Skip to content

Adds recording encryption manager#55078

Merged
eriktate merged 1 commit intomasterfrom
eriktate/encrypted-recording-manager
Jun 24, 2025
Merged

Adds recording encryption manager#55078
eriktate merged 1 commit intomasterfrom
eriktate/encrypted-recording-manager

Conversation

@eriktate
Copy link
Copy Markdown
Contributor

@eriktate eriktate commented May 22, 2025 •
edited
Loading

This PR adds a Manager struct responsible for higher level RecordingEncryption operations such as resolving state in order to facilitate cooperation between auth servers. It also includes the implementation for a watcher that will automatically attempt to resolve RecordingEncryption state whenever the resource is modified.

@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 7c97b4f to 1a198d9 Compare May 23, 2025 20:47
@eriktate eriktate force-pushed the eriktate/encrypted-recording-resources branch from c900a70 to cee99e5 Compare May 23, 2025 20:51
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 1a198d9 to 7713063 Compare May 23, 2025 20:51
@eriktate eriktate marked this pull request as ready for review May 23, 2025 21:15
@github-actions github-actions Bot requested a review from marcoandredinis May 23, 2025 21:15
@github-actions github-actions Bot requested a review from ryanclark May 23, 2025 21:15
marcoandredinis
marcoandredinis reviewed May 26, 2025
View reviewed changes
Comment thread go.mod Outdated
Comment thread go.mod
Comment thread go.mod
Comment thread go.mod Outdated
Comment thread api/types/sessionrecording.go Outdated
Comment thread api/types/sessionrecording.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
rosstimothy
rosstimothy reviewed May 27, 2025
View reviewed changes
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
@eriktate eriktate force-pushed the eriktate/encrypted-recording-resources branch from cee99e5 to 7afa9b6 Compare May 27, 2025 22:20
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch 3 times, most recently from e944d7d to 848b135 Compare May 27, 2025 23:42
@eriktate eriktate force-pushed the eriktate/encrypted-recording-resources branch from 7afa9b6 to 6fa728b Compare May 28, 2025 17:34
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch 3 times, most recently from 37bcbfe to 06206eb Compare May 28, 2025 20:26
@eriktate eriktate force-pushed the eriktate/encrypted-recording-resources branch 2 times, most recently from 653f866 to 23d65c6 Compare May 30, 2025 02:12
Base automatically changed from eriktate/encrypted-recording-resources to master May 30, 2025 02:53
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 4950191 to 54c711f Compare May 30, 2025 02:54
@eriktate eriktate added the no-changelog Indicates that a PR does not require a changelog entry label May 30, 2025
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 54c711f to df2ca7c Compare May 30, 2025 03:19
rosstimothy
rosstimothy reviewed May 30, 2025
View reviewed changes
Comment thread go.mod Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch 4 times, most recently from 7f1c265 to 5f9781b Compare May 30, 2025 18:17
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 5feae17 to f956674 Compare June 23, 2025 18:55
rosstimothy
rosstimothy reviewed Jun 23, 2025
View reviewed changes
Comment thread lib/auth/recordingencryption/manager.go Outdated
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch 3 times, most recently from bd87bb8 to eb4376b Compare June 24, 2025 19:23
rosstimothy
rosstimothy reviewed Jun 24, 2025
View reviewed changes
Comment thread lib/auth/recordingencryption/manager.go Outdated
rosstimothy
rosstimothy approved these changes Jun 24, 2025
View reviewed changes
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
@public-teleport-github-review-bot public-teleport-github-review-bot Bot removed the request for review from ryanclark June 24, 2025 20:17
@eriktate eriktate force-pushed the eriktate/encrypted-recording-manager branch from 821079b to 189e643 Compare June 24, 2025 20:23
@eriktate eriktate added this pull request to the merge queue Jun 24, 2025
Merged via the queue into master with commit aa0b3cb Jun 24, 2025
42 checks passed
@eriktate eriktate deleted the eriktate/encrypted-recording-manager branch June 24, 2025 21:23
This was referenced Jun 25, 2025
Open
Open
eriktate added a commit that referenced this pull request Jun 30, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
83e818b 
…ops more complex than CRUD (#55078)
@eriktate eriktate mentioned this pull request Jun 30, 2025
Closed
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
228afe9 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
0f8b388 
…ops more complex than CRUD (#55078)
@eriktate eriktate mentioned this pull request Jul 1, 2025
Closed
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
4ca9d88 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Aug 15, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
fe4b29d 
…ops more complex than CRUD (#55078)
@eriktate eriktate mentioned this pull request Aug 15, 2025
Merged
eriktate added a commit that referenced this pull request Aug 27, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
8f580e6 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
14ff4b5 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
1770761 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
56b3b99 
…ops more complex than CRUD (#55078)
eriktate added a commit that referenced this pull request Sep 3, 2025
@eriktate
adding Manager for RecordingEncryption resources that handles shared …
1f8687a 
…ops more complex than CRUD (#55078)
github-merge-queue Bot pushed a commit that referenced this pull request Sep 3, 2025
@eriktate
[v18] Encrypted Session Recordings (#57959)
236fd0e 
* adding support for encryption/decryption keys to keystore manager (#54428, #55652)

* adds new protos for resources related to encrypted session recordings and updates the existing SessionRecordingConfig protos to include a Status (#54780)

* adding local service implementation for recording encryption resources (#54816)

* adding Manager for RecordingEncryption resources that handles shared ops more complex than CRUD (#55078)

* Adding session recording plugin for `age` (#55120)

* adding Manager for RecordingEncryption resources that handles shared ops more complex than CRUD

* adding age plugin wrapping default X25519 Identity/Recipient implementation with hooks to more efficiently lookup private keys given their respective public key

* Adding recording encryption and playback for `sync` modes (#54901)

* adding cache for RecordingEncryption (#55857)

* adding recording_encryption service protos (#55121)

* adding async recording encryption with gRPC multipart uploader (#55859)

* adding file configuration for encrypted session recording (#56200)

* Switching recording encryption to unwrap keys using direct keystore RSA decryption (#56776)

* adding manual key management config (#56920)

* updating protos for recording encryption (#57055)

* Add missing handling for recording encryption configs and keys (#57279)

* updating protos for recording encryption

* changing labels for encryption keys to prevent automatic cleanup, adjusting pkcs11 host UUID check to allow for key sharing of encryption keys, preventing cloud tenants from enabling manual key management, preventing use of recording encryption in FIPS mode

* adding new protos for rotated keys and the local service for interacting (#57576)

with them

* Switching encryption keys from PEM to ASN.1 DER encoding (#58137)

* using pregenerated RSA4096 key for keystore tests because generation is too slow (#58138)

* extending precomputed RSA keys to support 4096-bit keys (#58251)

* adding rotation process to Manager and exposing with new RPCs and (#57577)

* adding rotation sub commands for recording encryption keys and fixing (#57780)

broken session_recording_config when using fileconf

* using more reliable method of validating key bit length
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcoandredinis marcoandredinis marcoandredinis approved these changes

@rosstimothy rosstimothy rosstimothy approved these changes

Assignees

No one assigned

Labels

no-changelog Indicates that a PR does not require a changelog entry size/lg

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eriktate @marcoandredinis @rosstimothy