Skip to content

Add support for encrypted backups in online restores.#5226

Merged
martinmr merged 3 commits intomasterfrom
martinmr/restore-enc
Apr 20, 2020
Merged

Add support for encrypted backups in online restores.#5226
martinmr merged 3 commits intomasterfrom
martinmr/restore-enc

Conversation

@martinmr
Copy link
Copy Markdown
Contributor

@martinmr martinmr commented Apr 16, 2020

Fixes DGRAPH-1233


This change is Reviewable

@martinmr martinmr requested a review from manishrjain as a code owner April 16, 2020 22:52
@martinmr martinmr requested a review from a team April 16, 2020 22:52
Copy link
Copy Markdown
Contributor

@parasssh parasssh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 0 of 14 files reviewed, 2 unresolved discussions (waiting on @manishrjain and @martinmr)

a discussion (no related file):
The same key should be used for re-encrypting the restored data.



graphql/admin/endpoints_ee.go, line 72 at r1 (raw file):

		"""
		Path to the key file needed to unencrypt the backup. This file should be accessible

unencrypt -> decrypt

Also, the the same key in the file is used to re-encrypt the restored data.

Copy link
Copy Markdown
Contributor Author

@martinmr martinmr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 0 of 14 files reviewed, 2 unresolved discussions (waiting on @manishrjain and @parasssh)

a discussion (no related file):

Previously, parasssh wrote…

The same key should be used for re-encrypting the restored data.

This doesn't apply to online restores. The data has to be encrypted with the key used to start the cluster, which can be different. Online restores don't create a new db, they used the db used by the running alpha service.



graphql/admin/endpoints_ee.go, line 72 at r1 (raw file):

Previously, parasssh wrote…

unencrypt -> decrypt

Also, the the same key in the file is used to re-encrypt the restored data.

Done.

The second part is not true for online restores. The data will be encrypted with the same key used to start the cluster. This key doesn't necessarily have to be the same. I've added a note in the comment saying this.

@martinmr martinmr requested a review from parasssh April 17, 2020 23:46
@martinmr martinmr dismissed parasssh’s stale review April 17, 2020 23:50

replied to review

Copy link
Copy Markdown
Contributor

@parasssh parasssh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 0 of 14 files reviewed, 3 unresolved discussions (waiting on @manishrjain, @martinmr, and @parasssh)

a discussion (no related file):
Makes sense. :lgtm:


Copy link
Copy Markdown
Contributor

@manishrjain manishrjain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:lgtm:

Reviewable status: 0 of 14 files reviewed, 3 unresolved discussions (waiting on @manishrjain, @martinmr, and @parasssh)

@martinmr martinmr merged commit 859e784 into master Apr 20, 2020
@martinmr martinmr deleted the martinmr/restore-enc branch April 20, 2020 17:25
dna2github pushed a commit to dna2fork/dgraph that referenced this pull request Jul 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants