Configurable s3 endpoint for download #1163
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aaperis
force-pushed
the
feature/unified-configurable-s3-endpoint-for-download
branch
from
d5fc9f1 to
d9c8803
Compare
aaperis
changed the title
aaperis
force-pushed
the
feature/unified-configurable-s3-endpoint-for-download
branch
from
d9c8803 to
73baacd
Compare
aaperis
force-pushed
the
feature/unified-configurable-s3-endpoint-for-download
branch
4 times, most recently
from
9f68afa to
d4e2439
Compare
aaperis
force-pushed
the
feature/unified-configurable-s3-endpoint-for-download
branch
2 times, most recently
from
32a1128 to
058887a
Compare
jbygdell
requested changes
Dec 13, 2024
Comment on lines
234
to
235
| {{- end }} | ||
| {{- if not .Values.global.vaultSecrets }} |
There was a problem hiding this comment.
Suggested change
| {{- end }} | |
| {{- if not .Values.global.vaultSecrets }} | |
| {{- end }} |
Comment on lines
260
to
261
| {{- if .Values.global.download.serveDecrypted }} | ||
| - name: c4gh-transient |
There was a problem hiding this comment.
Suggested change
| {{- if .Values.global.download.serveDecrypted }} | |
| - name: c4gh-transient | |
| {{- if not .Values.global.vaultSecrets }} | |
| {{- if .Values.global.download.serveDecrypted }} | |
| - name: c4gh-transient |
| @@ -4,7 +4,6 @@ app: | |||
| serverkey: "./dev_utils/certs/download-key.pem" | |||
| port: "8443" | |||
| middleware: "default" | |||
There was a problem hiding this comment.
Suggested change
| middleware: "default" | |
| middleware: "default" | |
| c4gh: | |
| passphrase: "" | |
| privateKeyPath: "" |
- use neic crypt4gh - do not use pip - silent curls
- internal c4gh key is optional - base64 pubkey is created from loaded file - modify tests
otherwise always serve encrypted files through /s3 - remove /s3-encrypted endpoint - log warning if serving unencrypted
- remove serveUnencryptedData configuration - add unencrypted download instance and config
for testing (un)encrypted download cases
and do a small refactoring
- add serveDecrypted object variable - repurpose obsolete c4gh secret logic - update README
aaperis
force-pushed
the
feature/unified-configurable-s3-endpoint-for-download
branch
from
4e96ea7 to
eb58f24
Compare
if they are run more than once
to increase success rate of date comparison
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related issue(s) and PR(s)
This PR closes #750.
Description
With this PR
downloadcan either be deployed as serving either unencrypted or encrypted files. TheserveUnencryptedDataboolean is removed as well as the logic fordownloadto always generate an internal c4gh key-pair (that would allow the service to serve unencrypted files in caseserveUnencryptedData=true).Main changes:
downloadcan now be configured to only serve unencrypted files if a filepath to a c4gh private key file is provided. Internally, the code checks the validity of the provided key by using the supplied passphrase to retrieve the corresponding c4gh public key. The service will not start if this procedure fails and the service will serve unencrypted data only if the retrieved public key is non-empty. This ensures that there can be no misconfiguration by e.g. providing malfunctioning keys etc. For example, the crypt4gh library and thereforereencryptwill use any string provided as to it to encrypt a file but with this mechanism we avoid such a scary scenario.downloadwill serve only encrypted files. This is the default behavior.Other changes include:
downloadlistening at different ports, one serving encrypted and the other serving unencrypted filesHow to test
Integration tests pass.