ATLAS-5189: Encrypt postgres password #499
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Approach:-:
Encryption:
Use cputil.py tool to encrypt password for key "atlas.graph.storage.rdbms.jpa.hikari.password" which will be then stored in jceks file along with password and Atlas will decrypt using new method added as getDecryptedPassword and set it in hikari data source
Expectation:-:
Encrypt password for rdbms db
atlas.graph.storage.rdbms.jpa.hikari.username=atlas
atlas.graph.storage.rdbms.jpa.hikari.password=password(we should set it as ********)
1.When a user will add password property in application.properties manually we should encrypt the password and send it to postgres
we should avoid plaintext password
How was this patch tested?
Created jceks file using below command
-k is for key
-p password to encrypt
-f jceks file path
./cputil.py -k atlas.graph.storage.rdbms.jpa.hikari.password -p password -f jceks://file/home/project/forkbranch/atlas/rdbms.jceks
You should get below message
file:/home/project/forkbranch/atlas (exists=false, cwd=file:/home/chaitali/project/forkbranch/atlas/distro/target/apache-atlas-3.0.0-SNAPSHOT-bin/apache-atlas-3.0.0-SNAPSHOT/bin)
Assign your provider path like below in atlas-application.properties file
hadoop.security.credential.provider.path=jceks://file/home/chaitali/project/forkbranch/atlas/rdbms.jceks
Assign password in * format to this hikari password property
atlas.graph.storage.rdbms.jpa.hikari.password=********
Please note it should be 8 * specifically