Skip to content

Commit c477750

Browse files
eriktateeriktate
committed
adding cache for RecordingEncryption
1 parent 5f70d06 commit c477750

File tree

13 files changed

+261
-8
lines changed

13 files changed

+261
-8
lines changed

‎api/client/events.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
3030
notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
3131
provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
32+
recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
3233
accessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
3334
userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
3435
usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
@@ -156,6 +157,10 @@ func EventToGRPC(in types.Event) (*proto.Event, error) {
156157
out.Resource = &proto.Event_WorkloadIdentityX509Revocation{
157158
WorkloadIdentityX509Revocation: r.UnwrapT(),
158159
}
160+
case types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]:
161+
out.Resource = &proto.Event_RecordingEncryption{
162+
RecordingEncryption: r.UnwrapT(),
163+
}
159164
case types.Resource153UnwrapperT[*healthcheckconfigv1.HealthCheckConfig]:
160165
out.Resource = &proto.Event_HealthCheckConfig{
161166
HealthCheckConfig: r.UnwrapT(),
@@ -652,6 +657,9 @@ func EventFromGRPC(in *proto.Event) (*types.Event, error) {
652657
} else if r := in.GetHealthCheckConfig(); r != nil {
653658
out.Resource = types.Resource153ToLegacy(r)
654659
return &out, nil
660+
} else if r := in.GetRecordingEncryption(); r != nil {
661+
out.Resource = types.Resource153ToLegacy(r)
662+
return &out, nil
655663
} else {
656664
return nil, trace.BadParameter("received unsupported resource %T", in.Resource)
657665
}

‎api/client/proto/event.pb.go

Lines changed: 29 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/proto/teleport/legacy/client/proto/event.proto

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import "teleport/machineid/v1/bot_instance.proto";
3131
import "teleport/machineid/v1/federation.proto";
3232
import "teleport/notifications/v1/notifications.proto";
3333
import "teleport/provisioning/v1/provisioning.proto";
34+
import "teleport/recordingencryption/v1/recording_encryption.proto";
3435
import "teleport/scopes/access/v1/assignment.proto";
3536
import "teleport/scopes/access/v1/role.proto";
3637
import "teleport/secreports/v1/secreports.proto";
@@ -225,5 +226,7 @@ message Event {
225226
teleport.scopes.access.v1.ScopedRole ScopedRole = 80;
226227
// ScopedRoleAssignment is an assignment of one or more scoped roles to a user.
227228
teleport.scopes.access.v1.ScopedRoleAssignment ScopedRoleAssignment = 81;
229+
// RecordingEncryption is a resource for controlling session recording encryption.
230+
teleport.recordingencryption.v1.RecordingEncryption RecordingEncryption = 82;
228231
}
229232
}

‎lib/auth/accesspoint/accesspoint.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ type Config struct {
111111
PluginStaticCredentials services.PluginStaticCredentials
112112
GitServers services.GitServers
113113
HealthCheckConfig services.HealthCheckConfigReader
114+
RecordingEncryption services.RecordingEncryption
114115
}
115116

116117
func (c *Config) CheckAndSetDefaults() error {
@@ -211,6 +212,7 @@ func NewCache(cfg Config) (*cache.Cache, error) {
211212
PluginStaticCredentials: cfg.PluginStaticCredentials,
212213
GitServers: cfg.GitServers,
213214
HealthCheckConfig: cfg.HealthCheckConfig,
215+
RecordingEncryption: cfg.RecordingEncryption,
214216
}
215217

216218
return cache.New(cfg.Setup(cacheCfg))

‎lib/auth/init.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ type RecordingEncryptionManager interface {
9292
services.RecordingEncryption
9393
recordingencryption.Resolver
9494
recordingencryption.DecryptionKeyFinder
95+
SetCache(cache recordingencryption.Cache)
9596
}
9697

9798
// InitConfig is auth server init config

‎lib/auth/recordingencryption/manager.go

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,21 +46,30 @@ type KeyStore interface {
4646
GetDecrypter(ctx context.Context, keyPair *types.EncryptionKeyPair) (crypto.Decrypter, error)
4747
}
4848

49+
// A Cache fetches a cached *recordingencryptionv1.RecordingEncryption
50+
type Cache interface {
51+
GetRecordingEncryption(context.Context) (*recordingencryptionv1.RecordingEncryption, error)
52+
}
53+
4954
// ManagerConfig captures all of the dependencies required to instantiate a Manager.
5055
type ManagerConfig struct {
5156
Backend services.RecordingEncryption
57+
Cache Cache
5258
KeyStore KeyStore
5359
Logger *slog.Logger
5460
LockConfig backend.RunWhileLockedConfig
5561
}
5662

5763
// NewManager returns a new Manager using the given ManagerConfig.
5864
func NewManager(cfg ManagerConfig) (*Manager, error) {
65+
5966
switch {
6067
case cfg.Backend == nil:
6168
return nil, trace.BadParameter("backend is required")
6269
case cfg.KeyStore == nil:
6370
return nil, trace.BadParameter("key store is required")
71+
case cfg.Cache == nil:
72+
return nil, trace.BadParameter("cache is required")
6473
}
6574

6675
if cfg.Logger == nil {
@@ -72,6 +81,7 @@ func NewManager(cfg ManagerConfig) (*Manager, error) {
7281
keyStore: cfg.KeyStore,
7382
lockConfig: cfg.LockConfig,
7483
logger: cfg.Logger,
84+
cache: cfg.Cache,
7585
}, nil
7686
}
7787

@@ -84,6 +94,12 @@ type Manager struct {
8494
logger *slog.Logger
8595
lockConfig backend.RunWhileLockedConfig
8696
keyStore KeyStore
97+
cache Cache
98+
}
99+
100+
// SetCache overwrites the configured Cache implementation
101+
func (m *Manager) SetCache(cache Cache) {
102+
m.cache = cache
87103
}
88104

89105
// ensureActiveRecordingEncryption returns the configured RecordingEncryption resource if it exists with active keys. If it does not,
@@ -308,7 +324,7 @@ func (m *Manager) searchActiveKeys(ctx context.Context, activeKeys []*recordinge
308324
// FindDecryptionKey returns the first accessible decryption key that matches one of the given public keys.
309325
func (m *Manager) FindDecryptionKey(publicKeys ...[]byte) (*types.EncryptionKeyPair, error) {
310326
ctx := context.Background()
311-
encryption, err := m.GetRecordingEncryption(ctx)
327+
encryption, err := m.cache.GetRecordingEncryption(ctx)
312328
if err != nil {
313329
return nil, trace.Wrap(err)
314330
}

‎lib/auth/recordingencryption/manager_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ func newManagerConfig(bk backend.Backend, local services.RecordingEncryption, ke
124124
Backend: local,
125125
KeyStore: &fakeEncryptionKeyStore{keyType: keyType},
126126
Logger: utils.NewSlogLoggerForTests(),
127+
Cache: local,
127128
LockConfig: backend.RunWhileLockedConfig{
128129
LockConfiguration: backend.LockConfiguration{
129130
Backend: bk,

‎lib/cache/cache.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,7 @@ func ForAuth(cfg Config) Config {
208208
{Kind: types.KindGitServer},
209209
{Kind: types.KindWorkloadIdentity},
210210
{Kind: types.KindHealthCheckConfig},
211+
{Kind: types.KindRecordingEncryption},
211212
}
212213
cfg.QueueSize = defaults.AuthQueueSize
213214
// We don't want to enable partial health for auth cache because auth uses an event stream
@@ -739,6 +740,8 @@ type Config struct {
739740
GitServers services.GitServerGetter
740741
// HealthCheckConfig is a health check config service.
741742
HealthCheckConfig services.HealthCheckConfigReader
743+
// RecordingEncryption manages state surrounding session recording encryption
744+
RecordingEncryption services.RecordingEncryption
742745
}
743746

744747
// CheckAndSetDefaults checks parameters and sets default values

‎lib/cache/cache_test.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ import (
5454
machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
5555
notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
5656
provisioningv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/provisioning/v1"
57+
recordingencryptionv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/recordingencryption/v1"
5758
accessv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/scopes/access/v1"
5859
userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v2"
5960
usertasksv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/usertasks/v1"
@@ -148,6 +149,7 @@ type testPack struct {
148149
gitServers *local.GitServerService
149150
workloadIdentity *local.WorkloadIdentityService
150151
healthCheckConfig *local.HealthCheckConfigService
152+
recordingEncryption *local.RecordingEncryptionService
151153
}
152154

153155
// testFuncs are functions to support testing an object in a cache.
@@ -426,6 +428,11 @@ func newPackWithoutCache(dir string, opts ...packOption) (*testPack, error) {
426428
return nil, trace.Wrap(err)
427429
}
428430

431+
p.recordingEncryption, err = local.NewRecordingEncryptionService(p.backend)
432+
if err != nil {
433+
return nil, trace.Wrap(err)
434+
}
435+
429436
return p, nil
430437
}
431438

@@ -482,6 +489,7 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
482489
GitServers: p.gitServers,
483490
HealthCheckConfig: p.healthCheckConfig,
484491
WorkloadIdentity: p.workloadIdentity,
492+
RecordingEncryption: p.recordingEncryption,
485493
MaxRetryPeriod: 200 * time.Millisecond,
486494
EventsC: p.eventsC,
487495
}))
@@ -751,6 +759,7 @@ func TestCompletenessInit(t *testing.T) {
751759
AutoUpdateService: p.autoUpdateService,
752760
ProvisioningStates: p.provisioningStates,
753761
WorkloadIdentity: p.workloadIdentity,
762+
RecordingEncryption: p.recordingEncryption,
754763
MaxRetryPeriod: 200 * time.Millisecond,
755764
IdentityCenter: p.identityCenter,
756765
PluginStaticCredentials: p.pluginStaticCredentials,
@@ -840,6 +849,7 @@ func TestCompletenessReset(t *testing.T) {
840849
IdentityCenter: p.identityCenter,
841850
PluginStaticCredentials: p.pluginStaticCredentials,
842851
WorkloadIdentity: p.workloadIdentity,
852+
RecordingEncryption: p.recordingEncryption,
843853
MaxRetryPeriod: 200 * time.Millisecond,
844854
EventsC: p.eventsC,
845855
GitServers: p.gitServers,
@@ -997,6 +1007,7 @@ func TestListResources_NodesTTLVariant(t *testing.T) {
9971007
IdentityCenter: p.identityCenter,
9981008
PluginStaticCredentials: p.pluginStaticCredentials,
9991009
WorkloadIdentity: p.workloadIdentity,
1010+
RecordingEncryption: p.recordingEncryption,
10001011
MaxRetryPeriod: 200 * time.Millisecond,
10011012
EventsC: p.eventsC,
10021013
neverOK: true, // ensure reads are never healthy
@@ -1095,6 +1106,7 @@ func initStrategy(t *testing.T) {
10951106
IdentityCenter: p.identityCenter,
10961107
PluginStaticCredentials: p.pluginStaticCredentials,
10971108
WorkloadIdentity: p.workloadIdentity,
1109+
RecordingEncryption: p.recordingEncryption,
10981110
MaxRetryPeriod: 200 * time.Millisecond,
10991111
EventsC: p.eventsC,
11001112
GitServers: p.gitServers,
@@ -1855,6 +1867,7 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
18551867
types.KindPluginStaticCredentials: &types.PluginStaticCredentialsV1{},
18561868
types.KindGitServer: &types.ServerV2{},
18571869
types.KindWorkloadIdentity: types.Resource153ToLegacy(newWorkloadIdentity("some_identifier")),
1870+
types.KindRecordingEncryption: types.Resource153ToLegacy(newRecordingEncryption()),
18581871
types.KindHealthCheckConfig: types.Resource153ToLegacy(newHealthCheckConfig(t, "some-name")),
18591872
scopedrole.KindScopedRole: types.Resource153ToLegacy(&accessv1.ScopedRole{}),
18601873
scopedrole.KindScopedRoleAssignment: types.Resource153ToLegacy(&accessv1.ScopedRoleAssignment{}),
@@ -1897,6 +1910,8 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
18971910
require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*autoupdate.AutoUpdateVersion]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
18981911
case types.Resource153UnwrapperT[*autoupdate.AutoUpdateConfig]:
18991912
require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*autoupdate.AutoUpdateConfig]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
1913+
case types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]:
1914+
require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*recordingencryptionv1.RecordingEncryption]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
19001915
case types.Resource153UnwrapperT[*userprovisioningpb.StaticHostUser]:
19011916
require.Empty(t, cmp.Diff(resource.(types.Resource153UnwrapperT[*userprovisioningpb.StaticHostUser]).UnwrapT(), uw.UnwrapT(), protocmp.Transform()))
19021917
case types.Resource153UnwrapperT[*machineidv1.SPIFFEFederation]:

0 commit comments

Comments
 (0)