NC | NSFS | CLI | Make Update Account Tolerance to Missing Master Key #8236
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
shirady
changed the title
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
2 times, most recently
from
aebeaab
to
646b644
Compare
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
3 times, most recently
from
3bbee87
to
c429ba5
Compare
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
from
c429ba5
to
ed104eb
Compare
|
@romayalon I added the suggested changes. |
shirady
changed the title
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
4 times, most recently
from
5cb88ef
to
3952711
Compare
|
I Converted it to draft since there was an issue after rebase with the health tests. |
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
from
3952711
to
1fd4d1e
Compare
shirady
changed the title
Signed-off-by: shirady <[email protected]>
shirady
force-pushed
the
nsfs-nc-missing-master-key
branch
from
1fd4d1e
to
1ebcee4
Compare
romayalon
reviewed
Oct 14, 2024
| if (decrypt_secret_key) config_data.access_keys = await nc_mkm.decrypt_access_keys(config_data); | ||
| return config_data; | ||
| } catch (err) { | ||
| dbg.warn('get_identity_config_data: with config_file_path', config_file_path, 'got an error', err); | ||
| if (err.code === 'ENOENT' && silent_if_missing) return; | ||
| if (return_encrypted_if_decryption_fails && err.rpc_code === 'INVALID_MASTER_KEY') return config_data; |
There was a problem hiding this comment.
As we discussed,
This solution creates a new master key under the hood, which means it tries to solve a big issue (master key disappeared) without letting the customer know about it. I don't think this is how we should do that, let's take some time for design.
I'm worried about temporary failures that we will create a new master key instead of fixing the issue.
|
Closing for now - would need design (see this comment). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Explain the changes
regenerateandaccess_keyandsecret_key) when we cannot decrypt the current access keys.config_fsfix JSDoc of the functionget_identity_config_data.mamage_nsfsadd JSDoc to the functionfetch_existing_account_data.Issues: Fixed partially #8104
master_key_idpoints to a missing master key, the commands:account updateandaccount statusin noobaa-cli (manage_nsfs) will fail with an error.Note: A missing master key can happen when the master keys that were previously used cannot be recovered due to some issue.
Testing Instructions:
Unit Tests
Please run:
sudo npx jest test_nc_nsfs_bucket_cli.test.js(for the change in point number 2 in the changes above).sudo npx jest test_nc_account_invalid_mkm_integration.test.jsManual Testing
A. Missing master key
sudo node src/cmd/manage_nsfs account add --name shira-1001 --new_buckets_path /tmp/nsfs_root1 --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid>Note: before creating the account need to give permission to the
new_buckets_path:chmod 777 /tmp/nsfs_root1.master_key.json:sudo mv /etc/noobaa.conf.d/master_keys.json /etc/noobaa.conf.d/temp_master_keys.jsonsudo node src/cmd/manage_nsfs account list --wide --show_secrets(doesn't fail, but you will see the propertyencrypted_secret_key).sudo node src/cmd/manage_nsfs account status --name shira-1001 --show_secrets(will fail).sudo node src/cmd/manage_nsfs account update --name shira-1001 --regenerateorsudo node src/cmd/manage_nsfs account update --access_key <access-key-id> --secret_key <secret-key>.