Skip to content

Commit dbe6915

Browse files
johnstcnjohnstcn
committed
add previous external token encryption key deployment value
1 parent 17e694c commit dbe6915

File tree

6 files changed

+72
-47
lines changed

6 files changed

+72
-47
lines changed

‎cli/testdata/coder_server_--help.golden

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,11 @@ These options are only available in the Enterprise Edition.
463463
database. The value must be a base64-encoded key exactly 32 bytes in
464464
length.
465465

466+
--previous-external-token-encryption-key string, $CODER_PREVIOUS_EXTERNAL_TOKEN_ENCRYPTION_KEY
467+
When rotating external token encryption key, provide the previous
468+
encryption key. The value must be a base64-encoded key exactly 32
469+
bytes in length.
470+
466471
--scim-auth-header string, $CODER_SCIM_AUTH_HEADER
467472
Enables SCIM and sets the authentication header for the built-in SCIM
468473
server. New users are automatically created with OIDC authentication.

‎coderd/deployment_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ func TestDeploymentValues(t *testing.T) {
2626
cfg.OIDC.EmailField.Set("some_random_field_you_never_expected")
2727
cfg.PostgresURL.Set(hi)
2828
cfg.SCIMAPIKey.Set(hi)
29-
cfg.ExternalTokenEncryptionKey.Set("the_random_key_we_never_expected") // len:32
29+
cfg.ExternalTokenEncryptionKey.Set("the_random_key_we_never_expected") // len:32
30+
cfg.PreviousExternalTokenEncryptionKey.Set("another_random_key_we_unexpected") // len:32
3031

3132
client := coderdtest.New(t, &coderdtest.Options{
3233
DeploymentValues: cfg,
@@ -46,6 +47,7 @@ func TestDeploymentValues(t *testing.T) {
4647
require.Empty(t, scrubbed.Values.PostgresURL.Value())
4748
require.Empty(t, scrubbed.Values.SCIMAPIKey.Value())
4849
require.Empty(t, scrubbed.Values.ExternalTokenEncryptionKey.Value())
50+
require.Empty(t, scrubbed.Values.PreviousExternalTokenEncryptionKey.Value())
4951
}
5052

5153
func TestDeploymentStats(t *testing.T) {

‎codersdk/deployment.go

Lines changed: 55 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -129,52 +129,53 @@ type DeploymentValues struct {
129129
DocsURL clibase.URL `json:"docs_url,omitempty"`
130130
RedirectToAccessURL clibase.Bool `json:"redirect_to_access_url,omitempty"`
131131
// HTTPAddress is a string because it may be set to zero to disable.
132-
HTTPAddress clibase.String `json:"http_address,omitempty" typescript:",notnull"`
133-
AutobuildPollInterval clibase.Duration `json:"autobuild_poll_interval,omitempty"`
134-
JobHangDetectorInterval clibase.Duration `json:"job_hang_detector_interval,omitempty"`
135-
DERP DERP `json:"derp,omitempty" typescript:",notnull"`
136-
Prometheus PrometheusConfig `json:"prometheus,omitempty" typescript:",notnull"`
137-
Pprof PprofConfig `json:"pprof,omitempty" typescript:",notnull"`
138-
ProxyTrustedHeaders clibase.StringArray `json:"proxy_trusted_headers,omitempty" typescript:",notnull"`
139-
ProxyTrustedOrigins clibase.StringArray `json:"proxy_trusted_origins,omitempty" typescript:",notnull"`
140-
CacheDir clibase.String `json:"cache_directory,omitempty" typescript:",notnull"`
141-
InMemoryDatabase clibase.Bool `json:"in_memory_database,omitempty" typescript:",notnull"`
142-
PostgresURL clibase.String `json:"pg_connection_url,omitempty" typescript:",notnull"`
143-
OAuth2 OAuth2Config `json:"oauth2,omitempty" typescript:",notnull"`
144-
OIDC OIDCConfig `json:"oidc,omitempty" typescript:",notnull"`
145-
Telemetry TelemetryConfig `json:"telemetry,omitempty" typescript:",notnull"`
146-
TLS TLSConfig `json:"tls,omitempty" typescript:",notnull"`
147-
Trace TraceConfig `json:"trace,omitempty" typescript:",notnull"`
148-
SecureAuthCookie clibase.Bool `json:"secure_auth_cookie,omitempty" typescript:",notnull"`
149-
StrictTransportSecurity clibase.Int64 `json:"strict_transport_security,omitempty" typescript:",notnull"`
150-
StrictTransportSecurityOptions clibase.StringArray `json:"strict_transport_security_options,omitempty" typescript:",notnull"`
151-
SSHKeygenAlgorithm clibase.String `json:"ssh_keygen_algorithm,omitempty" typescript:",notnull"`
152-
MetricsCacheRefreshInterval clibase.Duration `json:"metrics_cache_refresh_interval,omitempty" typescript:",notnull"`
153-
AgentStatRefreshInterval clibase.Duration `json:"agent_stat_refresh_interval,omitempty" typescript:",notnull"`
154-
AgentFallbackTroubleshootingURL clibase.URL `json:"agent_fallback_troubleshooting_url,omitempty" typescript:",notnull"`
155-
BrowserOnly clibase.Bool `json:"browser_only,omitempty" typescript:",notnull"`
156-
SCIMAPIKey clibase.String `json:"scim_api_key,omitempty" typescript:",notnull"`
157-
ExternalTokenEncryptionKey clibase.String `json:"external_token_encryption_key"`
158-
Provisioner ProvisionerConfig `json:"provisioner,omitempty" typescript:",notnull"`
159-
RateLimit RateLimitConfig `json:"rate_limit,omitempty" typescript:",notnull"`
160-
Experiments clibase.StringArray `json:"experiments,omitempty" typescript:",notnull"`
161-
UpdateCheck clibase.Bool `json:"update_check,omitempty" typescript:",notnull"`
162-
MaxTokenLifetime clibase.Duration `json:"max_token_lifetime,omitempty" typescript:",notnull"`
163-
Swagger SwaggerConfig `json:"swagger,omitempty" typescript:",notnull"`
164-
Logging LoggingConfig `json:"logging,omitempty" typescript:",notnull"`
165-
Dangerous DangerousConfig `json:"dangerous,omitempty" typescript:",notnull"`
166-
DisablePathApps clibase.Bool `json:"disable_path_apps,omitempty" typescript:",notnull"`
167-
SessionDuration clibase.Duration `json:"max_session_expiry,omitempty" typescript:",notnull"`
168-
DisableSessionExpiryRefresh clibase.Bool `json:"disable_session_expiry_refresh,omitempty" typescript:",notnull"`
169-
DisablePasswordAuth clibase.Bool `json:"disable_password_auth,omitempty" typescript:",notnull"`
170-
Support SupportConfig `json:"support,omitempty" typescript:",notnull"`
171-
GitAuthProviders clibase.Struct[[]GitAuthConfig] `json:"git_auth,omitempty" typescript:",notnull"`
172-
SSHConfig SSHConfig `json:"config_ssh,omitempty" typescript:",notnull"`
173-
WgtunnelHost clibase.String `json:"wgtunnel_host,omitempty" typescript:",notnull"`
174-
DisableOwnerWorkspaceExec clibase.Bool `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"`
175-
ProxyHealthStatusInterval clibase.Duration `json:"proxy_health_status_interval,omitempty" typescript:",notnull"`
176-
EnableTerraformDebugMode clibase.Bool `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"`
177-
UserQuietHoursSchedule UserQuietHoursScheduleConfig `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"`
132+
HTTPAddress clibase.String `json:"http_address,omitempty" typescript:",notnull"`
133+
AutobuildPollInterval clibase.Duration `json:"autobuild_poll_interval,omitempty"`
134+
JobHangDetectorInterval clibase.Duration `json:"job_hang_detector_interval,omitempty"`
135+
DERP DERP `json:"derp,omitempty" typescript:",notnull"`
136+
Prometheus PrometheusConfig `json:"prometheus,omitempty" typescript:",notnull"`
137+
Pprof PprofConfig `json:"pprof,omitempty" typescript:",notnull"`
138+
ProxyTrustedHeaders clibase.StringArray `json:"proxy_trusted_headers,omitempty" typescript:",notnull"`
139+
ProxyTrustedOrigins clibase.StringArray `json:"proxy_trusted_origins,omitempty" typescript:",notnull"`
140+
CacheDir clibase.String `json:"cache_directory,omitempty" typescript:",notnull"`
141+
InMemoryDatabase clibase.Bool `json:"in_memory_database,omitempty" typescript:",notnull"`
142+
PostgresURL clibase.String `json:"pg_connection_url,omitempty" typescript:",notnull"`
143+
OAuth2 OAuth2Config `json:"oauth2,omitempty" typescript:",notnull"`
144+
OIDC OIDCConfig `json:"oidc,omitempty" typescript:",notnull"`
145+
Telemetry TelemetryConfig `json:"telemetry,omitempty" typescript:",notnull"`
146+
TLS TLSConfig `json:"tls,omitempty" typescript:",notnull"`
147+
Trace TraceConfig `json:"trace,omitempty" typescript:",notnull"`
148+
SecureAuthCookie clibase.Bool `json:"secure_auth_cookie,omitempty" typescript:",notnull"`
149+
StrictTransportSecurity clibase.Int64 `json:"strict_transport_security,omitempty" typescript:",notnull"`
150+
StrictTransportSecurityOptions clibase.StringArray `json:"strict_transport_security_options,omitempty" typescript:",notnull"`
151+
SSHKeygenAlgorithm clibase.String `json:"ssh_keygen_algorithm,omitempty" typescript:",notnull"`
152+
MetricsCacheRefreshInterval clibase.Duration `json:"metrics_cache_refresh_interval,omitempty" typescript:",notnull"`
153+
AgentStatRefreshInterval clibase.Duration `json:"agent_stat_refresh_interval,omitempty" typescript:",notnull"`
154+
AgentFallbackTroubleshootingURL clibase.URL `json:"agent_fallback_troubleshooting_url,omitempty" typescript:",notnull"`
155+
BrowserOnly clibase.Bool `json:"browser_only,omitempty" typescript:",notnull"`
156+
SCIMAPIKey clibase.String `json:"scim_api_key,omitempty" typescript:",notnull"`
157+
ExternalTokenEncryptionKey clibase.String `json:"external_token_encryption_key"`
158+
PreviousExternalTokenEncryptionKey clibase.String `json:"previous_external_token_encryption_key"`
159+
Provisioner ProvisionerConfig `json:"provisioner,omitempty" typescript:",notnull"`
160+
RateLimit RateLimitConfig `json:"rate_limit,omitempty" typescript:",notnull"`
161+
Experiments clibase.StringArray `json:"experiments,omitempty" typescript:",notnull"`
162+
UpdateCheck clibase.Bool `json:"update_check,omitempty" typescript:",notnull"`
163+
MaxTokenLifetime clibase.Duration `json:"max_token_lifetime,omitempty" typescript:",notnull"`
164+
Swagger SwaggerConfig `json:"swagger,omitempty" typescript:",notnull"`
165+
Logging LoggingConfig `json:"logging,omitempty" typescript:",notnull"`
166+
Dangerous DangerousConfig `json:"dangerous,omitempty" typescript:",notnull"`
167+
DisablePathApps clibase.Bool `json:"disable_path_apps,omitempty" typescript:",notnull"`
168+
SessionDuration clibase.Duration `json:"max_session_expiry,omitempty" typescript:",notnull"`
169+
DisableSessionExpiryRefresh clibase.Bool `json:"disable_session_expiry_refresh,omitempty" typescript:",notnull"`
170+
DisablePasswordAuth clibase.Bool `json:"disable_password_auth,omitempty" typescript:",notnull"`
171+
Support SupportConfig `json:"support,omitempty" typescript:",notnull"`
172+
GitAuthProviders clibase.Struct[[]GitAuthConfig] `json:"git_auth,omitempty" typescript:",notnull"`
173+
SSHConfig SSHConfig `json:"config_ssh,omitempty" typescript:",notnull"`
174+
WgtunnelHost clibase.String `json:"wgtunnel_host,omitempty" typescript:",notnull"`
175+
DisableOwnerWorkspaceExec clibase.Bool `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"`
176+
ProxyHealthStatusInterval clibase.Duration `json:"proxy_health_status_interval,omitempty" typescript:",notnull"`
177+
EnableTerraformDebugMode clibase.Bool `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"`
178+
UserQuietHoursSchedule UserQuietHoursScheduleConfig `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"`
178179

179180
Config clibase.YAMLConfigPath `json:"config,omitempty" typescript:",notnull"`
180181
WriteConfig clibase.Bool `json:"write_config,omitempty" typescript:",notnull"`
@@ -1597,6 +1598,14 @@ when required by your organization's security policy.`,
15971598
Annotations: clibase.Annotations{}.Mark(annotationEnterpriseKey, "true").Mark(annotationSecretKey, "true"),
15981599
Value: &c.ExternalTokenEncryptionKey,
15991600
},
1601+
{
1602+
Name: "Previous External Token Encryption Key",
1603+
Description: "When rotating external token encryption key, provide the previous encryption key. The value must be a base64-encoded key exactly 32 bytes in length.",
1604+
Flag: "previous-external-token-encryption-key",
1605+
Env: "CODER_PREVIOUS_EXTERNAL_TOKEN_ENCRYPTION_KEY",
1606+
Annotations: clibase.Annotations{}.Mark(annotationEnterpriseKey, "true").Mark(annotationSecretKey, "true"),
1607+
Value: &c.PreviousExternalTokenEncryptionKey,
1608+
},
16001609
{
16011610
Name: "Disable Path Apps",
16021611
Description: "Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.",

‎codersdk/deployment_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ func TestDeploymentValues_HighlyConfigurable(t *testing.T) {
6060
"External Token Encryption Key": {
6161
yaml: true,
6262
},
63+
"Previous External Token Encryption Key": {
64+
yaml: true,
65+
},
6366
// These complex objects should be configured through YAML.
6467
"Support Links": {
6568
flag: true,

‎enterprise/cli/testdata/coder_server_--help.golden

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,11 @@ These options are only available in the Enterprise Edition.
463463
database. The value must be a base64-encoded key exactly 32 bytes in
464464
length.
465465

466+
--previous-external-token-encryption-key string, $CODER_PREVIOUS_EXTERNAL_TOKEN_ENCRYPTION_KEY
467+
When rotating external token encryption key, provide the previous
468+
encryption key. The value must be a base64-encoded key exactly 32
469+
bytes in length.
470+
466471
--scim-auth-header string, $CODER_SCIM_AUTH_HEADER
467472
Enables SCIM and sets the authentication header for the built-in SCIM
468473
server. New users are automatically created with OIDC authentication.

‎site/src/api/typesGenerated.ts

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)