Add annotation to preserve old encryption key (#310)

Author: Jorres

api/v1alpha1/const.go

@@ -71,6 +71,9 @@ const (
 	AnnotationAuthTokenSecretName    = "ydb.tech/auth-token-secret-name"
 	AnnotationAuthTokenSecretKey     = "ydb.tech/auth-token-secret-key"
 
+	// Preserve original key id when `.spec.StorageClusterRef` name changes
+	EncryptionKeyStorageNameAnnotation = "ydb.tech/encryption-key-storage-name"
+
 	AnnotationValueTrue = "true"
 
 	legacyTenantNameFormat = "/%s/%s"

internal/resources/database.go

@@ -138,6 +138,14 @@ func (b *DatabaseBuilder) GetResourceBuilders(restConfig *rest.Config) []Resourc
 			)
 		}
 
+		// This allows to specify old Storage value when changing StorageClusterRef.
+		// therefore, encryption key ID will stay the same and no re-encryption needed
+		// for databases.
+		storageNameForKeyID := b.Spec.StorageClusterRef.Name
+		if override, ok := b.Annotations[api.EncryptionKeyStorageNameAnnotation]; ok {
+			storageNameForKeyID = override
+		}
+
 		keyConfig := schema.KeyConfig{
 			Keys: []schema.Key{
 				{
@@ -146,7 +154,7 @@ func (b *DatabaseBuilder) GetResourceBuilders(restConfig *rest.Config) []Resourc
 						api.DatabaseEncryptionKeySecretDir,
 						api.DatabaseEncryptionKeySecretFile,
 					),
-					ID:      SHAChecksum(b.Spec.StorageClusterRef.Name),
+					ID:      SHAChecksum(storageNameForKeyID),
 					Pin:     b.Spec.Encryption.Pin,
 					Version: 1,
 				},