Enable encryption at rest for Secrets
- Dominant language
- Java
- Stars
- 2k
- Forks
- 370
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 19
Description
### Reason/Context
As of today, Secrets content is not encrypted when written into the MongoDB database. Of course, MongoDB communication can be secured using TLS and so on but encryption at rest is way better. We absolutely need to address this to provide better security guarantees to our adopters and users.
### Description
We should study how [Client-Side Field Level Encryption](https://www.mongodb.com/docs/v7.0/core/csfle/) or some other techniques can be enabled and used within Microcks. MongoDB encryption seems to be supported via [Spring Data MongoDB](https://docs.spring.io/spring-data/mongodb/reference/mongodb/mongo-encryption.html), the library we're using the communicate with Mongo.
### Implementation ideas
Any ideas from people having experience and/or interest on this field is more than welcome!
Contributor guide
Research direction
Start by studying the linked MongoDB Client-Side Field Level Encryption and Spring Data MongoDB references, then locate Microcks' Secrets persistence path. Compare the available approaches and determine how encryption can be enabled without breaking Secret access. Done means Secrets content is encrypted at rest in MongoDB and remains usable by the application.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mongodb, spring
- Domain
- backend, databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100