PMM-13129 Encryption.

.github/workflows/main.yml

@@ -16,6 +16,9 @@ jobs:
     name: Checks
     runs-on: ubuntu-22.04
 
+    env:
+      PMM_ENCRYPTION_KEY_PATH: pmm-encryption.key
+
     steps:
       - name: Check out code
         uses: actions/checkout@v4

go.mod

@@ -40,6 +40,7 @@ require (
 	github.com/go-sql-driver/mysql v1.7.1
 	github.com/gogo/status v1.1.1
 	github.com/golang-migrate/migrate/v4 v4.17.0
+	github.com/google/tink/go v1.7.0
 	github.com/google/uuid v1.6.0
 	github.com/grafana/grafana-api-golang-client v0.27.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
@@ -98,7 +99,6 @@ require (
 	github.com/google/btree v1.0.0 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-msgpack/v2 v2.1.1 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/miekg/dns v1.1.41 // indirect

go.sum

@@ -232,6 +232,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
+github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
 github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

managed/Makefile

@@ -37,7 +37,6 @@ clean:                          ## Remove generated files
 
 release:                        ## Build pmm-managed release binaries
 	env CGO_ENABLED=0 go build -v $(PMM_LD_FLAGS) -o $(PMM_RELEASE_PATH)/ ./cmd/...
-	$(PMM_RELEASE_PATH)/pmm-managed --version
 
 release-starlark:
 	env CGO_ENABLED=0 go build -v $(PMM_LD_FLAGS) -o $(PMM_RELEASE_PATH)/ ./cmd/pmm-managed-starlark/...

managed/models/agent_helpers.go

@@ -229,7 +229,8 @@
 
 	agents := make([]*Agent, len(structs))
 	for i, s := range structs {
-		agents[i] = s.(*Agent) //nolint:forcetypeassert
+		decryptedAgent := DecryptAgent(*s.(*Agent)) //nolint:forcetypeassert
+		agents[i] = &decryptedAgent
 	}
 
 	return agents, nil
@@ -249,8 +250,9 @@
 		}
 		return nil, errors.WithStack(err)
 	}
+	decryptedAgent := DecryptAgent(*agent)
 
-	return agent, nil
+	return &decryptedAgent, nil
 }
 
 // FindAgentsByIDs finds Agents by IDs.
@@ -272,7 +274,8 @@
 
 	res := make([]*Agent, len(structs))
 	for i, s := range structs {
-		res[i] = s.(*Agent) //nolint:forcetypeassert
+		decryptedAgent := DecryptAgent(*s.(*Agent)) //nolint:forcetypeassert
+		res[i] = &decryptedAgent
 	}
 	return res, nil
 }
@@ -323,7 +326,8 @@
 
 	res := make([]*Agent, len(structs))
 	for i, s := range structs {
-		res[i] = s.(*Agent) //nolint:forcetypeassert
+		decryptedAgent := DecryptAgent(*s.(*Agent)) //nolint:forcetypeassert
+		res[i] = &decryptedAgent
 	}
 
 	if len(res) == 0 {
@@ -350,8 +354,8 @@
 
 	res := make([]*Agent, 0, len(structs))
 	for _, str := range structs {
-		row := str.(*Agent) //nolint:forcetypeassert
-		res = append(res, row)
+		decryptedAgent := DecryptAgent(*str.(*Agent)) //nolint:forcetypeassert
+		res = append(res, &decryptedAgent)
 	}
 
 	return res, nil
@@ -395,8 +399,8 @@
 	}
 	res := make([]*Agent, 0, len(pmmAgentRecords))
 	for _, str := range pmmAgentRecords {
-		row := str.(*Agent) //nolint:forcetypeassert
-		res = append(res, row)
+		decryptedAgent := DecryptAgent(*str.(*Agent)) //nolint:forcetypeassert
+		res = append(res, &decryptedAgent)
 	}
 
 	return res, nil
@@ -477,7 +481,8 @@
 
 	res := make([]*Agent, len(allAgents))
 	for i, s := range allAgents {
-		res[i] = s.(*Agent) //nolint:forcetypeassert
+		decryptedAgent := DecryptAgent(*s.(*Agent)) //nolint:forcetypeassert
+		res[i] = &decryptedAgent
 	}
 	return res, nil
 }
@@ -598,7 +603,7 @@
 
 // CreatePMMAgent creates PMMAgent.
 func CreatePMMAgent(q *reform.Querier, runsOnNodeID string, customLabels map[string]string) (*Agent, error) {
 	id := "/agent_id/" + uuid.New().String()
 	return createPMMAgentWithID(q, id, runsOnNodeID, customLabels)
 }
 
@@ -624,8 +629,8 @@
 		return nil, err
 	}
 	if !IsPushMetricsSupported(pmmAgent.Version) {
 		return nil, status.Errorf(codes.FailedPrecondition, "cannot use push_metrics_enabled with pmm_agent version=%q,"+
 			" it doesn't support it, minimum supported version=%q", pointer.GetString(pmmAgent.Version), PMMAgentWithPushMetricsSupport.String())
 	}
 	row := &Agent{
 		AgentID:            id,
@@ -641,11 +646,13 @@
 	if err := row.SetCustomLabels(customLabels); err != nil {
 		return nil, err
 	}
-	if err := q.Insert(row); err != nil {
+
+	encryptedAgent := EncryptAgent(*row)
+	if err := q.Insert(&encryptedAgent); err != nil {
 		return nil, errors.WithStack(err)
 	}
 
-	return row, nil
+	return &encryptedAgent, nil
 }
 
 // CreateExternalExporterParams params for add external exporter.
@@ -725,11 +732,13 @@
 	if err := row.SetCustomLabels(params.CustomLabels); err != nil {
 		return nil, err
 	}
-	if err := q.Insert(row); err != nil {
+
+	encryptedAgent := EncryptAgent(*row)
+	if err := q.Insert(&encryptedAgent); err != nil {
 		return nil, errors.WithStack(err)
 	}
 
-	return row, nil
+	return &encryptedAgent, nil
 }
 
 // CreateAgentParams params for add common exporter.
@@ -912,15 +921,16 @@
 		DisabledCollectors:             params.DisableCollectors,
 		LogLevel:                       pointer.ToStringOrNil(params.LogLevel),
 	}
-
 	if err := row.SetCustomLabels(params.CustomLabels); err != nil {
 		return nil, err
 	}
-	if err := q.Insert(row); err != nil {
+
+	encryptedAgent := EncryptAgent(*row)
+	if err := q.Insert(&encryptedAgent); err != nil {
 		return nil, errors.WithStack(err)
 	}
 
-	return row, nil
+	return &encryptedAgent, nil
 }
 
 // ChangeCommonAgentParams contains parameters that can be changed for all Agents.

managed/models/database.go

@@ -27,6 +27,7 @@ import (
 	"net"
 	"net/url"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -36,6 +37,8 @@ import (
 	"google.golang.org/grpc/status"
 	"gopkg.in/reform.v1"
 	"gopkg.in/reform.v1/dialects/postgresql"
+
+	"github.com/percona/pmm/managed/utils/encryption"
 )
 
 const (
@@ -1059,12 +1062,85 @@ func SetupDB(ctx context.Context, sqlDB *sql.DB, params SetupDBParams) (*reform.
 		return nil, errCV
 	}
 
-	if err := migrateDB(db, params); err != nil {
+	agentColumnsToEncrypt := []encryption.Column{
+		{Name: "password"},
+		{Name: "aws_secret_key"},
+		{Name: "mongo_db_tls_options", CustomHandler: EncryptMongoDBOptionsHandler},
+		{Name: "azure_options", CustomHandler: EncryptAzureOptionsHandler},
+		{Name: "mysql_options", CustomHandler: EncryptMySQLOptionsHandler},
+		{Name: "postgresql_options", CustomHandler: EncryptPostgreSQLOptionsHandler},
+		{Name: "agent_password"},
+	}
+
+	itemsToEncrypt := []encryption.Table{
+		{
+			Name:        "agents",
+			Identifiers: []string{"agent_id"},
+			Columns:     agentColumnsToEncrypt,
+		},
+	}
+
+	if err := migrateDB(db, params, itemsToEncrypt); err != nil {
 		return nil, err
 	}
+
 	return db, nil
 }
 
+// EncryptDB encrypts a set of columns in a specific database and table.
+func EncryptDB(tx *reform.TX, params SetupDBParams, itemsToEncrypt []encryption.Table) error {
+	if len(itemsToEncrypt) == 0 {
+		return nil
+	}
+
+	settings, err := GetSettings(tx)
+	if err != nil {
+		return err
+	}
+	alreadyEncrypted := make(map[string]bool)
+	for _, v := range settings.EncryptedItems {
+		alreadyEncrypted[v] = true
+	}
+
+	notEncrypted := []encryption.Table{}
+	newlyEncrypted := []string{}
+	for _, table := range itemsToEncrypt {
+		columns := []encryption.Column{}
+		for _, column := range table.Columns {
+			dbTableColumn := fmt.Sprintf("%s.%s.%s", params.Name, table.Name, column.Name)
+			if alreadyEncrypted[dbTableColumn] {
+				continue
+			}
+
+			columns = append(columns, column)
+			newlyEncrypted = append(newlyEncrypted, dbTableColumn)
+		}
+		if len(columns) == 0 {
+			continue
+		}
+
+		table.Columns = columns
+		notEncrypted = append(notEncrypted, table)
+	}
+
+	if len(notEncrypted) == 0 {
+		return nil
+	}
+
+	err = encryption.EncryptItems(tx, notEncrypted)
+	if err != nil {
+		return err
+	}
+	_, err = UpdateSettings(tx, &ChangeSettingsParams{
+		EncryptedItems: slices.Concat(settings.EncryptedItems, newlyEncrypted),
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // checkVersion checks minimal required PostgreSQL server version.
 func checkVersion(ctx context.Context, db reform.DBTXContext) error {
 	PGVersion, err := GetPostgreSQLVersion(ctx, db)
@@ -1124,7 +1200,7 @@ func initWithRoot(params SetupDBParams) error {
 }
 
 // migrateDB runs PostgreSQL database migrations.
-func migrateDB(db *reform.DB, params SetupDBParams) error {
+func migrateDB(db *reform.DB, params SetupDBParams, itemsToEncrypt []encryption.Table) error {
 	var currentVersion int
 	errDB := db.QueryRow("SELECT id FROM schema_migrations ORDER BY id DESC LIMIT 1").Scan(&currentVersion)
 	// undefined_table (see https://www.postgresql.org/docs/current/errcodes-appendix.html)
@@ -1160,6 +1236,11 @@ func migrateDB(db *reform.DB, params SetupDBParams) error {
 			}
 		}
 
+		err := EncryptDB(tx, params, itemsToEncrypt)
+		if err != nil {
+			return err
+		}
+
 		if params.SetupFixtures == SkipFixtures {
 			return nil
 		}
@@ -1173,17 +1254,16 @@ func migrateDB(db *reform.DB, params SetupDBParams) error {
 			return err
 		}
 
-		if err = setupFixture1(tx.Querier, params); err != nil {
-			return err
-		}
-		if err = setupFixture2(tx.Querier, params.Username, params.Password); err != nil {
+		err = setupPMMServerAgents(tx.Querier, params)
+		if err != nil {
 			return err
 		}
+
 		return nil
 	})
 }
 
-func setupFixture1(q *reform.Querier, params SetupDBParams) error {
+func setupPMMServerAgents(q *reform.Querier, params SetupDBParams) error {
 	// create PMM Server Node and associated Agents
 	node, err := createNodeWithID(q, PMMServerNodeID, GenericNodeType, &CreateNodeParams{
 		NodeName: "pmm-server",
@@ -1266,12 +1346,6 @@ func setupFixture1(q *reform.Querier, params SetupDBParams) error {
 	return nil
 }
 
-func setupFixture2(q *reform.Querier, username, password string) error { //nolint:revive
-	// TODO add clickhouse_exporter
-
-	return nil
-}
-
 // parsePGAddress parses PostgreSQL address into address:port; if no port specified returns default port number.
 func parsePGAddress(address string) (string, uint16, error) {
 	if !strings.Contains(address, ":") {

managed/models/database_test.go

@@ -21,7 +21,6 @@
 	"database/sql"
 	"fmt"
 	"testing"
-	"time"
 
 	"github.com/AlekSi/pointer"
 	"github.com/lib/pq"
@@ -74,7 +73,7 @@
 
 		// node_id
 		_, err = db.Exec(
 			"INSERT INTO nodes (node_id, node_type, node_name, distro, node_model, az, address, created_at, updated_at) "+
 				"VALUES ('1', 'generic', 'name', '', '', '', '', $1, $2)", now, now)
 		require.NoError(t, err)
 		_, err = db.Exec(
@@ -90,7 +89,7 @@
 
 		// machine_id for generic Node: https://jira.percona.com/browse/PMM-4196
 		_, err = db.Exec(
 			"INSERT INTO nodes (node_id, node_type, node_name, machine_id, distro, node_model, az, address, created_at, updated_at) "+
 				"VALUES ('31', 'generic', 'name31', 'machine-id', '', '', '', '', $1, $2)", now, now)
 		require.NoError(t, err)
 		_, err = db.Exec(
@@ -153,7 +152,7 @@
 
 		// Try to insert both address and socket
 		_, err = db.Exec(
 			"INSERT INTO services (service_id, service_type, service_name, node_id, environment, cluster, replication_set, address, port, socket, external_group, created_at, updated_at) "+
 				"VALUES ('/service_id/1', 'mysql', 'name', '/node_id/1', '', '', '', '10.10.10.10', 3306, '/var/run/mysqld/mysqld.sock', '', $1, $2)",
 			now, now)
 		require.Error(t, err, `pq: new row for relation "services" violates check constraint "address_socket_check"`)
@@ -281,7 +280,7 @@
 				defer rollback()
 
 				_, err = tx.Exec(
 					"INSERT INTO agents (agent_id, agent_type, runs_on_node_id, pmm_agent_id, node_id, service_id, disabled, status, created_at, updated_at, tls, tls_skip_verify, max_query_length, query_examples_disabled, comments_parsing_disabled, max_query_log_size, table_count_tablestats_group_limit, rds_basic_metrics_disabled, rds_enhanced_metrics_disabled, push_metrics, expose_exporter) "+
 						"VALUES ('/agent_id/8', 'node_exporter', NULL, '/agent_id/1', '/node_id/1', NULL, false, '', $1, $2, false, false, 0, false, true, 0, 0, false, false, false, false)",
 					now, now)
 
@@ -327,60 +326,6 @@
 }
 
 func TestDatabaseMigrations(t *testing.T) {
-	t.Run("Update metrics resolutions", func(t *testing.T) {
-		sqlDB := testdb.Open(t, models.SkipFixtures, pointer.ToInt(9))
-		defer sqlDB.Close() //nolint:errcheck
-		settings, err := models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		metricsResolutions := models.MetricsResolutions{
-			HR: 5 * time.Second,
-			MR: 5 * time.Second,
-			LR: 60 * time.Second,
-		}
-		settings.MetricsResolutions = metricsResolutions
-		err = models.SaveSettings(sqlDB, settings)
-		require.NoError(t, err)
-
-		settings, err = models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		require.Equal(t, metricsResolutions, settings.MetricsResolutions)
-
-		testdb.SetupDB(t, sqlDB, models.SkipFixtures, pointer.ToInt(10))
-		settings, err = models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		require.Equal(t, models.MetricsResolutions{
-			HR: 5 * time.Second,
-			MR: 10 * time.Second,
-			LR: 60 * time.Second,
-		}, settings.MetricsResolutions)
-	})
-	t.Run("Shouldn' update metrics resolutions if it's already changed", func(t *testing.T) {
-		sqlDB := testdb.Open(t, models.SkipFixtures, pointer.ToInt(9))
-		defer sqlDB.Close() //nolint:errcheck
-		settings, err := models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		metricsResolutions := models.MetricsResolutions{
-			HR: 1 * time.Second,
-			MR: 5 * time.Second,
-			LR: 60 * time.Second,
-		}
-		settings.MetricsResolutions = metricsResolutions
-		err = models.SaveSettings(sqlDB, settings)
-		require.NoError(t, err)
-
-		settings, err = models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		require.Equal(t, metricsResolutions, settings.MetricsResolutions)
-
-		testdb.SetupDB(t, sqlDB, models.SkipFixtures, pointer.ToInt(10))
-		settings, err = models.GetSettings(sqlDB)
-		require.NoError(t, err)
-		require.Equal(t, models.MetricsResolutions{
-			HR: 1 * time.Second,
-			MR: 5 * time.Second,
-			LR: 60 * time.Second,
-		}, settings.MetricsResolutions)
-	})
 	t.Run("stats_collections field migration: string to string array", func(t *testing.T) {
 		sqlDB := testdb.Open(t, models.SkipFixtures, pointer.ToInt(57))
 		defer sqlDB.Close() //nolint:errcheck