Skip to content

Add group encryption keys

Pascal Zumkehr requested to merge codez0/gitlab:group-encryption-keys into master

This MR is superseded by the following new MRs:

What does this MR do and why?

Adds group encryption keys so each organization is able to en-/decrypt CI variables in the database with their own key. This resolves #378386 (closed)

The GroupEncryptionKey model holds the optional encryption key for each (root) group. If such a key exists, it is used to en-/decrypt all descendant CI variables of this group. Whenever the key for a group is changed, the values of all descendant CI variables are re-encrypted with the new key in a background job. The same happens when a group or a project is transferred to another root group.

Because the MR is quite large, it is currently split up into multiple commits. However, all changes are required for a consistent behavior. I plan to work on adding support for both the REST and GraphQL APIs and update the documentation in separate MRs.

Screenshots or screen recordings

The CI/CD Settings page of any root group / organisation:

Encryption Keys section in CI/CD Settings

How to set up and validate locally

  1. Visit any group CI/CD settings page such as http://127.0.0.1:3000/groups/flightjs/-/settings/ci_cd and expand the "Encryption Key" panel.
  2. Enter an encryption key for this group and save it.
  3. All variables in this group are now encrypted using the custom encryption key.
  4. To remove a custom encryption key and use the global/instance encryption key, leave the encryption key field empty and save it.
  5. All variables in this group are now encrypted using the global encryption key.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Pascal Zumkehr

Merge request reports