Root key rotate - core side #7218

jackyalbo · 2023-02-27T10:06:06Z

Explain the changes

We decided to move key rotation part in core to a daily running process checking if anything is changed with the external root keys file and if so, to re-encrypt the system/systems keys accordingly.
the key files will be under directory /etc/noobaa-server/root_keys. the active root key id will be under /etc/noobaa-server/active_root_key
As trying to support both old format (env-variable) and the new one(a directory mount with no env variable) checks were added to system_server load and also in case of running in the new format and seeing the old format leftovers - those leftovers will get cleaned

in 2nd commit:

moving mongodb outside of noobaa tester container (due to issues with the image in M1)
like in postgres, mongo will run in its own container and tester will connect to it for DB access.

Issues: Fixed #xxx / Gap #xxx

Testing Instructions:

Fixed Automatically comment out mongo-db code in Tests.Dockerfile when using Mac with M1 #7179

Doc added/updated
Tests added

Makefile

src/server/system_services/master_key_manager.js

romayalon · 2023-02-27T16:19:16Z

src/server/system_services/master_key_manager.js

    }

    is_root_key(root_key_id) {
        return root_key_id && root_key_id.toString() === ROOT_KEY.toString();
    }

+    get_current_root_key_id() {


I feel we should remove the old format or at least merge it so it won't be even more confusing

this is still relevant

src/server/system_services/system_server.js

jackyalbo · 2023-03-07T06:37:36Z

As discussed with @romayalon and @dannyzaken. I'm resolving all the design issues; moving the key_rotator to bg_worker, and waiting for a re-review.

Makefile

src/test/unit_tests/coretest.js

src/util/mongo_client.js

src/server/system_services/system_store.js

config.js

src/server/bg_services/key_rotator.js

src/server/bg_workers.js

src/server/bg_services/key_rotator.js

src/server/system_services/system_store.js

src/server/system_services/master_key_manager.js

config.js

src/server/system_services/master_key_manager.js

romayalon · 2023-03-19T10:10:02Z

src/server/system_services/master_key_manager.js

    }

    is_root_key(root_key_id) {
        return root_key_id && root_key_id.toString() === ROOT_KEY.toString();
    }

+    get_current_root_key_id() {


this is still relevant

src/server/system_services/master_key_manager.js

src/server/system_services/system_store.js

Signed-off-by: jackyalbo <jacky.albo@gmail.com>

Moving mongo to a docker in the same way we do for Postgres Signed-off-by: jackyalbo <jacky.albo@gmail.com>

baum

lgtm

jackyalbo requested review from dannyzaken and romayalon February 27, 2023 10:06

pull-request-size bot added the size/L label Feb 27, 2023

jackyalbo force-pushed the jacky-root-key-rotate branch 2 times, most recently from 67c6ca0 to fa195e0 Compare February 27, 2023 14:39

romayalon reviewed Feb 27, 2023

View reviewed changes

jackyalbo force-pushed the jacky-root-key-rotate branch 2 times, most recently from 74c3c08 to 766bf44 Compare March 2, 2023 15:37

jackyalbo force-pushed the jacky-root-key-rotate branch from 766bf44 to 338b800 Compare March 7, 2023 09:57

dannyzaken reviewed Mar 8, 2023

View reviewed changes

jackyalbo force-pushed the jacky-root-key-rotate branch from 338b800 to 2358c23 Compare March 8, 2023 18:04

jackyalbo requested a review from dannyzaken March 9, 2023 13:02

jackyalbo force-pushed the jacky-root-key-rotate branch from 2358c23 to e9a2dc6 Compare March 9, 2023 14:14

jackyalbo mentioned this pull request Mar 12, 2023

Add Ceph-S3 Tests Documentation #7229

Merged

1 task

jackyalbo force-pushed the jacky-root-key-rotate branch from e9a2dc6 to 98b5f42 Compare March 12, 2023 16:05

romayalon reviewed Mar 13, 2023

View reviewed changes

src/server/bg_services/key_rotator.js Outdated Show resolved Hide resolved

romayalon reviewed Mar 13, 2023

View reviewed changes

src/server/system_services/system_store.js Outdated Show resolved Hide resolved

romayalon reviewed Mar 13, 2023

View reviewed changes

src/server/system_services/master_key_manager.js Outdated Show resolved Hide resolved

baum mentioned this pull request Mar 14, 2023

Master Root Key rotation for K8S secret backend noobaa/noobaa-operator#1071

Merged

jackyalbo force-pushed the jacky-root-key-rotate branch 2 times, most recently from f2d5812 to 6c29fcc Compare March 16, 2023 14:05

romayalon reviewed Mar 19, 2023

View reviewed changes

jackyalbo force-pushed the jacky-root-key-rotate branch 3 times, most recently from 69d3da6 to ea3ecda Compare March 23, 2023 15:08

baum reviewed Mar 31, 2023

View reviewed changes

src/server/system_services/system_store.js Outdated Show resolved Hide resolved

jackyalbo added 2 commits April 18, 2023 16:28

Root Key rotate - core side

12029e2

Signed-off-by: jackyalbo <jacky.albo@gmail.com>

Addition and fixes for makefile and dockerfiles

65d0f56

Moving mongo to a docker in the same way we do for Postgres Signed-off-by: jackyalbo <jacky.albo@gmail.com>

jackyalbo force-pushed the jacky-root-key-rotate branch from ea3ecda to 65d0f56 Compare April 18, 2023 13:28

baum approved these changes Apr 18, 2023

View reviewed changes

jackyalbo merged commit 57b0dde into noobaa:master Apr 19, 2023
5 checks passed

jackyalbo mentioned this pull request Apr 19, 2023

Automatically comment out mongo-db code in Tests.Dockerfile when using Mac with M1 #7179

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Root key rotate - core side #7218

Root key rotate - core side #7218

jackyalbo commented Feb 27, 2023 •

edited

romayalon Feb 27, 2023

romayalon Mar 19, 2023

jackyalbo commented Mar 7, 2023

romayalon Mar 19, 2023

baum left a comment

Root key rotate - core side #7218

Root key rotate - core side #7218

Conversation

jackyalbo commented Feb 27, 2023 • edited

Explain the changes

Issues: Fixed #xxx / Gap #xxx

Testing Instructions:

romayalon Feb 27, 2023

Choose a reason for hiding this comment

romayalon Mar 19, 2023

Choose a reason for hiding this comment

jackyalbo commented Mar 7, 2023

romayalon Mar 19, 2023

Choose a reason for hiding this comment

baum left a comment

Choose a reason for hiding this comment

jackyalbo commented Feb 27, 2023 •

edited