[NIFI-3722] Handle provenance repository encryption status change on startup

• Type: Sub-task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.0
• Component/s: Core Framework
• Labels: encryption provenance security
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 21/Apr/17 00:51
• Updated: 26/Jan/23 02:34

Description

If the provenance repository changes from encrypted -> unencrypted or vice-versa on startup, the application should handle the change.

• Unencrypted -> encrypted: Attempt to create a EventIdFirstSchemaRecordReader instance to read the existing events into memory and write them back using EncryptedSchemaRecordWriter
• Encrypted -> unencrypted: Attempt to create a EncryptedSchemaRecordReader instance to read the existing events into memory and write them back using EventIdFirstSchemaRecordWriter or ByteArraySchemaRecordWriter depending on the repository implementation class. This depends on the key(s) for the key IDs used still being available via nifi.properties.

This process may be very slow given large existing repositories, so a standalone tool should also be made available to perform this process outside of the running app.

Issue Links

• is cloned by: NIFI-6783 Handle content repository encryption status change on startup
• relates to: NIFI-3594 Implement encrypted provenance repository
• relates to: NIFI-3723 Provide standalone tool to perform provenance repository encryption translation