BREAKING(flags) feat(bulk): Allow encrypted input with unencrypted output in bulk.

dgraph/cmd/bulk/loader.go

@@ -67,6 +67,7 @@ type options struct {
 	NewUids          bool
 	ClientDir        string
 	Encrypted        bool
+	EncryptedOut     bool
 
 	MapShards    int
 	ReduceShards int

dgraph/cmd/bulk/reduce.go

@@ -142,12 +142,17 @@ func (r *reducer) createBadgerInternal(dir string, compression bool) *badger.DB
 		}
 	}
 
+	key := r.opt.EncryptionKey
+	if !r.opt.EncryptedOut {
+		key = nil
+	}
+
 	opt := badger.DefaultOptions(dir).
 		WithSyncWrites(false).
 		WithTableLoadingMode(bo.MemoryMap).
 		WithValueThreshold(1 << 10 /* 1 KB */).
 		WithLogger(nil).
-		WithEncryptionKey(r.opt.EncryptionKey).
+		WithEncryptionKey(key).
 		WithBlockCacheSize(r.opt.BlockCacheSize).
 		WithIndexCacheSize(r.opt.IndexCacheSize)
 

dgraph/cmd/bulk/run.go

@@ -60,7 +60,11 @@ func init() {
 	flag.String("format", "",
 		"Specify file format (rdf or json) instead of getting it from filename.")
 	flag.Bool("encrypted", false,
-		"Flag to indicate whether schema and data files are encrypted.")
+		"Flag to indicate whether schema and data files are encrypted. "+
+			"Must be specified with --encryption_key_file or vault option(s).")
+	flag.Bool("encrypted_out", false,
+		"Flag to indicate whether to encrypt the output. "+
+			"Must be specified with --encryption_key_file or vault option(s).")
 	flag.String("out", defaultOutDir,
 		"Location to write the final dgraph data directories.")
 	flag.Bool("replace_out", false,
@@ -122,6 +126,7 @@ func run() {
 		SchemaFile:       Bulk.Conf.GetString("schema"),
 		GqlSchemaFile:    Bulk.Conf.GetString("graphql_schema"),
 		Encrypted:        Bulk.Conf.GetBool("encrypted"),
+		EncryptedOut:     Bulk.Conf.GetBool("encrypted_out"),
 		OutDir:           Bulk.Conf.GetString("out"),
 		ReplaceOutDir:    Bulk.Conf.GetBool("replace_out"),
 		TmpDir:           Bulk.Conf.GetString("tmp"),
@@ -166,10 +171,25 @@ func run() {
 		fmt.Printf("unable to read key %v", err)
 		return
 	}
-	if opt.Encrypted && len(opt.EncryptionKey) == 0 {
-		fmt.Printf("Must use --encryption_key_file or vault option(s) with --encrypted option.\n")
-		os.Exit(1)
+	if len(opt.EncryptionKey) == 0 {
+		if opt.Encrypted || opt.EncryptedOut {
+			fmt.Fprint(os.Stderr, "Must use --encryption_key_file or vault option(s).\n")
+			os.Exit(1)
+		}
+	} else {
+		requiredFlags := Bulk.Cmd.Flags().Changed("encrypted") &&
+			Bulk.Cmd.Flags().Changed("encrypted_out")
+		if !requiredFlags {
+			fmt.Fprint(os.Stderr, "Must specify --encrypted and --encrypted_out when providing encryption key.\n")
+			os.Exit(1)
+		}
+		if !opt.Encrypted && !opt.EncryptedOut {
+			fmt.Fprint(os.Stderr, "Must set --encrypted and/or --encrypted_out to true when providing encryption key.\n")
+			os.Exit(1)
+		}
 	}
+	fmt.Printf("Encrypted input: %v; Encrypted output: %v\n", opt.Encrypted, opt.EncryptedOut)
+
 	if opt.SchemaFile == "" {
 		fmt.Fprint(os.Stderr, "Schema file must be specified.\n")
 		os.Exit(1)