Skip to content

fix: implement secure storage for sensitive data with encryption and repository management #364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Ash-exp merged 1 commit into from
Dec 4, 2025
Merged

fix: implement secure storage for sensitive data with encryption and repository management #364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kubewatch/env_gen.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
[{"Category":"ARGOCD_INFORMER","Fields":[{"Env":"ACD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether ArgoCD informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"ACD_NAMESPACE","EnvType":"string","EnvValue":"devtroncd","EnvDescription":"Namespace where all the ArgoCD application objects are published. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CD_ARGO_WORKFLOW","Fields":[{"Env":"CD_DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-cd","EnvDescription":"Namespace where all CD workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"},{"Env":"CD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CD informer is enabled or not","Example":"","Deprecated":"false"}]},{"Category":"CI_ARGO_WORKFLOW","Fields":[{"Env":"CI_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CI informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-ci","EnvDescription":"Namespace where all CI workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CLUSTER_MODE","Fields":[{"Env":"CLUSTER_ARGO_CD_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for ArgoCD informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CD_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CD ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CI_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CI ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for System Executor informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"}]},{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"kubewatch","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CONSUMER_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"DEFAULT_LOG_TIME_LIMIT","EnvType":"int64","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"ENABLE_STATSVIZ","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_CLIENT_MAX_IDLE_CONNS_PER_HOST","EnvType":"int","EnvValue":"25","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_IDLE_CONN_TIMEOUT","EnvType":"int","EnvValue":"300","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_KEEPALIVE","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_TIMEOUT","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TLS_HANDSHAKE_TIMEOUT","EnvType":"int","EnvValue":"10","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_ACK_WAIT_IN_SECS","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_BUFFER_SIZE","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_MAX_AGE","EnvType":"int","EnvValue":"86400","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_PROCESSING_BATCH_SIZE","EnvType":"int","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_REPLICAS","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_SERVER_HOST","EnvType":"string","EnvValue":"nats://devtron-nats.devtroncd:4222","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"RUNTIME_CONFIG_LOCAL_DEV","EnvType":"LocalDevMode","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"STREAM_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"USE_CUSTOM_HTTP_TRANSPORT","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"EXTERNAL_KUBEWATCH","Fields":[{"Env":"CD_EXTERNAL_LISTENER_URL","EnvType":"string","EnvValue":"http://devtroncd-orchestrator-service-prod.devtroncd:80","EnvDescription":"URL of the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_NAMESPACE","EnvType":"string","EnvValue":"","EnvDescription":"Namespace where the external kubewatch is set up","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_ORCHESTRATOR_TOKEN","EnvType":"string","EnvValue":"","EnvDescription":"Token used to authenticate with the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_REST_LISTENER","EnvType":"bool","EnvValue":"false","EnvDescription":"Used to determine whether it's an external kubewatch or internal kubewatch","Example":"","Deprecated":"false"}]},{"Category":"GRACEFUL_SHUTDOWN","Fields":[{"Env":"SLEEP_TIMEOUT","EnvType":"int","EnvValue":"5","EnvDescription":"Graceful shutdown timeout in seconds","Example":"","Deprecated":"false"}]}]
[{"Category":"ARGOCD_INFORMER","Fields":[{"Env":"ACD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether ArgoCD informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"ACD_NAMESPACE","EnvType":"string","EnvValue":"devtroncd","EnvDescription":"Namespace where all the ArgoCD application objects are published. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CD_ARGO_WORKFLOW","Fields":[{"Env":"CD_DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-cd","EnvDescription":"Namespace where all CD workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"},{"Env":"CD_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CD informer is enabled or not","Example":"","Deprecated":"false"}]},{"Category":"CI_ARGO_WORKFLOW","Fields":[{"Env":"CI_INFORMER","EnvType":"bool","EnvValue":"true","EnvDescription":"Used to determine whether CI informer is enabled or not","Example":"","Deprecated":"false"},{"Env":"DEFAULT_NAMESPACE","EnvType":"string","EnvValue":"devtron-ci","EnvDescription":"Namespace where all CI workflows objects are scheduled. For multi-cluster mode, it will be set to v1.NamespaceAll","Example":"","Deprecated":"false"}]},{"Category":"CLUSTER_MODE","Fields":[{"Env":"CLUSTER_ARGO_CD_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for ArgoCD informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CD_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CD ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_CI_ARGO_WF_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for CI ArgoWorkflow informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"},{"Env":"CLUSTER_TYPE","EnvType":"string","EnvValue":"IN_CLUSTER","EnvDescription":"Determines cluster mode for System Executor informer; for multiple cluster mode, it will be set to ALL_CLUSTER; for single cluster mode, it will be set to IN_CLUSTER","Example":"","Deprecated":"false"}]},{"Category":"DEVTRON","Fields":[{"Env":"APP","EnvType":"string","EnvValue":"kubewatch","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"CONSUMER_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"DEFAULT_LOG_TIME_LIMIT","EnvType":"int64","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"ENABLE_STATSVIZ","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_CLIENT_MAX_IDLE_CONNS_PER_HOST","EnvType":"int","EnvValue":"25","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_IDLE_CONN_TIMEOUT","EnvType":"int","EnvValue":"300","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_KEEPALIVE","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TCP_TIMEOUT","EnvType":"int","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"K8s_TLS_HANDSHAKE_TIMEOUT","EnvType":"int","EnvValue":"10","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"LOG_LEVEL","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_ACK_WAIT_IN_SECS","EnvType":"int","EnvValue":"120","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_BUFFER_SIZE","EnvType":"int","EnvValue":"-1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_MAX_AGE","EnvType":"int","EnvValue":"86400","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_PROCESSING_BATCH_SIZE","EnvType":"int","EnvValue":"1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_MSG_REPLICAS","EnvType":"int","EnvValue":"0","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"NATS_SERVER_HOST","EnvType":"string","EnvValue":"nats://devtron-nats.devtroncd:4222","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_ADDR","EnvType":"string","EnvValue":"127.0.0.1","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_DATABASE","EnvType":"string","EnvValue":"orchestrator","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_EXPORT_PROM_METRICS","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_FAILURE_QUERIES","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_ALL_QUERY","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_LOG_SLOW_QUERY","EnvType":"bool","EnvValue":"true","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PASSWORD","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_PORT","EnvType":"string","EnvValue":"5432","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_QUERY_DUR_THRESHOLD","EnvType":"int64","EnvValue":"5000","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_USER","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"RUNTIME_CONFIG_LOCAL_DEV","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"STREAM_CONFIG_JSON","EnvType":"string","EnvValue":"","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"USE_CUSTOM_HTTP_TRANSPORT","EnvType":"bool","EnvValue":"false","EnvDescription":"","Example":"","Deprecated":"false"}]},{"Category":"EXTERNAL_KUBEWATCH","Fields":[{"Env":"CD_EXTERNAL_LISTENER_URL","EnvType":"string","EnvValue":"http://devtroncd-orchestrator-service-prod.devtroncd:80","EnvDescription":"URL of the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_NAMESPACE","EnvType":"string","EnvValue":"","EnvDescription":"Namespace where the external kubewatch is set up","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_ORCHESTRATOR_TOKEN","EnvType":"string","EnvValue":"","EnvDescription":"Token used to authenticate with the orchestrator","Example":"","Deprecated":"false"},{"Env":"CD_EXTERNAL_REST_LISTENER","EnvType":"bool","EnvValue":"false","EnvDescription":"Used to determine whether it's an external kubewatch or internal kubewatch","Example":"","Deprecated":"false"}]},{"Category":"GRACEFUL_SHUTDOWN","Fields":[{"Env":"SLEEP_TIMEOUT","EnvType":"int","EnvValue":"5","EnvDescription":"Graceful shutdown timeout in seconds","Example":"","Deprecated":"false"}]},{"Category":"POSTGRES","Fields":[{"Env":"CASBIN_DATABASE","EnvType":"string","EnvValue":"casbin","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_READ_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"},{"Env":"PG_WRITE_TIMEOUT","EnvType":"int64","EnvValue":"30","EnvDescription":"","Example":"","Deprecated":"false"}]}]
10 changes: 9 additions & 1 deletion kubewatch/env_gen.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
| PG_PORT | string |5432 | | | false |
| PG_QUERY_DUR_THRESHOLD | int64 |5000 | | | false |
| PG_USER | string | | | | false |
| RUNTIME_CONFIG_LOCAL_DEV | LocalDevMode |false | | | false |
| RUNTIME_CONFIG_LOCAL_DEV | bool |false | | | false |
| STREAM_CONFIG_JSON | string | | | | false |
| USE_CUSTOM_HTTP_TRANSPORT | bool |false | | | false |

Expand All @@ -78,3 +78,11 @@
|-------|----------|-------------------|-------------------|-----------------------|------------------|
| SLEEP_TIMEOUT | int |5 | Graceful shutdown timeout in seconds | | false |


## POSTGRES Related Environment Variables
| Key | Type | Default Value | Description | Example | Deprecated |
|-------|----------|-------------------|-------------------|-----------------------|------------------|
| CASBIN_DATABASE | string |casbin | | | false |
| PG_READ_TIMEOUT | int64 |30 | | | false |
| PG_WRITE_TIMEOUT | int64 |30 | | | false |

5 changes: 5 additions & 0 deletions kubewatch/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package main

import (
"github.com/devtron-labs/common-lib/securestore"
"log"
"os"
"os/signal"
Expand All @@ -25,6 +26,10 @@ import (
)

func main() {
err := securestore.SetEncryptionKey()
if err != nil {
log.Println("error in setting encryption key", "err", err)
}
app, err := InitializeApp()
if err != nil {
log.Panic(err)
Expand Down
35 changes: 18 additions & 17 deletions kubewatch/pkg/cluster/ClusterRepository.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package repository

import (
"github.com/devtron-labs/common-lib/securestore"
"github.com/devtron-labs/common-lib/utils/k8s/commonBean"
"github.com/devtron-labs/kubewatch/pkg/sql"
"github.com/go-pg/pg"
Expand All @@ -25,23 +26,23 @@ import (
)

type Cluster struct {
tableName struct{} `sql:"cluster" pg:",discard_unknown_columns"`
Id int `sql:"id,pk"`
ClusterName string `sql:"cluster_name"`
ServerUrl string `sql:"server_url"`
PrometheusEndpoint string `sql:"prometheus_endpoint"`
Active bool `sql:"active,notnull"`
CdArgoSetup bool `sql:"cd_argo_setup,notnull"`
Config map[string]string `sql:"config"`
PUserName string `sql:"p_username"`
PPassword string `sql:"p_password"`
PTlsClientCert string `sql:"p_tls_client_cert"`
PTlsClientKey string `sql:"p_tls_client_key"`
AgentInstallationStage int `sql:"agent_installation_stage"`
K8sVersion string `sql:"k8s_version"`
ErrorInConnecting string `sql:"error_in_connecting"`
InsecureSkipTlsVerify bool `sql:"insecure_skip_tls_verify"`
IsVirtualCluster bool `sql:"is_virtual_cluster"`
tableName struct{} `sql:"cluster" pg:",discard_unknown_columns"`
Id int `sql:"id,pk"`
ClusterName string `sql:"cluster_name"`
ServerUrl string `sql:"server_url"`
PrometheusEndpoint string `sql:"prometheus_endpoint"`
Active bool `sql:"active,notnull"`
CdArgoSetup bool `sql:"cd_argo_setup,notnull"`
Config securestore.EncryptedMap `sql:"config"`
PUserName string `sql:"p_username"`
PPassword string `sql:"p_password"`
PTlsClientCert string `sql:"p_tls_client_cert"`
PTlsClientKey string `sql:"p_tls_client_key"`
AgentInstallationStage int `sql:"agent_installation_stage"`
K8sVersion string `sql:"k8s_version"`
ErrorInConnecting string `sql:"error_in_connecting"`
InsecureSkipTlsVerify bool `sql:"insecure_skip_tls_verify"`
IsVirtualCluster bool `sql:"is_virtual_cluster"`
sql.AuditLog
}

Expand Down
Loading