Azure / ARO-RP / 33741256103

41%

Build Type

push

github

Committed by web-flow

Commit Message

[ARO-29319] Defer document encryption key rotation until a re-seal path exists (#5057)

* fix(deploy): defer document encryption key rotation pending re-seal

A service enumerates the encryption key versions in force once, at start-up,
and seals with whichever is current then. A service that is not restarted
after a rotation holds no opener for the new version, and so cannot read what
its restarted peers have since written. The MIMO units have never been in the
restart script, and lost the ability to open cluster documents on the RP scale
set as a result.

Until existing documents can be re-sealed and superseded versions retired,
rotating encryption-key-v2 and fe-encryption-key-v2 does not offset that cost.
Create them if absent and leave them alone thereafter, as the legacy secrets
already are.

The portal session key continues to rotate. aro-portal alone holds it, so the
restart script is reduced to that unit and now runs only when that key is
rotated.

Add a test that the script restarts aro-portal and nothing else, replacing an
assertion that compared the constant to itself.

* test(deploy): pin the restart script to the holders of the secret

The script names the services that must be restarted to pick up a rotated
secret, and drift in that list is what let this incident run undetected.
Pin it: every unit named must be a known key vault consumer, must hold the
portal session key, and every holder must appear. Unit names are compared
whole, so a future aro-rp-something cannot satisfy a check for aro-rp.

The restart expectation was AnyTimes(), which zero calls satisfy, so the
cases meant to prove a restart happens passed without one. Make it
Times(1), and add a case fixing that creating the portal SSH host key
restarts nothing.

ensureSecretKey's result is discarded. Say why: it returns on finding any
version, with no age check, so this code never supersedes a version a
running service already holds, and creation means initial rollout, where
there... (continued)

Coverage Stats

12 of 12 new or added lines in 1 file covered. (100.0%)

7 existing lines in 2 files now uncovered.

32097 of 78727 relevant lines covered (40.77%)

0.47 hits per line