This repository was archived by the owner on Feb 6, 2026. It is now read-only.
Move encrypted secrets into LayerDB (ENG-2415)#3478
Merged
si-bors-ng[bot] merged 1 commit intomainfrom Mar 28, 2024
Merged
Conversation
github-actions
bot
added
A-sdf
nickgerace
force-pushed
the
nick/0c5604f
branch
from
26da286 to
f5a193d
Compare
github-actions
bot
added
A-si-settings
nickgerace
force-pushed
the
nick/0c5604f
branch
3 times, most recently
from
b09dab5 to
a060632
Compare
nickgerace
changed the title
nickgerace
force-pushed
the
nick/0c5604f
branch
5 times, most recently
from
fdc6cd4 to
e19c104
Compare
Contributor
Author
|
bors merge |
Contributor
|
Merge conflict. |
nickgerace
force-pushed
the
nick/0c5604f
branch
from
e19c104 to
0542eaf
Compare
This commit moves encrypted secrets into LayerDB. Before this commit,
encrypted secrets were store on the existing PG table whose migration is
from the "old-engine". This table implemented standard model and was
both tenancy and visibility scoped. While referential secrets made it on
the "new-engine" graph structure, their encrypted bits remained in the
old table. Now that LayerDB is in play, we are able to leverage it to
get encrypted secrets working between change sets as well as to work
with them faster than before.
Primary changes:
- Add new LayerDB table for encrypted secrets
- Generate keys for the table with the tenancy, SecretId, and a
generated Ulid from the current change set
- Concentrate secrets into two primary objects: Secret and
EncryptedSecret (while retaining DecryptedSecret for sending
information to cyclone and for testing)
- Secret contains metadata for the secret as well as a key to the
encrypted contents
- EncryptedSecret contains the encrypted contents
- Ensure that when encrypted contents are updated, we insert a new
EncryptedSecret and update the key on the Secret
- Split secrets functionality into separate private modules
- Add integration test for updating both the metadata and the encrypted
contents for a secret
- Refactor secrets unit tests to be split across relevant modules and
integration tests to match the new paradigm
Secondary changes:
- Privatize the "func::before" module and export its core function and
error type
- Restore the qualification check in the before funcs test for added
coverage
- Remove unused identity func helper module
- Add "remain::sorted" to LayeredEventKind
Signed-off-by: Nick Gerace <nick@systeminit.com>
nickgerace
force-pushed
the
nick/0c5604f
branch
from
0542eaf to
b4e3c29
Compare
Contributor
Author
|
bors merge |
Contributor
|
Build succeeded: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR moves encrypted secrets into LayerDB.
Before this PR, encrypted secrets were store on the existing PG table whose migration is from the
old-engine. This table implemented standard model and was both tenancy-scoped and visibility-scoped. While referential secrets made it on thenew-enginegraph structure, their encrypted bits remained in the old table.Now that LayerDB is in play, we are able to leverage it to get encrypted secrets working between change sets as well as to work with them faster than before.
Primary Changes
SecretId, and a generatedUlidfrom the current change setSecretandEncryptedSecret(while retainingDecryptedSecretfor sending information to cyclone and for testing)Secretcontains metadata for the secret as well as a key to the encrypted contentsEncryptedSecretcontains the encrypted contentsEncryptedSecretand update the key on theSecretSecondary Changes
func::beforemodule and export its core function and error typeremain::sortedtoLayeredEventKind