kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'aws_sse-c' into 'master'

Browse source 
Add SSE-C key configuration option for Amazon S3 remote backups

See merge request gitlab-org/gitlab-ce!23797
This commit is contained in:
James Lopez 2019-01-09 16:39:20 +00:00
commit 3f01f0c5b3
6 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
changelogs/unreleased/backup_aws_sse-c.yml Normal file
View file

@ -0,0 +1,5 @@
title: Add support for customer provided encryption keys for Amazon S3 remote backups
merge_request: 23797
author: Pepijn Van Eeckhoudt
type: added

4
config/gitlab.yml.example
View file

@ -635,6 +635,10 @@ production: &base
# multipart_chunk_size: 104857600
# # Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
# # encryption: 'AES256'
# # Turns on AWS Server-Side Encryption with Amazon Customer-Provided Encryption Keys for backups, this is optional
# # This should be set to the 256-bit, base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data.
# # 'encryption' must also be set in order for this to have any effect.
# # encryption_key: '<base64 key>'
# # Specifies Amazon S3 storage class to use for backups, this is optional
# # storage_class: 'STANDARD'

1
config/initializers/1_settings.rb
View file

@ -392,6 +392,7 @@ Settings.backup['archive_permissions'] ||= 0600
Settings.backup['upload'] ||= Settingslogic.new({ 'remote_directory' => nil, 'connection' => nil })
Settings.backup['upload']['multipart_chunk_size'] ||= 104857600
Settings.backup['upload']['encryption'] ||= nil
Settings.backup['upload']['encryption_key'] ||= ENV['GITLAB_BACKUP_ENCRYPTION_KEY']
Settings.backup['upload']['storage_class'] ||= nil
#

5
doc/raketasks/backup_restore.md
View file

@ -311,6 +311,11 @@ For installations from source:
remote_directory: 'my.s3.bucket'
# Turns on AWS Server-Side Encryption with Amazon S3-Managed Keys for backups, this is optional
# encryption: 'AES256'
# Turns on AWS Server-Side Encryption with Amazon Customer-Provided Encryption Keys for backups, this is optional
# This should be set to the base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data.
# 'encryption' must also be set in order for this to have any effect.
# To avoid storing the key on disk, the key can also be specified via the `GITLAB_BACKUP_ENCRYPTION_KEY` environment variable.
# encryption_key: '<base64 key>'
# Specifies Amazon S3 storage class to use for backups, this is optional
# storage_class: 'STANDARD'
```

1
lib/backup/manager.rb
View file

@ -50,6 +50,7 @@ module Backup
if directory.files.create(key: remote_target, body: File.open(tar_file), public: false,
multipart_chunk_size: Gitlab.config.backup.upload.multipart_chunk_size,
encryption: Gitlab.config.backup.upload.encryption,
encryption_key: Gitlab.config.backup.upload.encryption_key,
storage_class: Gitlab.config.backup.upload.storage_class)
progress.puts "done".color(:green)
else

1
spec/lib/backup/manager_spec.rb
View file

@ -266,6 +266,7 @@ describe Backup::Manager do
remote_directory: 'directory',
multipart_chunk_size: 104857600,
encryption: nil,
encryption_key: nil,
storage_class: nil
}
)