pinterest / knox

Knox is a secret management service
Apache License 2.0
1.23k stars 104 forks source link

[Feature Request] SQLite support #78

Open lonix1 opened 2 years ago

lonix1 commented 2 years ago

I see postgres is supported.

Is sqlite supported? Or any others?

stuartskelton commented 2 years ago

Hi,

I was looking around myself it seems there is a keydb.NewSQLDB() where you can pass it a sqlite or mysql connection.

Looking at TestSQLite in server/keydb/keydb_test.go

Hope that helped

-S

lonix1 commented 2 years ago

Unfortunately only go devs could do that :) Was hoping for something that doesn't require coding. But it is good to know that it's somehow possible. Thanks

stuartskelton commented 2 years ago

well yeah there is a little bit of coding, but updating the server_dev file to use keydb.NewSQLDB() instead of keydb.TempDB(), isn't much of a stretch.

If you want to test it out here is a little diff.

diff --git a/cmd/dev_server/main.go b/cmd/dev_server/main.go
index b4d11c7..e909434 100644
--- a/cmd/dev_server/main.go
+++ b/cmd/dev_server/main.go
@@ -7,6 +7,7 @@ import (
        "crypto/tls"
        "crypto/x509"
        "crypto/x509/pkix"
+       "database/sql"
        "encoding/pem"
        "expvar"
        "flag"
@@ -16,6 +17,8 @@ import (
        "os"
        "time"

+       _ "github.com/mattn/go-sqlite3"
+
        "github.com/pinterest/knox"
        "github.com/pinterest/knox/log"
        "github.com/pinterest/knox/server"
@@ -62,8 +65,14 @@ func main() {
                errLogger.Fatal("Failed to make TLS key or cert: ", err)
        }

-       db := keydb.NewTempDB()
-
+       d, err := sql.Open("sqlite3", "foo.db")
+       if err != nil {
+               errLogger.Fatal(err)
+       }
+       db, err := keydb.NewSQLDB(d)
+       if err != nil {
+               errLogger.Fatal(err)
+       }
        server.AddDefaultAccess(&knox.Access{
                Type:       knox.UserGroup,
                ID:         "security-team",
lonix1 commented 2 years ago

Thanks @stuartskelton! From your code it indeed looks like a simple change.

lonix1 commented 2 years ago

Mods: may I thus change this issue from a question to a feature request for SQLite support?

A small, simple and dockerised secrets tool - which uses sqlite - would be a gamechanger in this area.

Please consider it? Thanks!