Files
threshold/internal/db/schema/migrations/oss/postgres/44/02_hosts.up.sql
T
edd323b73a Key Rotation/Destruction (#2477) (#2607)
* Key Rotation/Destruction (#2477)

* fix: Correct kms.CreateKeys comment

This method does not return anything.

* feat(kms): Add new ListKeys method

The new ListKeys method wraps the underlying KMS wrapper,
returning all the keys in the scope specified.

* feat(scopes): Add new scope actions for key management

Adds list-keys, rotate-keys and revoke-keys actions for scopes.

* feat(scopes): Add ListKeys API endpoint

This new endpoint lists all keys in a scope

* feat(api): Add ListKeys to Scopes client

This has to be a custom function because it is a custom action
and doesn't map well to any of the existing templates, or
generalises well in a way that would make it reasonable
to create a new template.

* feat(cli): Add new scopes list-keys command

* add RotateKeys function to the kms repository

* Add Rotate Keys Endpoint to Scopes Api (#2360)

* add rotate keys endpoint

* add tests for RotateKeys endpoint

* remove that one comment I forgot about

* addressing more PR comments

* Add Rotate Keys CLI Command (#2395)

* add cli command and client

* add bats tests

* fix some info text and pr comments

* write a new rotate keys description

* Add Missing DEK Foreign Keys (#2408)

* add missing fks

* mark key as nullable in gorm

* update tests to use a new wrapper with a real key_id

* fix formatting in test and add keys for auth_token test

* replace key values

* revert postgres_40_01_test.go

* style: reformat sql for readability

* refactor: change type of key_id columns to kms_private_id

* Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431)

* fix(db): Correct types of data key version referencers

* fix(oplog): Fix missing error handling

* feat(oplog): Store key_id and scope_id with oplog entries

This migration truncates all existing oplog entries, as
migrating existing data would have been complex and
likely unnecessary.

* Update view references

* Always delete oplog entries when dropping keys

* Fix rebase issues

* Fix sql tests

* Add schema for new kms destruction jobs (#2479)

* feat: Add schema for new kms destruction jobs

The schema lets us manage destruction jobs per-table
while providing a guarantee that only one run is running
at a time.

* Apply suggestions from code review

Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>

* Fix table reference and tests

Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>

* update domain, api, and cli to all include key versions in outputs (#2472)

* update domain, api, and cli to all include key versions in outputs

* fix go sum

* add migration to fix immutable error

* fix final test issue as well as make gen issue

* rebase and fix

* address johan pr comments

* make gen, didn't realize comments were included

* update migrations based on new migration 55 file 03

* Move migrations to 56

* feat: Add key version rewrapping function registry (#2478)

The new RegisterTableRewrapFn can be used by a domain
to register a callback to use when rewrapping data in a
specific table name.

* feat(kms): Add scopeId to RewrapFn (#2539)

This makes it much easier for rewrap functions to look up
the correct wrapper and limit the number of rows searched.

* Update Root Cert Proto Definition (#2542)

* update root cert proto definition to properly identify public_key as the table primary key

* add the test fix as well

* Rewrap Functions for Encrypted Tables (#2532)

* add oidc rewrap

* add argon2 config rewrap

* add auth token rewrapping

* add worker auth cert rewrapping

* check the err

* add username password credential rewrapping

* add ssh private key credential rewrapping

* add vault client certificate rewrap function

* add host catalog secret rewrap function

* cleanup a little

* add host vault token rewrap function

* add session credential rewrap function

* add session rewrap function

* add worker auth rewrap function

* update test to include full assert gamut

* add session rewrap function TEST

* bring all tests up to current standards, make more readable, and include full assert gamut

* rework all rewrap functions to utilize scope id

* update comments, queries, sql refs, etc, in response to PR comments

* forgot a comment

* remove hmac updates and fix a couple comments again

* Rewrapping Registered Tables Test (#2555)

* add the registered table test as well as the two missing rewrap functions

* address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test

* Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498)

* feat(kms): Add ability to list data key version destruction jobs

* feat(scopes): Add ListKeyVersionDestructionJobs

* feat(cli): Add list-key-version-destruction-jobs

* feat(kms): Add recurring job that performs table rewrapping

The new recurring job runs for each job table with a registered
rewrapping callback. It attempts to become the running run and
start its rewrapping, gracefully handling sudden interruptions
by resuming it's work if it finds evidence of sudden interruption.

* feat(kms): Add recurring job for destroying key versions

The new job monitors the database for data key version destruction
jobs that have finished rewrapping all its data, performing
the final data key version revocation.

* feat(kms): Add DestroyKeyVersion

DestroyKeyVersion immediately destroys a key version
if it is a root key version or a data key version
which encrypts no data. If the data key version
encrypts data which needs to be rewrapped, it
queues an asynchronous job to complete the rewrapping
operation.

* feat(scopes): Add DestroyKeyVersion API endpoint

* feat(cli): Add scopes destroy-key-version CLI command

* Ensure all secret updates include key ID (#2556)

* feat(all): Ensure all secret updates include key ID

When updating a secret, it is paramount that the key ID
is also updated, as it is the only means we have of ensuring
that we only destroy keys once there is no more data
associated with the key.

* Remove fix to session repository for now

This breaks the current private key derivation method

* add new encrypt/decrypt funcs and made necessary proto changes (#2557)

* add new encrypt/decrypt funcs and made necessary proto changes

* address all PR comments

* fix test panic

* add param checking to rewraps

* fix(schema): Correctly organize migrations again

* Review comments part 1

* Review comments part 2

* Review comments part 3

* Store cert private key, encrypt tofu token (#2583)

* fix(session): store cert private key, encrypt tofu token

Previously, we would derive a session certificate private key from
the session key used in each project, and not store the key. We
would also encrypt the tofu token with the database key but not
store a reference to this key in the database.

This change fixes this by replacing our key derivation with a key
generation step, and instead store the generated key, encrypted,
in the database. We also ensure that any new tofu tokens are
encrypted with the same key.

To handle existing sessions, we lazily rewrite the sessions whenever
a user lists them. There is a minor risk that a user could end up
destroying the database key that encrypts the tofu token before
that session has been rewrapped, but this is going to be rare and
temporary.

* feat(session): Allow the random source for secrets to be configured

* Review comments

* Minor fixes

* More minor fixes

* More small fixes

Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>

* fix(session): Unset session key ID when scope is deleted

Unsetting the key ID allows the session to live beyond the lifetime of
the scope, while allowing the scope to cascade delete its keys.

* fix(migrations): Rewrite migration 56 tests

These tests can no longer use the normal test helpers
as they try to use the new oplog table structure, so we
have to manually write all the interactions.

* fix(migrations): Rename migration 58 file name

This was the name used in the release branch, update
it to the new migration number.

* fix(e2e): Add some comments and debug to kms tests

* fix(session): Handle empty project and user IDs in read

When a project or user is deleted, the session is automatically
canceled and the respective field on the session is unset.
LookupSession did not handle this case gracefully, and would
error on decryption in this state. Skip decrypting sessions that
do not have either a user or project to avoid this error. The
decrypted values are not used for a canceled session.

* Fix worker test

* Increase test timeout

Co-authored-by: Danielle Miu <dani.miu@hashicorp.com>
Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
2022-11-16 18:17:28 -05:00

126 lines
5.0 KiB
PL/PgSQL

begin;
-- dropping these foreign keys because they were never needed
alter table host_plugin_catalog drop constraint iam_scope_fkey;
alter table static_host_catalog drop constraint static_host_catalog_scope_id_fkey;
alter table host_catalog rename column scope_id to project_id;
alter table host_catalog rename constraint host_catalog_scope_id_name_uq to host_catalog_project_id_name_uq;
alter table host_catalog rename constraint host_catalog_scope_id_public_id_key to host_catalog_project_id_public_id_uq;
drop trigger immutable_columns on host_catalog;
create trigger immutable_columns before update on host_catalog
for each row execute function immutable_columns('public_id', 'project_id');
-- insert_host_catalog_subtype() is a before insert trigger function for
-- subtypes of host_catalog.
-- Replaces the insert_host_catalog_subtype function defined in 20/04_host.up.sql
create or replace function insert_host_catalog_subtype() returns trigger
as $$
begin
insert into host_catalog
(public_id, project_id, name)
values
(new.public_id, new.project_id, new.name);
return new;
end;
$$ language plpgsql;
comment on function insert_host_catalog_subtype() is
'insert_host_catalog_subtype() is a before insert trigger function that should be added to all host_catalog subtype tables.';
alter table static_host_catalog rename column scope_id to project_id;
alter table static_host_catalog rename constraint static_host_catalog_scope_id_name_key to static_host_catalog_project_id_name_uq;
drop trigger immutable_columns on static_host_catalog;
create trigger immutable_columns before update on static_host_catalog
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
alter table host_plugin_catalog rename column scope_id to project_id;
alter table host_plugin_catalog rename constraint host_plugin_catalog_scope_id_name_uq to host_plugin_catalog_project_id_name_uq;
drop trigger immutable_columns on host_plugin_catalog;
create trigger immutable_columns before update on host_plugin_catalog
for each row execute function immutable_columns('public_id', 'project_id', 'plugin_id', 'create_time');
-- target_host_set_scope_valid() is a before insert trigger function for target_host_set
-- Replaces target_host_set_scope_valid defined in 0/40_targets.up.sql
-- Replaced in 44/03_targets.up.sql
create or replace function target_host_set_scope_valid() returns trigger
as $$
declare
host_set_project_id wt_scope_id;
target_project_id wt_scope_id;
begin
select hc.project_id into host_set_project_id
from host_set hs
join host_catalog hc on hs.catalog_id = hc.public_id
where hs.public_id = new.host_set_id;
select target.scope_id into target_project_id
from target
where target.public_id = new.target_id;
if target_project_id = host_set_project_id then
return new;
end if;
raise exception 'target and host set are not in the same scope' using
errcode = '23000',
schema = tg_table_schema,
table = tg_table_name;
end;
$$ language plpgsql;
-- update views
drop view host_plugin_catalog_with_secret;
-- Recreated in 58/02_add_data_key_foreign_key_references.up.sql
create view host_plugin_catalog_with_secret as
select
hc.public_id,
hc.project_id,
hc.plugin_id,
hc.name,
hc.description,
hc.create_time,
hc.update_time,
hc.version,
hc.secrets_hmac,
hc.attributes,
hcs.secret,
hcs.key_id,
hcs.create_time as persisted_create_time,
hcs.update_time as persisted_update_time
from
host_plugin_catalog hc
left outer join host_plugin_catalog_secret hcs on hc.public_id = hcs.catalog_id;
comment on view host_plugin_catalog_with_secret is
'host plugin catalog with its associated persisted data';
-- Replaces view from 20/08_plugin_host_views.up.sql
drop view host_plugin_host_with_value_obj_and_set_memberships;
create view host_plugin_host_with_value_obj_and_set_memberships as
select
h.public_id,
h.catalog_id,
h.external_id,
hc.project_id,
hc.plugin_id,
h.name,
h.description,
h.create_time,
h.update_time,
h.version,
-- the string_agg(..) column will be null if there are no associated value objects
string_agg(distinct host(hip.address), '|') as ip_addresses,
string_agg(distinct hdns.name, '|') as dns_names,
string_agg(distinct hpsm.set_id, '|') as set_ids
from
host_plugin_host h
join host_plugin_catalog hc on h.catalog_id = hc.public_id
left outer join host_ip_address hip on h.public_id = hip.host_id
left outer join host_dns_name hdns on h.public_id = hdns.host_id
left outer join host_plugin_set_member hpsm on h.public_id = hpsm.host_id
group by h.public_id, hc.plugin_id, hc.project_id;
comment on view host_plugin_host_with_value_obj_and_set_memberships is
'host plugin host with its associated value objects';
commit;