NIFI-9953 - The config encryption tool is too complicated to use and can be simplified
This is a draft PR of adding the property encryptor module. I would like input on the general approach, any issues with naming, or suggestions for improvement.
At the moment this can be run by building and running:
java -cp "./target/nifi-property-encryptor-tool-1.18.0-SNAPSHOT-jar-with-dependencies.jar:~/.m2/repository/info/picocli/picocli/4.5.2/picocli-4.5.2.jar:~/.m2/repository/org/slf4j/slf4j-simple/1.7.36/slf4j-simple-1.7.36.jar:~/.m2/repository/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar:../../nifi-commons/nifi-property-protection-factory/target/nifi-property-protection-factory-1.18.0-SNAPSHOT.jar" org.apache.nifi.util.console.PropertyEncryptorCLI encrypt config /tmp/encrypt-me aSecurePassphrase AES_GCM
though it seems the references to maven repository may need to be absolute rather than using tilde. I have not yet determined how to build the picocli application to run more like a bash script but that is the end goal.
This PR should encrypt configuration files with AES_GCM - other providers have not yet been added. Also still to add is encrypting the nifi.properties (which should be an additional commit to this PR) and encrypting the flow.xml.gz/flow.json.gz which might be a separate PR. Currently it is also writing out the encrypted files as temporary files, without overwriting the existing ones. I think I will instead add some changes to this PR to copy the old files to .bkup and rename the encrypted files.
Summary
Tracking
Please complete the following tracking steps prior to pull request creation.
Issue Tracking
- [x] Apache NiFi Jira issue created
Pull Request Tracking
- [x] Pull Request title starts with Apache NiFi Jira issue number, such as
NIFI-00000 - [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such
NIFI-00000
Pull Request Formatting
- [x] Pull Request based on current revision of the
mainbranch - [ ] Pull Request refers to a feature branch with one commit containing changes
Verification
Please indicate the verification steps performed prior to pull request creation.
Build
- [ ] Build completed using
mvn clean install -P contrib-check- [ ] JDK 8
- [ ] JDK 11
- [ ] JDK 17
Licensing
- [ ] New dependencies are compatible with the Apache License 2.0 according to the License Policy
- [ ] New dependencies are documented in applicable
LICENSEandNOTICEfiles
Documentation
- [ ] Documentation formatting appears as expected in rendered files
I've updated the PR with most of the requested changes, let me know if further changes are necessary