PMM-13132 Changes, CI.

.github/workflows/admin.yml

@@ -14,6 +14,7 @@ on:
       - "agent/**"
       - "api-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "qan-api2/**"
       - "update/**"

.github/workflows/agent.yml

@@ -15,6 +15,7 @@ on:
       - "api-tests/**"
       - "cli-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "qan-api2/**"
       - "update/**"

.github/workflows/encryption-rotation.yml

@@ -0,0 +1,94 @@
+name: 'Encryption Rotation Tool'
+
+on:
+  push:
+    branches:
+      - main
+      - v3
+      - pmm-*
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+*
+
+  pull_request:
+    paths-ignore:
+      - "admin/**"
+      - "agent/**"
+      - "api-tests/**"
+      - "cli-tests/**"
+      - "docs/**"
+      - "managed/**"
+      - "qan-api2/**"
+      - "update/**"
+      - "vmproxy/**"
+      - "ui/**"
+
+jobs:
+  test:
+    name: Tests
+    runs-on: ubuntu-22.04
+
+    continue-on-error: true
+
+    env:
+
+    defaults:
+      run:
+        working-directory: ${{ github.workspace }}/encryption-rotation
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Go release
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ github.workspace }}/go.mod
+          cache: false
+
+      - name: Enable Go build cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/go-build
+          key: ${{ runner.os }}-go-build-${{ github.ref }}-${{ hashFiles('**') }}
+          restore-keys: |
+            ${{ runner.os }}-go-build-${{ github.ref }}-
+            ${{ runner.os }}-go-build-
+
+      - name: Enable Go modules cache
+        uses: actions/cache@v4
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-modules-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-modules-
+
+      - name: Download Go modules
+        run: go mod download -x
+
+      - name: Build and install
+        run: make install
+
+      - name: Launch containers
+        env:
+          ENV_UP_FLAGS: "--detach"
+        run: make env-up
+
+      - name: Run tests
+        run: go test ./...
+
+      - name: Upload coverage results
+        uses: codecov/codecov-action@v4
+        with:
+          file: cover.out
+          flags: agent
+          env_vars: MYSQL_IMAGE,MONGO_IMAGE,POSTGRES_IMAGE,PMM_SERVER_IMAGE
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Run debug commands on failure
+        if: ${{ failure() }}
+        run: |
+          echo "--- Environment variables ---"
+          env | sort
+          echo "--- GO Environment ---"
+          go env | sort
+          git status

.github/workflows/managed.yml

@@ -15,6 +15,7 @@ on:
       - 'api-tests/**'
       - 'cli-tests/**'
       - 'docs/**'
+      - "encryption-rotation/**"
       - 'qan-api2/**'
       - 'update/**'
       - 'vmproxy/**'

.github/workflows/qan-api2.yml

@@ -16,6 +16,7 @@ on:
       - "api-tests/**"
       - "cli-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "update/**"
       - "vmproxy/**"

.github/workflows/ui.yml

@@ -15,6 +15,7 @@ on:
       - "api-tests/**"
       - "cli-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "managed-dev/**"
       - "qan-api2/**"

.github/workflows/update.yml

@@ -15,6 +15,7 @@ on:
       - "api-tests/**"
       - "cli-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "qan-api2/**"
       - "vmproxy/**"

.github/workflows/vmproxy.yml

@@ -16,6 +16,7 @@ on:
       - "api-tests/**"
       - "cli-tests/**"
       - "docs/**"
+      - "encryption-rotation/**"
       - "managed/**"
       - "qan-api2/**"
       - "update/**"

encryption-rotation/main_test.go

@@ -36,8 +36,10 @@ import (
 const (
 	encryptionKeyTestPath = "/srv/pmm-encryption-rotation-test.key"
 	originEncryptionKey   = `CMatkOIIEmQKWAowdHlwZS5nb29nbGVhcGlzLmNvbS9nb29nbGUuY3J5cHRvLnRpbmsuQWVzR2NtS2V5EiIaIKDxOKZxwiJl5Hj6oPZ/unTzmAvfwHWzZ1Wli0vac15YGAEQARjGrZDiCCAB`
-	originUsernameHash    = `AYxEFsZVZMH7UErzcQ8vbm3lVza//yRF6o/yTH7tcRD0PAwsESt6c/d0BzM=`
-	originPasswordHash    = `AYxEFsa5GYg97cnETVOU/A7ZPjrG7A1je3qlu+g5pKI/uH2ndz3lzCaZwkU=` //nolint:gosec
+	// pmm-managed-username encrypted with originEncryptionKey
+	originUsernameHash = `AYxEFsbCFxg31sCqO4KlCsqASFYNeHapjT+vf8seEhsQrN5hWOCuvCSxd/ZERv8RODu3oX4=`
+	// pmm-managed-password encrypted with originEncryptionKey
+	originPasswordHash = `AYxEFsajO8X5rrXG4ocOEE4ltWuaNmy7Uz0GyDgZ/Q04O2biFah5IdkenQ9ehXwv+nyiwDw=` //nolint:gosec
 )
 
 func TestEncryptionRotation(t *testing.T) {
@@ -63,7 +65,7 @@ func TestEncryptionRotation(t *testing.T) {
 
 func createOriginEncryptionKey() error {
 	encryption.DefaultEncryptionKeyPath = encryptionKeyTestPath
-	return os.WriteFile(encryptionKeyTestPath, []byte(originEncryptionKey), 0o600)
+	return os.WriteFile(encryptionKeyTestPath, []byte(originEncryptionKey), 0o644)
 }
 
 func insertTestData(db *sql.DB) error {