Skip to content

feat: encryption for db credentials #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kartik-579 merged 27 commits into from
Oct 13, 2025
Merged

feat: encryption for db credentials #344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
73b31a5
secure store common lib
kartik-579 Oct 7, 2025
f7425ae
Merge branch 'main' into pwd-db-encryption
kartik-579 Oct 7, 2025
699d83a
git sensor encryption
kartik-579 Oct 7, 2025
0fac967
Merge branch 'pwd-db-encryption' of github.com:devtron-labs/devtron-s…
kartik-579 Oct 7, 2025
a2f2daa
image scanner encryption
kartik-579 Oct 7, 2025
22665e1
chart sync encrypt
kartik-579 Oct 7, 2025
fe4e897
empty string encryption remove
kartik-579 Oct 7, 2025
29c145e
kubelink encryption
kartik-579 Oct 7, 2025
e07187c
updated encryption impors
kartik-579 Oct 7, 2025
28668ab
wip
kartik-579 Oct 7, 2025
fee1a36
wip
kartik-579 Oct 7, 2025
2e7d061
wip
kartik-579 Oct 7, 2025
1943937
wip
kartik-579 Oct 7, 2025
87d0269
vendor files
kartik-579 Oct 7, 2025
721b776
vendor files
kartik-579 Oct 7, 2025
f85db36
wip
kartik-579 Oct 9, 2025
8e01936
wip
kartik-579 Oct 9, 2025
7ab6a5a
added decode for encryption key
kartik-579 Oct 9, 2025
3a7f7db
updated import
kartik-579 Oct 9, 2025
6e0447e
wip
kartik-579 Oct 13, 2025
ba1448b
updated all services
kartik-579 Oct 13, 2025
3336b9c
added vendor files
kartik-579 Oct 13, 2025
3418fc3
added vendor files
kartik-579 Oct 13, 2025
f53e2f3
updated makefile
kartik-579 Oct 13, 2025
9d1c517
wip
kartik-579 Oct 13, 2025
5efe8cc
updated oss
kartik-579 Oct 13, 2025
da21d4b
Merge branch 'main' into pwd-db-encryption
kartik-579 Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions chart-sync/App.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package main
import (
"github.com/devtron-labs/chart-sync/internals"
"github.com/devtron-labs/chart-sync/pkg"
"github.com/devtron-labs/common-lib/securestore"
"github.com/go-pg/pg"
"github.com/prometheus/client_golang/prometheus/promhttp"
"go.uber.org/zap"
Expand All @@ -22,12 +23,17 @@ func NewApp(Logger *zap.SugaredLogger,
db *pg.DB,
syncService pkg.SyncService,
configuration *internals.Configuration) *App {
err := securestore.SetEncryptionKey()
if err != nil {
Logger.Errorw("error in setting encryption key", "err", err)
}
return &App{
Logger: Logger,
db: db,
syncService: syncService,
configuration: configuration,
}

}

func (app *App) Start() {
Expand Down
2 changes: 1 addition & 1 deletion chart-sync/env_gen.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
[{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"chart-sync","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_STORE_APPLICATION_VERSIONS_SAVE_CHUNK_SIZE","EnvType":"int","EnvValue":"20","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_SYNC_SHUTDOWN_WAIT_DURATION","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CHART_PROVIDER_ID","EnvType":"string","EnvValue":"*","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"IS_OCI_REGISTRY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PARALLELISM_LIMIT_FOR_TAG_PROCESSING","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"password","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"user","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PROMETHEUS_MATRIX_PORT","EnvType":"int","EnvValue":"8080","EnvDescription":"","Example":"","Deprecated":"false"}]}]
[{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"chart-sync","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_STORE_APPLICATION_VERSIONS_SAVE_CHUNK_SIZE","EnvType":"int","EnvValue":"20","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"APP_SYNC_SHUTDOWN_WAIT_DURATION","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CHART_PROVIDER_ID","EnvType":"string","EnvValue":"*","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"IS_OCI_REGISTRY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PARALLELISM_LIMIT_FOR_TAG_PROCESSING","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"password","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"user","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PROMETHEUS_MATRIX_PORT","EnvType":"int","EnvValue":"8080","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"POSTGRES","Fields":[{"Env":"CASBIN_DATABASE","EnvType":"string","EnvValue":"casbin","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_READ_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_WRITE_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"}]}]
8 changes: 8 additions & 0 deletions chart-sync/env_gen.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,3 +22,11 @@
| PG_USER | string |user | | | false |
| PROMETHEUS_MATRIX_PORT | int |8080 | | | false |


## POSTGRES Related Environment Variables
| Key | Type | Default Value | Description | Example | Deprecated |
|-------|----------|-------------------|-------------------|-----------------------|------------------|
| CASBIN_DATABASE | string |casbin | | | false |
| PG_READ_TIMEOUT | int64 |30 | | | false |
| PG_WRITE_TIMEOUT | int64 |30 | | | false |

2 changes: 1 addition & 1 deletion chart-sync/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.24.0

toolchain go1.24.3

replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3
replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d

require (
github.com/caarlos0/env v3.5.0+incompatible
Expand Down
4 changes: 2 additions & 2 deletions chart-sync/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3 h1:jCxpB8+6KD29jenB4SLTimCYzsmazBAPKv6637xRT5M=
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250901093002-1be330be4db3/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d h1:EAGZ+sei6Hl98Hp09HgNcnOIWgI43jcx1q0Mb6V5HdQ=
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013041509-9d1c5175da2d/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
Expand Down
35 changes: 18 additions & 17 deletions chart-sync/internals/sql/DockerArtifactStoreRepository.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
package sql

import (
"github.com/devtron-labs/common-lib/securestore"
"github.com/go-pg/pg"
"github.com/go-pg/pg/orm"
)
Expand All @@ -41,23 +42,23 @@ type RegistryType string
var OCI_REGISRTY_REPO_TYPE_LIST = []string{OCI_REGISRTY_REPO_TYPE_CONTAINER, OCI_REGISRTY_REPO_TYPE_CHART}

type DockerArtifactStore struct {
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
Id string `sql:"id,pk" json:"id,,omitempty"`
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
AWSSecretAccessKey string `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
Username string `sql:"username" json:"username,omitempty"`
Password string `sql:"password" json:"password,omitempty"`
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
Connection string `sql:"connection" json:"connection,omitempty"`
Cert string `sql:"cert" json:"cert,omitempty"`
Active bool `sql:"active,notnull" json:"active"`
RemoteConnectionConfigId int `sql:"remote_connection_config_id"`
CredentialsType string `sql:"credentials_type,notnull"`
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
Id string `sql:"id,pk" json:"id,,omitempty"`
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
AWSSecretAccessKey securestore.EncryptedString `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
Username string `sql:"username" json:"username,omitempty"`
Password securestore.EncryptedString `sql:"password" json:"password,omitempty"`
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
Connection string `sql:"connection" json:"connection,omitempty"`
Cert string `sql:"cert" json:"cert,omitempty"`
Active bool `sql:"active,notnull" json:"active"`
RemoteConnectionConfigId int `sql:"remote_connection_config_id"`
CredentialsType string `sql:"credentials_type,notnull"`
OCIRegistryConfig []*OCIRegistryConfig
RemoteConnectionConfig *RemoteConnectionConfig
AuditLog
Expand Down
19 changes: 10 additions & 9 deletions chart-sync/internals/sql/remoteConnectionConfigRepository.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,21 @@
package sql

import (
"github.com/devtron-labs/common-lib/securestore"
"github.com/go-pg/pg"
"go.uber.org/zap"
)

type RemoteConnectionConfig struct {
tableName struct{} `sql:"remote_connection_config" pg:",discard_unknown_columns"`
Id int `sql:"id,pk"`
ConnectionMethod string `sql:"connection_method"`
ProxyUrl string `sql:"proxy_url"`
SSHServerAddress string `sql:"ssh_server_address"`
SSHUsername string `sql:"ssh_username"`
SSHPassword string `sql:"ssh_password"`
SSHAuthKey string `sql:"ssh_auth_key"`
Deleted bool `sql:"deleted,notnull"`
tableName struct{} `sql:"remote_connection_config" pg:",discard_unknown_columns"`
Id int `sql:"id,pk"`
ConnectionMethod string `sql:"connection_method"`
ProxyUrl string `sql:"proxy_url"`
SSHServerAddress string `sql:"ssh_server_address"`
SSHUsername string `sql:"ssh_username"`
SSHPassword securestore.EncryptedString `sql:"ssh_password"`
SSHAuthKey securestore.EncryptedString `sql:"ssh_auth_key"`
Deleted bool `sql:"deleted,notnull"`
AuditLog
}

Expand Down
8 changes: 4 additions & 4 deletions chart-sync/pkg/registry/adapter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ func NewToRegistryConfig(store *sql.DockerArtifactStore) (*registry.Configuratio
remoteConnectionConfig.SSHTunnelConfig = &bean.SSHTunnelConfig{
SSHServerAddress: store.RemoteConnectionConfig.SSHServerAddress,
SSHUsername: store.RemoteConnectionConfig.SSHUsername,
SSHPassword: store.RemoteConnectionConfig.SSHPassword,
SSHAuthKey: store.RemoteConnectionConfig.SSHAuthKey,
SSHPassword: store.RemoteConnectionConfig.SSHPassword.String(),
SSHAuthKey: store.RemoteConnectionConfig.SSHAuthKey.String(),
}
}
}
Expand All @@ -36,9 +36,9 @@ func NewToRegistryConfig(store *sql.DockerArtifactStore) (*registry.Configuratio
RegistryId: store.Id,
RegistryUrl: store.RegistryURL,
Username: store.Username,
Password: store.Password,
Password: store.Password.String(),
AwsAccessKey: store.AWSAccessKeyId,
AwsSecretKey: store.AWSSecretAccessKey,
AwsSecretKey: store.AWSSecretAccessKey.String(),
AwsRegion: store.AWSRegion,
RegistryConnectionType: store.Connection,
RegistryCertificateString: store.Cert,
Expand Down
75 changes: 75 additions & 0 deletions ...-sync/vendor/github.com/devtron-labs/common-lib/securestore/AttributesRepoDBConnection.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

111 changes: 111 additions & 0 deletions chart-sync/vendor/github.com/devtron-labs/common-lib/securestore/AttributesRepository.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading