m -count=1 \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need timeout here if it's specified in the actions job?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to also timeout for local executions of this tests.

@openshift-ci openshift-ci bot added the lgtm label Aug 2, 2023
kurlov
kurlov approved these changes Aug 2, 2023
View reviewed changes
Copy link
Member

@kurlov kurlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Aug 2, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johannes94, kurlov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot removed the lgtm label Aug 2, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Aug 2, 2023

New changes are detected. LGTM label has been removed.

@johannes94 johannes94 temporarily deployed to development August 2, 2023 18:57 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 2, 2023 18:57 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 2, 2023 18:57 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 2, 2023 19:10 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 2, 2023 19:10 — with GitHub Actions Inactive
@johannes94 johannes94 temporarily deployed to development August 2, 2023 19:10 — with GitHub Actions Inactive
@johannes94
Copy link
Contributor Author

/retest

@johannes94
Copy link
Contributor Author

johannes94 commented Aug 2, 2023 •
edited
Loading

@kurlov May I ask you to review once again the last 3 commits. I did some changes here, because I noticed that AWS KMS does not support encrypting secrets as large as our central-tls using the API. We have to generate a data key and use that instead.

@johannes94
Copy link
Contributor Author

/retest

kurlov
kurlov reviewed Aug 3, 2023
View reviewed changes
Copy link
Member

@kurlov kurlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good

@johannes94 johannes94 merged commit ae49d96 into main Aug 3, 2023
@johannes94 johannes94 deleted the jmalsam/ROX-18428-kms-cipher branch August 3, 2023 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kurlov kurlov kurlov approved these changes

@ludydoo ludydoo Awaiting requested review from ludydoo

@vladbologa vladbologa Awaiting requested review from vladbologa

Assignees

@kurlov kurlov

Labels
approved
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@johannes94 @kurlov