Skip to content

Commit 76c7b10

Browse files
Ash-expAsh-exp
authored
Merge pull request #364 from devtron-labs/fix/secret-encryption-support
fix: implement secure storage for sensitive data with encryption and repository management
2 parents 385fc6b + fad5bf5 commit 76c7b10

15 files changed

Lines changed: 801 additions & 19 deletions

File tree

‎kubewatch/env_gen.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
[{"Category":"ARGOCD_INFORMER","Fields":[{"Env":"ACD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether ArgoCD informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"ACD_NAMESPACE","EnvType":"string","EnvValue":"devtroncd","EnvDescription":"Namespace where all the ArgoCD application objects are published. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CD_ARGO_WORKFLOW","Fields":[{"Env":"CD_DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-cd","EnvDescription":"Namespace where all CD workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"},{"Env":"CD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CD informer is enabled or not","Example":"","Deprecated":"false"}]},{"Category":"CI_ARGO_WORKFLOW","Fields":[{"Env":"CI_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CI informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-ci","EnvDescription":"Namespace where all CI workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CLUSTER_MODE","Fields":[{"Env":"CLUSTER_ARGO_CD_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for ArgoCD informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CD_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CD ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CI_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CI ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for System Executor informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"}]},{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"kubewatch","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CONSUMER_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"DEFAULT_LOG_TIME_LIMIT","EnvType":"int64","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"ENABLE_STATSVIZ","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_CLIENT_MAX_IDLE_CONNS_PER_HOST","EnvType":"int","EnvValue":"25","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_IDLE_CONN_TIMEOUT","EnvType":"int","EnvValue":"300","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_KEEPALIVE","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_TIMEOUT","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TLS_HANDSHAKE_TIMEOUT","EnvType":"int","EnvValue":"10","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_ACK_WAIT_IN_SECS","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_BUFFER_SIZE","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_MAX_AGE","EnvType":"int","EnvValue":"86400","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_PROCESSING_BATCH_SIZE","EnvType":"int","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_REPLICAS","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_SERVER_HOST","EnvType":"string","EnvValue":"nats://devtron-nats.devtroncd:4222","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"RUNTIME_CONFIG_LOCAL_DEV","EnvType":"LocalDevMode","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"STREAM_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"USE_CUSTOM_HTTP_TRANSPORT","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"EXTERNAL_KUBEWATCH","Fields":[{"Env":"CD_EXTERNAL_LISTENER_URL","EnvType":"string","EnvValue":"http://devtroncd-orchestrator-service-prod.devtroncd:80","EnvDescription":"URL of the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_NAMESPACE","EnvType":"string","EnvValue":"","EnvDescription":"Namespace where the external kubewatch is set up","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_ORCHESTRATOR_TOKEN","EnvType":"string","EnvValue":"","EnvDescription":"Token used to authenticate with the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_REST_LISTENER","EnvType":"bool","EnvValue":"false","EnvDescription":"Used to determine whether it's an external kubewatch or internal kubewatch","Example":"","Deprecated":"false"}]},{"Category":"GRACEFUL_SHUTDOWN","Fields":[{"Env":"SLEEP_TIMEOUT","EnvType":"int","EnvValue":"5","EnvDescription":"Graceful shutdown timeout in seconds","Example":"","Deprecated":"false"}]}]
1+
[{"Category":"ARGOCD_INFORMER","Fields":[{"Env":"ACD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether ArgoCD informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"ACD_NAMESPACE","EnvType":"string","EnvValue":"devtroncd","EnvDescription":"Namespace where all the ArgoCD application objects are published. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CD_ARGO_WORKFLOW","Fields":[{"Env":"CD_DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-cd","EnvDescription":"Namespace where all CD workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"},{"Env":"CD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CD informer is enabled or not","Example":"","Deprecated":"false"}]},{"Category":"CI_ARGO_WORKFLOW","Fields":[{"Env":"CI_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CI informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-ci","EnvDescription":"Namespace where all CI workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CLUSTER_MODE","Fields":[{"Env":"CLUSTER_ARGO_CD_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for ArgoCD informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CD_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CD ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CI_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CI ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for System Executor informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"}]},{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"kubewatch","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CONSUMER_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"DEFAULT_LOG_TIME_LIMIT","EnvType":"int64","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"ENABLE_STATSVIZ","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_CLIENT_MAX_IDLE_CONNS_PER_HOST","EnvType":"int","EnvValue":"25","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_IDLE_CONN_TIMEOUT","EnvType":"int","EnvValue":"300","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_KEEPALIVE","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_TIMEOUT","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TLS_HANDSHAKE_TIMEOUT","EnvType":"int","EnvValue":"10","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_ACK_WAIT_IN_SECS","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_BUFFER_SIZE","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_MAX_AGE","EnvType":"int","EnvValue":"86400","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_PROCESSING_BATCH_SIZE","EnvType":"int","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_REPLICAS","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_SERVER_HOST","EnvType":"string","EnvValue":"nats://devtron-nats.devtroncd:4222","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"RUNTIME_CONFIG_LOCAL_DEV","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"STREAM_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"USE_CUSTOM_HTTP_TRANSPORT","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"EXTERNAL_KUBEWATCH","Fields":[{"Env":"CD_EXTERNAL_LISTENER_URL","EnvType":"string","EnvValue":"http://devtroncd-orchestrator-service-prod.devtroncd:80","EnvDescription":"URL of the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_NAMESPACE","EnvType":"string","EnvValue":"","EnvDescription":"Namespace where the external kubewatch is set up","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_ORCHESTRATOR_TOKEN","EnvType":"string","EnvValue":"","EnvDescription":"Token used to authenticate with the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_REST_LISTENER","EnvType":"bool","EnvValue":"false","EnvDescription":"Used to determine whether it's an external kubewatch or internal kubewatch","Example":"","Deprecated":"false"}]},{"Category":"GRACEFUL_SHUTDOWN","Fields":[{"Env":"SLEEP_TIMEOUT","EnvType":"int","EnvValue":"5","EnvDescription":"Graceful shutdown timeout in seconds","Example":"","Deprecated":"false"}]},{"Category":"POSTGRES","Fields":[{"Env":"CASBIN_DATABASE","EnvType":"string","EnvValue":"casbin","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_READ_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_WRITE_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"}]}]

‎kubewatch/env_gen.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
| PG_PORT | string |5432 | | | false |
6060
| PG_QUERY_DUR_THRESHOLD | int64 |5000 | | | false |
6161
| PG_USER | string | | | | false |
62-
| RUNTIME_CONFIG_LOCAL_DEV | LocalDevMode |false | | | false |
62+
| RUNTIME_CONFIG_LOCAL_DEV | bool |false | | | false |
6363
| STREAM_CONFIG_JSON | string | | | | false |
6464
| USE_CUSTOM_HTTP_TRANSPORT | bool |false | | | false |
6565

@@ -78,3 +78,11 @@
7878
|-------|----------|-------------------|-------------------|-----------------------|------------------|
7979
| SLEEP_TIMEOUT | int |5 | Graceful shutdown timeout in seconds | | false |
8080

81+
82+
## POSTGRES Related Environment Variables
83+
| Key | Type | Default Value | Description | Example | Deprecated |
84+
|-------|----------|-------------------|-------------------|-----------------------|------------------|
85+
| CASBIN_DATABASE | string |casbin | | | false |
86+
| PG_READ_TIMEOUT | int64 |30 | | | false |
87+
| PG_WRITE_TIMEOUT | int64 |30 | | | false |
88+

‎kubewatch/main.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package main
1818

1919
import (
20+
"github.com/devtron-labs/common-lib/securestore"
2021
"log"
2122
"os"
2223
"os/signal"
@@ -25,6 +26,10 @@ import (
2526
)
2627

2728
func main() {
29+
err := securestore.SetEncryptionKey()
30+
if err != nil {
31+
log.Println("error in setting encryption key", "err", err)
32+
}
2833
app, err := InitializeApp()
2934
if err != nil {
3035
log.Panic(err)

‎kubewatch/pkg/cluster/ClusterRepository.go‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package repository
1818

1919
import (
20+
"github.com/devtron-labs/common-lib/securestore"
2021
"github.com/devtron-labs/common-lib/utils/k8s/commonBean"
2122
"github.com/devtron-labs/kubewatch/pkg/sql"
2223
"github.com/go-pg/pg"
@@ -25,23 +26,23 @@ import (
2526
)
2627

2728
type Cluster struct {
28-
tableName struct{} `sql:"cluster" pg:",discard_unknown_columns"`
29-
Id int `sql:"id,pk"`
30-
ClusterName string `sql:"cluster_name"`
31-
ServerUrl string `sql:"server_url"`
32-
PrometheusEndpoint string `sql:"prometheus_endpoint"`
33-
Active bool `sql:"active,notnull"`
34-
CdArgoSetup bool `sql:"cd_argo_setup,notnull"`
35-
Config map[string]string `sql:"config"`
36-
PUserName string `sql:"p_username"`
37-
PPassword string `sql:"p_password"`
38-
PTlsClientCert string `sql:"p_tls_client_cert"`
39-
PTlsClientKey string `sql:"p_tls_client_key"`
40-
AgentInstallationStage int `sql:"agent_installation_stage"`
41-
K8sVersion string `sql:"k8s_version"`
42-
ErrorInConnecting string `sql:"error_in_connecting"`
43-
InsecureSkipTlsVerify bool `sql:"insecure_skip_tls_verify"`
44-
IsVirtualCluster bool `sql:"is_virtual_cluster"`
29+
tableName struct{} `sql:"cluster" pg:",discard_unknown_columns"`
30+
Id int `sql:"id,pk"`
31+
ClusterName string `sql:"cluster_name"`
32+
ServerUrl string `sql:"server_url"`
33+
PrometheusEndpoint string `sql:"prometheus_endpoint"`
34+
Active bool `sql:"active,notnull"`
35+
CdArgoSetup bool `sql:"cd_argo_setup,notnull"`
36+
Config securestore.EncryptedMap `sql:"config"`
37+
PUserName string `sql:"p_username"`
38+
PPassword string `sql:"p_password"`
39+
PTlsClientCert string `sql:"p_tls_client_cert"`
40+
PTlsClientKey string `sql:"p_tls_client_key"`
41+
AgentInstallationStage int `sql:"agent_installation_stage"`
42+
K8sVersion string `sql:"k8s_version"`
43+
ErrorInConnecting string `sql:"error_in_connecting"`
44+
InsecureSkipTlsVerify bool `sql:"insecure_skip_tls_verify"`
45+
IsVirtualCluster bool `sql:"is_virtual_cluster"`
4546
sql.AuditLog
4647
}
4748

0 commit comments

Comments
 (0)