Skip to content

Commit fcac4ff

Browse files
kartik-579kartik-579
authored
Merge pull request #6852 from devtron-labs/pwd-db-encryption
feat: encryption for db credentials
2 parents 917c551 + 0554483 commit fcac4ff

File tree

41 files changed

+1011
-153
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1011
-153
lines changed

‎App.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
"fmt"
2424
"github.com/devtron-labs/common-lib/middlewares"
2525
pubsub "github.com/devtron-labs/common-lib/pubsub-lib"
26+
"github.com/devtron-labs/common-lib/securestore"
2627
posthogTelemetry "github.com/devtron-labs/common-lib/telemetry"
2728
"github.com/devtron-labs/devtron/pkg/eventProcessor"
2829
"github.com/devtron-labs/devtron/pkg/eventProcessor/in"
@@ -47,6 +48,13 @@ import (
4748
"go.uber.org/zap"
4849
)
4950

51+
func init() {
52+
err := securestore.SetEncryptionKey()
53+
if err != nil {
54+
log.Println("error in setting encryption key", "err", err)
55+
}
56+
}
57+
5058
type App struct {
5159
MuxRouter *router.MuxRouter
5260
Logger *zap.SugaredLogger

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
all: fetch-all-env build
44

5-
TARGET_BRANCH?=develop
5+
TARGET_BRANCH?=main
66
TAG?=$(shell bash -c 'git log --pretty=format:'%h' -n 1')
77
FLAGS=
88
ENVVAR=

‎api/helm-app/service/HelmAppService.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -965,10 +965,10 @@ func (impl *HelmAppServiceImpl) TemplateChart(ctx context.Context, templateChart
965965
registryCredential = &gRPC.RegistryCredential{
966966
RegistryUrl: appStoreAppVersion.AppStore.DockerArtifactStore.RegistryURL,
967967
Username: appStoreAppVersion.AppStore.DockerArtifactStore.Username,
968-
Password: appStoreAppVersion.AppStore.DockerArtifactStore.Password,
968+
Password: appStoreAppVersion.AppStore.DockerArtifactStore.Password.String(),
969969
AwsRegion: appStoreAppVersion.AppStore.DockerArtifactStore.AWSRegion,
970970
AccessKey: appStoreAppVersion.AppStore.DockerArtifactStore.AWSAccessKeyId,
971-
SecretKey: appStoreAppVersion.AppStore.DockerArtifactStore.AWSSecretAccessKey,
971+
SecretKey: appStoreAppVersion.AppStore.DockerArtifactStore.AWSSecretAccessKey.String(),
972972
RegistryType: string(appStoreAppVersion.AppStore.DockerArtifactStore.RegistryType),
973973
RepoName: appStoreAppVersion.AppStore.Name,
974974
IsPublic: ociRegistryConfig.IsPublic,

‎cmd/external-app/externalApp.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ import (
2020
"context"
2121
"errors"
2222
"fmt"
23+
"github.com/devtron-labs/common-lib/securestore"
24+
"log"
2325
"net/http"
2426
"os"
2527
"time"
@@ -35,6 +37,13 @@ import (
3537
"go.uber.org/zap"
3638
)
3739

40+
func init() {
41+
err := securestore.SetEncryptionKey()
42+
if err != nil {
43+
log.Println("error in setting encryption key", "err", err)
44+
}
45+
}
46+
3847
type App struct {
3948
db *pg.DB
4049
sessionManager *authMiddleware.SessionManager

‎cmd/external-app/wire_gen.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ require (
335335
replace (
336336
github.com/argoproj/argo-workflows/v3 v3.5.13 => github.com/devtron-labs/argo-workflows/v3 v3.5.13
337337
github.com/cyphar/filepath-securejoin v0.4.1 => github.com/cyphar/filepath-securejoin v0.3.6 // indirect
338-
github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250911133753-9256a0667454
339-
github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250911133753-9256a0667454
338+
github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251013071936-4564399cd269
339+
github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013071936-4564399cd269
340340
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1
341341
)

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc h1:VRRKCwnzq
237237
github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
238238
github.com/devtron-labs/argo-workflows/v3 v3.5.13 h1:3pINq0gXOSeTw2z/vYe+j80lRpSN5Rp/8mfQORh8SmU=
239239
github.com/devtron-labs/argo-workflows/v3 v3.5.13/go.mod h1:/vqxcovDPT4zqr4DjR5v7CF8ggpY1l3TSa2CIG3jmjA=
240-
github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250911133753-9256a0667454 h1:FfSiQrZpr6rDjmtFR6u3vG1WaoUBkv4ZR6rGZ5eRX8I=
241-
github.com/devtron-labs/devtron-services/authenticator v0.0.0-20250911133753-9256a0667454/go.mod h1:9LCkYfiWaEKIBkmxw9jX1GujvEMyHwmDtVsatffAkeU=
242-
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250911133753-9256a0667454 h1:qpYqvcezyTM9yDBSsDHJvp7GjSypx9SxiU/L4xoZR9s=
243-
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250911133753-9256a0667454/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
240+
github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251013071936-4564399cd269 h1:DWDnjdZ+AAa4w+WiqFPLS4kBRVeY+BvHQGrfEsFTREE=
241+
github.com/devtron-labs/devtron-services/authenticator v0.0.0-20251013071936-4564399cd269/go.mod h1:9LCkYfiWaEKIBkmxw9jX1GujvEMyHwmDtVsatffAkeU=
242+
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013071936-4564399cd269 h1:9+YW3jipbllOHJ1l3mYFSeSris1wUCaM/MQuI4p+Hxc=
243+
github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251013071936-4564399cd269/go.mod h1:/Ciy9tD9OxZOWBDPIasM448H7uvSo4+ZJiExpfwBZpA=
244244
github.com/devtron-labs/go-bitbucket v0.9.60-beta h1:VEx1jvDgdtDPS6A1uUFoaEi0l1/oLhbr+90xOwr6sDU=
245245
github.com/devtron-labs/go-bitbucket v0.9.60-beta/go.mod h1:GnuiCesvh8xyHeMCb+twm8lBR/kQzJYSKL28ZfObp1Y=
246246
github.com/devtron-labs/protos v0.0.3-0.20250323220609-ecf8a0f7305e h1:U6UdYbW8a7xn5IzFPd8cywjVVPfutGJCudjePAfL/Hs=

‎internal/sql/repository/GitOpsConfigRepository.go‎

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package repository
1818

1919
import (
20+
"github.com/devtron-labs/common-lib/securestore"
2021
"github.com/devtron-labs/devtron/pkg/sql"
2122
"github.com/go-pg/pg"
2223
"go.uber.org/zap"
@@ -41,24 +42,24 @@ type GitOpsConfigRepositoryImpl struct {
4142
}
4243

4344
type GitOpsConfig struct {
44-
tableName struct{} `sql:"gitops_config" pg:",discard_unknown_columns"`
45-
Id int `sql:"id,pk"`
46-
Provider string `sql:"provider"`
47-
Username string `sql:"username"`
48-
Token string `sql:"token"`
49-
GitLabGroupId string `sql:"gitlab_group_id"`
50-
GitHubOrgId string `sql:"github_org_id"`
51-
AzureProject string `sql:"azure_project"`
52-
Host string `sql:"host"`
53-
Active bool `sql:"active,notnull"`
54-
AllowCustomRepository bool `sql:"allow_custom_repository,notnull"`
55-
BitBucketWorkspaceId string `sql:"bitbucket_workspace_id"`
56-
BitBucketProjectKey string `sql:"bitbucket_project_key"`
57-
EmailId string `sql:"email_id"`
58-
EnableTLSVerification bool `sql:"enable_tls_verification"`
59-
TlsCert string `sql:"tls_cert"`
60-
TlsKey string `sql:"tls_key"`
61-
CaCert string `sql:"ca_cert"`
45+
tableName struct{} `sql:"gitops_config" pg:",discard_unknown_columns"`
46+
Id int `sql:"id,pk"`
47+
Provider string `sql:"provider"`
48+
Username string `sql:"username"`
49+
Token securestore.EncryptedString `sql:"token"`
50+
GitLabGroupId string `sql:"gitlab_group_id"`
51+
GitHubOrgId string `sql:"github_org_id"`
52+
AzureProject string `sql:"azure_project"`
53+
Host string `sql:"host"`
54+
Active bool `sql:"active,notnull"`
55+
AllowCustomRepository bool `sql:"allow_custom_repository,notnull"`
56+
BitBucketWorkspaceId string `sql:"bitbucket_workspace_id"`
57+
BitBucketProjectKey string `sql:"bitbucket_project_key"`
58+
EmailId string `sql:"email_id"`
59+
EnableTLSVerification bool `sql:"enable_tls_verification"`
60+
TlsCert string `sql:"tls_cert"`
61+
TlsKey string `sql:"tls_key"`
62+
CaCert string `sql:"ca_cert"`
6263
sql.AuditLog
6364
}
6465

@@ -71,15 +72,24 @@ func (impl *GitOpsConfigRepositoryImpl) GetConnection() *pg.DB {
7172
}
7273

7374
func (impl *GitOpsConfigRepositoryImpl) CreateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) (*GitOpsConfig, error) {
74-
err := tx.Insert(model)
75+
var err error
76+
model.Token, err = securestore.EncryptString(model.Token.String())
77+
if err != nil {
78+
return model, err
79+
}
80+
err = tx.Insert(model)
7581
if err != nil {
7682
impl.logger.Error(err)
7783
return model, err
7884
}
7985
return model, nil
8086
}
81-
func (impl *GitOpsConfigRepositoryImpl) UpdateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) error {
82-
err := tx.Update(model)
87+
func (impl *GitOpsConfigRepositoryImpl) UpdateGitOpsConfig(model *GitOpsConfig, tx *pg.Tx) (err error) {
88+
model.Token, err = securestore.EncryptString(model.Token.String())
89+
if err != nil {
90+
return err
91+
}
92+
err = tx.Update(model)
8393
if err != nil {
8494
impl.logger.Error(err)
8595
return err

‎internal/sql/repository/dockerRegistry/DockerArtifactStoreRepository.go‎

Lines changed: 35 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package repository
1818

1919
import (
2020
"fmt"
21+
"github.com/devtron-labs/common-lib/securestore"
2122
"github.com/devtron-labs/devtron/pkg/sql"
2223
"github.com/devtron-labs/devtron/util"
2324
"github.com/go-pg/pg/orm"
@@ -46,21 +47,21 @@ type RegistryType string
4647
var OCI_REGISRTY_REPO_TYPE_LIST = []string{OCI_REGISRTY_REPO_TYPE_CONTAINER, OCI_REGISRTY_REPO_TYPE_CHART}
4748

4849
type DockerArtifactStore struct {
49-
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
50-
Id string `sql:"id,pk" json:"id,,omitempty"`
51-
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
52-
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
53-
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
54-
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
55-
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
56-
AWSSecretAccessKey string `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
57-
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
58-
Username string `sql:"username" json:"username,omitempty"`
59-
Password string `sql:"password" json:"password,omitempty"`
60-
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
61-
Connection string `sql:"connection" json:"connection,omitempty"`
62-
Cert string `sql:"cert" json:"cert,omitempty"`
63-
Active bool `sql:"active,notnull" json:"active"`
50+
tableName struct{} `sql:"docker_artifact_store" json:",omitempty" pg:",discard_unknown_columns"`
51+
Id string `sql:"id,pk" json:"id,,omitempty"`
52+
PluginId string `sql:"plugin_id,notnull" json:"pluginId,omitempty"`
53+
RegistryURL string `sql:"registry_url" json:"registryUrl,omitempty"`
54+
RegistryType RegistryType `sql:"registry_type,notnull" json:"registryType,omitempty"`
55+
IsOCICompliantRegistry bool `sql:"is_oci_compliant_registry,notnull" json:"isOCICompliantRegistry,omitempty"`
56+
AWSAccessKeyId string `sql:"aws_accesskey_id" json:"awsAccessKeyId,omitempty" `
57+
AWSSecretAccessKey securestore.EncryptedString `sql:"aws_secret_accesskey" json:"awsSecretAccessKey,omitempty"`
58+
AWSRegion string `sql:"aws_region" json:"awsRegion,omitempty"`
59+
Username string `sql:"username" json:"username,omitempty"`
60+
Password securestore.EncryptedString `sql:"password" json:"password,omitempty"`
61+
IsDefault bool `sql:"is_default,notnull" json:"isDefault"`
62+
Connection string `sql:"connection" json:"connection,omitempty"`
63+
Cert string `sql:"cert" json:"cert,omitempty"`
64+
Active bool `sql:"active,notnull" json:"active"`
6465
IpsConfig *DockerRegistryIpsConfig
6566
OCIRegistryConfig []*OCIRegistryConfig
6667
sql.AuditLog
@@ -109,7 +110,16 @@ func (impl DockerArtifactStoreRepositoryImpl) GetConnection() *pg.DB {
109110
return impl.dbConnection
110111
}
111112

112-
func (impl DockerArtifactStoreRepositoryImpl) Save(artifactStore *DockerArtifactStore, tx *pg.Tx) error {
113+
func (impl DockerArtifactStoreRepositoryImpl) Save(artifactStore *DockerArtifactStore, tx *pg.Tx) (err error) {
114+
artifactStore.Password, err = securestore.EncryptString(artifactStore.Password.String())
115+
if err != nil {
116+
return err
117+
}
118+
artifactStore.AWSSecretAccessKey, err = securestore.EncryptString(artifactStore.AWSSecretAccessKey.String())
119+
if err != nil {
120+
return err
121+
}
122+
113123
if util.IsBaseStack() {
114124
return tx.Insert(artifactStore)
115125
}
@@ -235,7 +245,15 @@ func (impl DockerArtifactStoreRepositoryImpl) FindOneInactive(storeId string) (*
235245
return &provider, err
236246
}
237247

238-
func (impl DockerArtifactStoreRepositoryImpl) Update(artifactStore *DockerArtifactStore, tx *pg.Tx) error {
248+
func (impl DockerArtifactStoreRepositoryImpl) Update(artifactStore *DockerArtifactStore, tx *pg.Tx) (err error) {
249+
artifactStore.Password, err = securestore.EncryptString(artifactStore.Password.String())
250+
if err != nil {
251+
return err
252+
}
253+
artifactStore.AWSSecretAccessKey, err = securestore.EncryptString(artifactStore.AWSSecretAccessKey.String())
254+
if err != nil {
255+
return err
256+
}
239257
//TODO check for unique default
240258
//there can be only one default
241259

‎pkg/appStore/adapter/Adapter.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ func GenerateInstallAppVersionDTO(installedApp *repository.InstalledApps, instal
159159
chartVersionApp.AppStore.DockerArtifactStore.RegistryURL,
160160
chartVersionApp.AppStore.Name)
161161
Username = chartVersionApp.AppStore.DockerArtifactStore.Username
162-
Password = chartVersionApp.AppStore.DockerArtifactStore.Password
162+
Password = chartVersionApp.AppStore.DockerArtifactStore.Password.String()
163163
}
164164
envBean := adapter2.NewEnvironmentBean(&installedApp.Environment)
165165
installAppDto := &appStoreBean.InstallAppVersionDTO{

0 commit comments

Comments
 (0)