Skip to content

Commit 4564399

Browse files
kartik-579kartik-579
authored
Merge pull request #344 from devtron-labs/pwd-db-encryption
feat: encryption for db credentials
2 parents fe0165e + da21d4b commit 4564399

169 files changed

Lines changed: 4579 additions & 4476 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎chart-sync/App.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package main
33
import (
44
"github.com/devtron-labs/chart-sync/internals"
55
"github.com/devtron-labs/chart-sync/pkg"
6+
"github.com/devtron-labs/common-lib/securestore"
67
"github.com/go-pg/pg"
78
"github.com/prometheus/client_golang/prometheus/promhttp"
89
"go.uber.org/zap"
@@ -22,12 +23,17 @@ func NewApp(Logger *zap.SugaredLogger,
2223
db *pg.DB,
2324
syncService pkg.SyncService,
2425
configuration *internals.Configuration) *App {
26+
err := securestore.SetEncryptionKey()
27+
if err != nil {
28+
Logger.Errorw("error in setting encryption key", "err", err)
29+
}
2530
return &App{
2631
Logger: Logger,
2732
db: db,
2833
syncService: syncService,
2934
configuration: configuration,
3035
}
36+
3137
}
3238

3339
func (app *App) Start() {

‎chart-sync/env_gen.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
[{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"chart-sync","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_STORE_APPLICATION_VERSIONS_SAVE_CHUNK_SIZE","EnvType":"int","EnvValue":"20","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_SYNC_SHUTDOWN_WAIT_DURATION","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CHART_PROVIDER_ID","EnvType":"string","EnvValue":"*","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"IS_OCI_REGISTRY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PARALLELISM_LIMIT_FOR_TAG_PROCESSING","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"password","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"user","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PROMETHEUS_MATRIX_PORT","EnvType":"int","EnvValue":"8080","EnvDescription":"","Example":"","Deprecated":"false"}]}]
1+
[{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"chart-sync","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_STORE_APPLICATION_VERSIONS_SAVE_CHUNK_SIZE","EnvType":"int","EnvValue":"20","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_SYNC_SHUTDOWN_WAIT_DURATION","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CHART_PROVIDER_ID","EnvType":"string","EnvValue":"*","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"IS_OCI_REGISTRY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PARALLELISM_LIMIT_FOR_TAG_PROCESSING","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"password","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"user","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PROMETHEUS_MATRIX_PORT","EnvType":"int","EnvValue":"8080","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"POSTGRES","Fields":[{"Env":"CASBIN_DATABASE","EnvType":"string","EnvValue":"casbin","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_READ_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_WRITE_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"}]}]

‎chart-sync/env_gen.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,11 @@
2222
| PG_USER | string |user | | | false |
2323
| PROMETHEUS_MATRIX_PORT | int |8080 | | | false |
2424

25+
26+
## POSTGRES Related Environment Variables
27+
| Key | Type | Default Value | Description | Example | Deprecated |
28+
|-------|----------|-------------------|-------------------|-----------------------|------------------|
29+
| CASBIN_DATABASE | string |casbin | | | false |
30+
| PG_READ_TIMEOUT | int64 |30 | | | false |
31+
| PG_WRITE_TIMEOUT | int64 |30 | | | false |
32+

‎chart-sync/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.24.0
44

55
toolchain go1.24.3
66

7-
replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3
7+
replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d
88

99
require (
1010
github.com/caarlos0/env v3.5.0+incompatible

‎chart-sync/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
4343
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4444
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
4545
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
46-
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3 h1:jCxpB8+6KD29jenB4SLTimCYzsmazBAPKv6637xRT5M=
47-
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
46+
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d h1:EAGZ+sei6Hl98Hp09HgNcnOIWgI43jcx1q0Mb6V5HdQ=
47+
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
4848
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
4949
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5050
github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=

‎chart-sync/internals/sql/DockerArtifactStoreRepository.go‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
package sql
1919

2020
import (
21+
"github.com/devtron-labs/common-lib/securestore"
2122
"github.com/go-pg/pg"
2223
"github.com/go-pg/pg/orm"
2324
)
@@ -41,23 +42,23 @@ type RegistryType string
4142
var OCI_REGISRTY_REPO_TYPE_LIST = []string{OCI_REGISRTY_REPO_TYPE_CONTAINER, OCI_REGISRTY_REPO_TYPE_CHART}
4243

4344
type DockerArtifactStore struct {
44-
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
45-
Id string `sql:"id,pk" json:"id,,omitempty"`
46-
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
47-
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
48-
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
49-
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
50-
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
51-
AWSSecretAccessKey string `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
52-
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
53-
Username string `sql:"username" json:"username,omitempty"`
54-
Password string `sql:"password" json:"password,omitempty"`
55-
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
56-
Connection string `sql:"connection" json:"connection,omitempty"`
57-
Cert string `sql:"cert" json:"cert,omitempty"`
58-
Active bool `sql:"active,notnull" json:"active"`
59-
RemoteConnectionConfigId int `sql:"remote_connection_config_id"`
60-
CredentialsType string `sql:"credentials_type,notnull"`
45+
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
46+
Id string `sql:"id,pk" json:"id,,omitempty"`
47+
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
48+
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
49+
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
50+
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
51+
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
52+
AWSSecretAccessKey securestore.EncryptedString `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
53+
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
54+
Username string `sql:"username" json:"username,omitempty"`
55+
Password securestore.EncryptedString `sql:"password" json:"password,omitempty"`
56+
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
57+
Connection string `sql:"connection" json:"connection,omitempty"`
58+
Cert string `sql:"cert" json:"cert,omitempty"`
59+
Active bool `sql:"active,notnull" json:"active"`
60+
RemoteConnectionConfigId int `sql:"remote_connection_config_id"`
61+
CredentialsType string `sql:"credentials_type,notnull"`
6162
OCIRegistryConfig []*OCIRegistryConfig
6263
RemoteConnectionConfig *RemoteConnectionConfig
6364
AuditLog

‎chart-sync/internals/sql/remoteConnectionConfigRepository.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
package sql
22

33
import (
4+
"github.com/devtron-labs/common-lib/securestore"
45
"github.com/go-pg/pg"
56
"go.uber.org/zap"
67
)
78

89
type RemoteConnectionConfig struct {
9-
tableName struct{} `sql:"remote_connection_config" pg:",discard_unknown_columns"`
10-
Id int `sql:"id,pk"`
11-
ConnectionMethod string `sql:"connection_method"`
12-
ProxyUrl string `sql:"proxy_url"`
13-
SSHServerAddress string `sql:"ssh_server_address"`
14-
SSHUsername string `sql:"ssh_username"`
15-
SSHPassword string `sql:"ssh_password"`
16-
SSHAuthKey string `sql:"ssh_auth_key"`
17-
Deleted bool `sql:"deleted,notnull"`
10+
tableName struct{} `sql:"remote_connection_config" pg:",discard_unknown_columns"`
11+
Id int `sql:"id,pk"`
12+
ConnectionMethod string `sql:"connection_method"`
13+
ProxyUrl string `sql:"proxy_url"`
14+
SSHServerAddress string `sql:"ssh_server_address"`
15+
SSHUsername string `sql:"ssh_username"`
16+
SSHPassword securestore.EncryptedString `sql:"ssh_password"`
17+
SSHAuthKey securestore.EncryptedString `sql:"ssh_auth_key"`
18+
Deleted bool `sql:"deleted,notnull"`
1819
AuditLog
1920
}
2021

‎chart-sync/pkg/registry/adapter.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ func NewToRegistryConfig(store *sql.DockerArtifactStore) (*registry.Configuratio
1919
remoteConnectionConfig.SSHTunnelConfig = &bean.SSHTunnelConfig{
2020
SSHServerAddress: store.RemoteConnectionConfig.SSHServerAddress,
2121
SSHUsername: store.RemoteConnectionConfig.SSHUsername,
22-
SSHPassword: store.RemoteConnectionConfig.SSHPassword,
23-
SSHAuthKey: store.RemoteConnectionConfig.SSHAuthKey,
22+
SSHPassword: store.RemoteConnectionConfig.SSHPassword.String(),
23+
SSHAuthKey: store.RemoteConnectionConfig.SSHAuthKey.String(),
2424
}
2525
}
2626
}
@@ -36,9 +36,9 @@ func NewToRegistryConfig(store *sql.DockerArtifactStore) (*registry.Configuratio
3636
RegistryId: store.Id,
3737
RegistryUrl: store.RegistryURL,
3838
Username: store.Username,
39-
Password: store.Password,
39+
Password: store.Password.String(),
4040
AwsAccessKey: store.AWSAccessKeyId,
41-
AwsSecretKey: store.AWSSecretAccessKey,
41+
AwsSecretKey: store.AWSSecretAccessKey.String(),
4242
AwsRegion: store.AWSRegion,
4343
RegistryConnectionType: store.Connection,
4444
RegistryCertificateString: store.Cert,

‎chart-sync/vendor/github.com/devtron-labs/common-lib/securestore/AttributesRepoDBConnection.go‎

Lines changed: 75 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎chart-sync/vendor/github.com/devtron-labs/common-lib/securestore/AttributesRepository.go‎

Lines changed: 111 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)