Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Platform] Add ability to turn off encryption at rest for an encrypted at rest universe #2730

Closed
daniel-yb opened this issue Oct 25, 2019 · 0 comments
Closed

[Platform] Add ability to turn off encryption at rest for an encrypted at rest universe #2730

daniel-yb opened this issue Oct 25, 2019 · 0 comments
Assignees
@daniel-yb
Labels
area/platform Yugabyte Platform

Comments

@daniel-yb
Copy link
Contributor

Right now we need to turn off encryption at rest for a universe that is currently encrypted at rest through RPC. Add the ability to trigger disabling encryption through the YW UI.
@daniel-yb daniel-yb added the area/platform Yugabyte Platform label Oct 25, 2019
@daniel-yb daniel-yb self-assigned this Oct 25, 2019
daniel-yb added a commit that referenced this issue Oct 30, 2019
@daniel-yb
Followup work on EncryptionAtRestService #2697, #2715, #2578, #2730
c16e028 
Summary:
  - Can now rotate encryption at rest universe keys for an already-existing universe.
  - If the EncryptionAtRestService::createKey/rotateKey calls fail to generate a new universe key, we do not default to a self-generated universe key anymore. In the case of enabling encryption at rest during a universe creation, a failure results in defaulting to an unencrypted universe. In the case of setting the key for an existing universe, it outright fails the set key API request.
- Can specify the set-key operation that is being run (supports "ENABLE" and "DISABLE" at the moment).

Test Plan:
Rotate universe key for a universe already encrypted at rest using the
```
/customers/:cUUID/universes/:uniUUID/set_key
```
API -> ensure the universe is encrypted using a new encryption key file (file name should be suffixed with how many different keys have been set on that specific universe).

Disable encryption at rest by hitting the same endpoint with a
```
"key_op": "DISABLE"
```
k/v added to the normal payload

Reviewers: sanketh, ram

Reviewed By: ram

Subscribers: rahuldesirazu, jenkins-bot, yugaware

Differential Revision: https://phabricator.dev.yugabyte.com/D7445
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@daniel-yb daniel-yb

Labels
area/platform Yugabyte Platform
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@daniel-yb