{"push_id":3154065635,"size":2,"distinct_size":2,"ref":"refs/heads/automate-db-key-rotation-158179141","head":"43377853ef402ffb9cd51fa6ffaa3c6e48567a27","before":"967e1d709c45e42ff67805b4076aaacf34ddacca","commits":[{"sha":"8055dbd787211442ebacedae5dd7eddf8fca9256","author":{"name":"Hector Rivas Gandara","email":"cfdafbac99d2e35c247a9a77807e3052ab164d38@gmail.com"},"message":"Allow rotate CC database encryption key\n\nWe will implement a logic similar to the one implemented for\nthe jwt token[1]. The CC encryption key name would be a password itself\nthat would be rotated, called `cc_db_encryption_key_id`\n\nWe use the `cc_db_encryption_key_id_old` and `cc_db_encryption_key_old`\nto allow transit between key rotations.\n\nHere we add a dedicated job to rotate the DB keys, as it is a more\nsensitive task that will not be run as often. This task rotates\nthe database key `cc_db_encryption_key` and the id\n`cc_db_encryption_key_id` at the same time.\n\nWe need to also add cc_db_encryption_key_id as a secret to preserve\nduring the key rotation.\n\nWe move the related configuration of the vm_extension for the errand\ndefinition to the operations file including all the rotation\nconfig.\n\nWe also keep the original `encryption_key_0` that comes from\ncf-deployment, as it is the key that is being used in the deployments.\nThat key would keep using `((cc_db_encryption_key))` as a value.\nWe set as a new default key a new one with name\n`((cc_db_encryption_key_id))` and same value `((cc_db_encryption_key))`,\nso that the first deployment would migrate the DB encryption key\nfrom `encryption_key_0` to `((cc_db_encryption_key_id))`. After\nthe first deployment, we can also drop `encryption_key_0`.\n\n[1] https://github.com/alphagov/paas-cf/pull/1184","distinct":true,"url":"https://api.github.com/repos/alphagov/paas-cf/commits/8055dbd787211442ebacedae5dd7eddf8fca9256"},{"sha":"43377853ef402ffb9cd51fa6ffaa3c6e48567a27","author":{"name":"Hector Rivas Gandara","email":"cfdafbac99d2e35c247a9a77807e3052ab164d38@gmail.com"},"message":"Allow rotate UAA database encryption key\n\nWe will implement a logic similar to the one implemented for\nthe jwt token and the CC db encryption key.\n\nThe UAA encryption key name would be a password itself\nthat would be rotated, called `uaa_default_encryption_passphrase_id`\n\nWe use the `uaa_default_encryption_passphrase_id_old` and\n`uaa_default_encryption_passphrase_old` to allow transit\nbetween key rotations.\n\nWe add an errand to run the uaa_key_rotator job.\n\nHere we add the corresponding task to the job to rotate the DB keys.\nThis task must be run sequencially (under a `- do:` after the\nexisting CC db key rotation task, because the bosh errad adquires\na global lock on the manifest when running, meaning that only\none errand or deployment can run concurrently.\n\nWe need to also add uaa_default_encryption_passphrase_id as a secret\nto preserve during the key rotation.\n\nWe also keep the original `default_key` that comes from\ncf-deployment, as it is the key that is being used in the deployments.\nThat key would keep using `((uaa_default_encryption_passphrase))`\nas a value. We set as a new default key a new one with name\n`((uaa_default_encryption_passphrase_id))` and same value\n`((uaa_default_encryption_passphrase))`, so that the first deployment\nwould migrate the DB encryption key from `default_key` to\n`((uaa_default_encryption_passphrase_id))`.\nAfter the first deployment, we can also drop `default_key`.\n\n[1] https://github.com/alphagov/paas-cf/pull/1184","distinct":true,"url":"https://api.github.com/repos/alphagov/paas-cf/commits/43377853ef402ffb9cd51fa6ffaa3c6e48567a27"}]}
{"actor":{"display_login":"keymon"}}