NC | CLI | List Accounts When Decrypt Access Keys Fails

[shirady]

Explain the changes

1. In account list add additional option of return_encrypted_on_decryption_error and we will neither return the secret_key nor the encrypted_secret_key in case of failure of access keys decryption.
2. In the function get_identity_config_data add a case in try-catch clause for the decryption failure and add the property of decryption_err in case there was failure of access keys decryption that is related to INVALID_MASTER_KEY and remove the encrypted_secret_key property (added a helper function for that).
3. Small refactors in file test_nc_account_invalid_mkm_integration.test.js so we can add additional account and rename the file master_keys.json for the test.

Issues:

1. It is a partial fix related to issue NC | Make list accounts/buckets and update account/bucket tolerant to errors like missing master key, permissions etc #8104 - this fix only handles the list account CLI with decrypt issue.

Testing Instructions:

Automatic Tests:

Please run:

• sudo npx jest test_nc_account_invalid_mkm_integration.test.js -t 'cli with renamed master key file'
• npx jest test_config_fs.test.js -t 'remove_encrypted_secret_key'

Manual Tests

1. Create an account with the CLI: sudo node src/cmd/manage_nsfs account add --name <account-name> --new_buckets_path /Users/buckets/ --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid>
   Note: before creating the account need to give permission to the new_buckets_path: chmod 777 /Users/buckets/.
2. Make the master key invalid by renaming the file master_key.json: sudo mv /etc/noobaa.conf.d/master_keys.json /etc/noobaa.conf.d/temp_master_keys.json
3. Account list with decryption: sudo node src/cmd/manage_nsfs account list --wide --show_secrets (should not fail, but you will see the property encrypted_secret_key and decryption_err).
4. Account status with decryption: sudo node src/cmd/manage_nsfs account status --name <account-name> --show_secrets (will fail - we didn't handle this case).

Before this fix we had this error (added partial output):

  "error": {
    "code": "InvalidMasterKey",
    "message": "Master key manager had issues loading master key, can not decrypt/encrypt secrets.",
    "cause": "Error: master key id is missing in master_keys_by_id\n    at NCMasterKeysManager._validate_master_key_manager ...
...
  }

• Doc added/updated
• Tests added

[romayalon]

@shirady So this is a partial fix of #8104, right?
only for list + decryption issue

[shirady]

@shirady So this is a partial fix of #8104, right? only for list + decryption issue

@romayalon , yes, I fixed the wrong link in the PR description, thanks.