Skip to content

Commit 6635827

Browse files
tobyhedetobyhede
authored
Merge pull request #119 from cipherstash/remove-zero-downtime-migration-workflow
EQL: remove zero-downtime migration workflow
2 parents cb97c93 + 3093e28 commit 6635827

File tree

4 files changed

+64
-19
lines changed

4 files changed

+64
-19
lines changed

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,9 @@ SELECT eql_v2.add_column('users', 'encrypted_email');
9898

9999
**Note:** This function allows you to encrypt and decrypt data but does not enable searchable encryption. See [Searching data with EQL](#searching-data-with-eql) for enabling searchable encryption.
100100

101+
<!--
102+
NOTE: NO LONGER REQUIRED
103+
DOCUMENTATION CAN BE UPDATED WHEN/IF ZERO DOWNTIME SUPPORT IS ADDED TO PROXY
101104
### Activating configuration
102105
103106
After modifying configurations, activate them by running:
@@ -106,6 +109,7 @@ After modifying configurations, activate them by running:
106109
SELECT eql_v2.migrate_config();
107110
SELECT eql_v2.activate_config();
108111
```
112+
-->
109113

110114
**Important:** These functions must be run after any modifications to the configuration.
111115

‎src/config/config_test.sql‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ DO $$
2525
BEGIN
2626

2727
-- Add indexes
28-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
28+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
2929
ASSERT (SELECT _search_config_exists('users', 'name', 'match'));
3030

3131
-- Add index with cast
32-
PERFORM eql_v2.add_search_config('users', 'name', 'unique', 'int');
32+
PERFORM eql_v2.add_search_config('users', 'name', 'unique', 'int', migrating => true);
3333
ASSERT (SELECT _search_config_exists('users', 'name', 'unique'));
3434

3535
ASSERT (SELECT EXISTS (SELECT id FROM eql_v2_configuration c
@@ -60,15 +60,15 @@ DO $$
6060
BEGIN
6161

6262
-- Add indexes
63-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
63+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
6464
ASSERT (SELECT _search_config_exists('users', 'name', 'match'));
6565

6666
ASSERT (SELECT EXISTS (SELECT id FROM eql_v2_configuration c
6767
WHERE c.state = 'pending' AND
6868
c.data #> array['tables', 'users', 'name', 'indexes'] ? 'match'));
6969

7070
-- Add index with cast
71-
PERFORM eql_v2.add_search_config('blah', 'vtha', 'unique', 'int');
71+
PERFORM eql_v2.add_search_config('blah', 'vtha', 'unique', 'int', migrating => true);
7272
ASSERT (SELECT _search_config_exists('blah', 'vtha', 'unique'));
7373

7474
ASSERT (SELECT EXISTS (SELECT id FROM eql_v2_configuration c
@@ -107,11 +107,11 @@ $$ LANGUAGE plpgsql;
107107

108108
DO $$
109109
BEGIN
110-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
110+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
111111
ASSERT (SELECT _search_config_exists('users', 'name', 'match'));
112112

113113
-- Pending configuration contains the path `user/name.match.option`
114-
PERFORM eql_v2.modify_search_config('users', 'name', 'match', 'int', '{"option": "value"}'::jsonb);
114+
PERFORM eql_v2.modify_search_config('users', 'name', 'match', 'int', '{"option": "value"}'::jsonb, migrating => true);
115115
ASSERT (SELECT _search_config_exists('users', 'name', 'match'));
116116

117117
ASSERT (SELECT EXISTS (SELECT id FROM eql_v2_configuration c
@@ -162,7 +162,7 @@ DO $$
162162
BEGIN
163163
ASSERT (SELECT _search_config_exists('users', 'blah', 'match', 'active'));
164164

165-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
165+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
166166

167167
-- index added to name
168168
ASSERT (SELECT _search_config_exists('users', 'name', 'match' ));
@@ -205,15 +205,15 @@ DO $$
205205
-- reset the table
206206
PERFORM create_table_with_encrypted();
207207

208-
PERFORM eql_v2.add_column('encrypted', 'e');
208+
PERFORM eql_v2.add_column('encrypted', 'e', migrating => true);
209209

210210
PERFORM assert_count(
211211
'Pending configuration was created',
212212
'SELECT * FROM eql_v2_configuration c WHERE c.state = ''pending''',
213213
1);
214214

215215

216-
PERFORM eql_v2.remove_column('encrypted', 'e');
216+
PERFORM eql_v2.remove_column('encrypted', 'e', migrating => true);
217217

218218
PERFORM assert_no_result(
219219
'Pending configuration was removed',

‎src/config/functions.sql‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
-- REQUIRE: src/config/types.sql
22
-- REQUIRE: src/config/functions_private.sql
3-
--
3+
-- REQUIRE: src/encrypted/functions.sql
4+
5+
46
-- Customer-facing configuration functions
57
-- Depends on private functions for implemenation
68
--
@@ -10,7 +12,7 @@
1012
-- Adds an index term to the configuration
1113
--
1214

13-
CREATE FUNCTION eql_v2.add_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}')
15+
CREATE FUNCTION eql_v2.add_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}', migrating boolean DEFAULT false)
1416
RETURNS jsonb
1517

1618
AS $$
@@ -54,6 +56,13 @@ AS $$
5456
DO UPDATE
5557
SET data = _config;
5658

59+
IF NOT migrating THEN
60+
PERFORM eql_v2.migrate_config();
61+
PERFORM eql_v2.activate_config();
62+
END IF;
63+
64+
-- PERFORM eql_v2.add_encrypted_constraint(table_name, column_name);
65+
5766
-- exeunt
5867
RETURN _config;
5968
END;
@@ -121,12 +130,12 @@ $$ LANGUAGE plpgsql;
121130

122131

123132

124-
CREATE FUNCTION eql_v2.modify_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}')
133+
CREATE FUNCTION eql_v2.modify_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}', migrating boolean DEFAULT false)
125134
RETURNS jsonb
126135
AS $$
127136
BEGIN
128137
PERFORM eql_v2.remove_search_config(table_name, column_name, index_name);
129-
RETURN eql_v2.add_search_config(table_name, column_name, index_name, cast_as, opts);
138+
RETURN eql_v2.add_search_config(table_name, column_name, index_name, cast_as, opts, migrating);
130139
END;
131140
$$ LANGUAGE plpgsql;
132141

@@ -200,7 +209,7 @@ $$ LANGUAGE plpgsql;
200209

201210

202211

203-
CREATE FUNCTION eql_v2.add_column(table_name text, column_name text, cast_as text DEFAULT 'text')
212+
CREATE FUNCTION eql_v2.add_column(table_name text, column_name text, cast_as text DEFAULT 'text', migrating boolean DEFAULT false)
204213
RETURNS jsonb
205214
AS $$
206215
DECLARE
@@ -231,6 +240,11 @@ AS $$
231240
DO UPDATE
232241
SET data = _config;
233242

243+
IF NOT migrating THEN
244+
PERFORM eql_v2.migrate_config();
245+
PERFORM eql_v2.activate_config();
246+
END IF;
247+
234248
PERFORM eql_v2.add_encrypted_constraint(table_name, column_name);
235249

236250
-- exeunt
@@ -240,7 +254,7 @@ $$ LANGUAGE plpgsql;
240254

241255

242256

243-
CREATE FUNCTION eql_v2.remove_column(table_name text, column_name text)
257+
CREATE FUNCTION eql_v2.remove_column(table_name text, column_name text, migrating boolean DEFAULT false)
244258
RETURNS jsonb
245259
AS $$
246260
DECLARE
@@ -289,6 +303,11 @@ AS $$
289303

290304
PERFORM eql_v2.remove_encrypted_constraint(table_name, column_name);
291305

306+
IF NOT migrating THEN
307+
PERFORM eql_v2.migrate_config();
308+
PERFORM eql_v2.activate_config();
309+
END IF;
310+
292311
-- exeunt
293312
RETURN _config;
294313

‎src/encryptindex/functions_test.sql‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -154,16 +154,38 @@ CREATE TABLE users
154154
-- An encrypting config should exist
155155
DO $$
156156
BEGIN
157-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
157+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
158158
PERFORM eql_v2.migrate_config();
159-
160159
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
161160
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'encrypting'));
162161
ASSERT (SELECT NOT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'pending'));
163162
END;
164163
$$ LANGUAGE plpgsql;
165164

166165

166+
-- Encrypting config without `migrating = true` is immediately active
167+
DO $$
168+
BEGIN
169+
TRUNCATE TABLE eql_v2_configuration;
170+
PERFORM eql_v2.add_search_config('users', 'name', 'match');
171+
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
172+
END;
173+
$$ LANGUAGE plpgsql;
174+
175+
176+
-- migrate_config() should raise an exception when no pending configuration exists
177+
DO $$
178+
BEGIN
179+
TRUNCATE TABLE eql_v2_configuration;
180+
PERFORM eql_v2.add_search_config('users', 'name', 'match');
181+
182+
PERFORM assert_exception(
183+
'eql_v2.migrate_config() should raise an exception when no pending configuration exists',
184+
'SELECT eql_v2.migrate_config()'
185+
);
186+
END;
187+
$$ LANGUAGE plpgsql;
188+
167189
-- -----------------------------------------------
168190
-- With existing active config and an updated schema using a raw JSONB column
169191
-- Start encryptindexing
@@ -204,7 +226,7 @@ CREATE TABLE users
204226
-- An encrypting config should exist
205227
DO $$
206228
BEGIN
207-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
229+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
208230
PERFORM eql_v2.migrate_config();
209231

210232
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
@@ -254,7 +276,7 @@ CREATE TABLE users
254276
-- An encrypting config should exist
255277
DO $$
256278
BEGIN
257-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
279+
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
258280

259281
PERFORM eql_v2.migrate_config(); -- need to encrypt first
260282
PERFORM eql_v2.activate_config();

0 commit comments

Comments
 (0)