Description

• plugins.query.datasources.encryption.masterkey is being used for encrypting auth information in datasource metadata configuration. In previous versions, this config will default to 0000000000000000 if not provided.
• However, we have decided to remove the logic of defaulting for better security posture. So with this change, User has to generate a master key and configure in the opensearch.yml for using datasource CRUD APIs.
• Updated documentation: https://github.com/vamsi-amazon/sql/blob/remove-default-master-key/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information

Testing

Request:

{
  "name": "aws_prometheus3",
  "connector": "PROMETHEUS",
  "allowedRoles": [],
  "properties": {
    "prometheus.uri": "https://localhost:9090",
    "prometheus.auth.type" : "basicauth",
    "prometheus.auth.username" : "username",
    "prometheus.auth.password" : "password"
  }
}

Response

{
  "status": 400,
  "error": {
    "type": "IllegalStateException",
    "reason": "Invalid Request",
    "details": "Master key is a required config for using datasource APIs. Please set the following config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information"
  }
}

Issues Resolved

[List any issues this PR will resolve]

Check List

• New functionality includes testing.
  • All tests pass, including unit test, integration test and doctest
• New functionality has been documented.
  • New functionality has javadoc added
  • New functionality has user manual doc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.