As a user already using database-level encryption, I don't want to have Pulp encrypt anything
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 598
- Forks
- 168
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 86
Description
Is your feature request related to a problem? Please describe.
I use AWS RDS as my database backend. Data is configured to use encryption at rest, and access to the database is authenticated. In an environment with servers as cattle, I would prefer not to have to maintain an encryption key at all, as I don't consider the field-level encryption to be a substantially significant security improvement.
Describe the solution you'd like
I would like a way to skip the field-level encryption in Pulp, ideally by specifying a configuration value
Describe alternatives you've considered
Pre-generating an encryption key and storing it as a k8s secret is not a terrible solution, as it could be mounted into the container as a file and could persist across container lifespan. That still means I have to back up the secret value somewhere (preferably alongside the database backup) for disaster recovery purposes. This whole problem is conveniently solved already by using AWS key management for the database and AWS-aware backup tooling, so it's not great to have an application reinvent my wheels. :)
Additional context
Refs #1301 and indirectly also #2048
PR coming shortly :)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Pulp's field-level encryption behavior and the related context in issues #1301 and #2048. Done means a configuration option allows field-level encryption to be skipped while the database continues to operate normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100