You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@devlake.apache.org by "klesh (via GitHub)" <gi...@apache.org> on 2023/05/19 02:45:36 UTC

[GitHub] [incubator-devlake] klesh opened a new issue, #5235: [Feature][installation] Fix the `encKey` `ENCODE_KEY` complication once and for all

klesh opened a new issue, #5235:
URL: https://github.com/apache/incubator-devlake/issues/5235

   ### Search before asking
   
   - [X] I had searched in the [issues](https://github.com/apache/incubator-devlake/issues?q=is%3Aissue) and found no similar feature requirement.
   
   
   ### Use case
   
   As a user, I would like to upgrade the `devlake` smoothly without losing my data.
   
   ### Description
   
   ### Why do we need it?
   The `encKey` or `ENCODE_KEY` was introduced a long time ago to encrypt sensitive information (e.g. access token, password, etc) stored in the database.
   
   ### What went wrong?
   We decided to generate the encryption key and save it to the `.env` file automatically on the first boot if it was omitted in order to make the installation process smoother.
   
   However, it has been proven problematic along the way:
   
   1. bad naming
   2. the `devlake` container must be deployed as a `stateful` set, since we have to write the key back to the `.env` file
   3. users often do not aware of the key and run into `encKey` after upgrading if they chose to deploy a completely new instance with the existing database
   
   ### What can we do about it?
   Users should be properly informed about the encryption key, and how should they do about it.
   
   ### Plan of attack
   1. Unify `encKey` `ENCODE_KEY` to `encryptionSecret` / `ENCRYPTION_SECRET` both codebase and documentation 
   2. Remove the auto-generate logic from our code base, `devlake` should fail if no `ENCRYPTION_SECRET` is provided
   3. Update the Installation Guide to specifically ask users to generate the `ENCRYPTION_SECRET` manually with some example command, and ask them to store it properly in case they want to deploy a brand new instance using the existing database.
   4. Deprecate the `.env` file and load all settings from Environment Variables instead
   5. Proceed issue https://github.com/apache/incubator-devlake-helm-chart/pull/130
   
   
   ### Related issues
   
   - https://github.com/apache/incubator-devlake-helm-chart/pull/130
   - https://github.com/apache/incubator-devlake-helm-chart/issues/133
   - Many others: https://github.com/apache/incubator-devlake/issues?q=is%3Aissue+enckey
   
   ### Are you willing to submit a PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [incubator-devlake] mindlesscloud closed issue #5235: [Feature][installation] Make `.env` file only read to fix the `encKey` `ENCODE_KEY` complication once and for all

Posted by "mindlesscloud (via GitHub)" <gi...@apache.org>.
mindlesscloud closed issue #5235: [Feature][installation] Make `.env` file only read to fix the `encKey` `ENCODE_KEY` complication once and for all
URL: https://github.com/apache/incubator-devlake/issues/5235


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [incubator-devlake] klesh commented on issue #5235: [Feature][installation] Make `.env` file only read to fix the `encKey` `ENCODE_KEY` complication once and for all

Posted by "klesh (via GitHub)" <gi...@apache.org>.
klesh commented on issue #5235:
URL: https://github.com/apache/incubator-devlake/issues/5235#issuecomment-1580030274

   @IronCore864 The `.env` file is optional now, we can now proceed to update the helm chart to use the user-generated `ENCRYPTION_SECRET` from Environment Variable, check https://github.com/apache/incubator-devlake-website/pull/550 for detail


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [incubator-devlake] mindlesscloud closed issue #5235: [Feature][installation] Deprecate `.env` file to fix the `encKey` `ENCODE_KEY` complication once and for all

Posted by "mindlesscloud (via GitHub)" <gi...@apache.org>.
mindlesscloud closed issue #5235: [Feature][installation] Deprecate `.env` file to fix the `encKey` `ENCODE_KEY` complication once and for all
URL: https://github.com/apache/incubator-devlake/issues/5235


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org