Repository navigation
CLDSRV-1058: Replace internal bucket keys that carry an ARN prefix during SSE migration - #6352
Conversation
Hello dvasilas,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
Codecov Report❌ Patch coverage is
Additional details and impacted files
... and 1 file with indirect coverage changes @@ Coverage Diff @@
## development/9.3 #6352 +/- ##
===================================================
+ Coverage 85.38% 85.44% +0.05%
===================================================
Files 207 207
Lines 13503 13509 +6
===================================================
+ Hits 11530 11543 +13
+ Misses 1973 1966 -7
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Incorrect fix versionThe
Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:
Please check the |
Incorrect fix versionThe
Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:
Please check the |
e956392 to
6d4bd4f
Compare
|
/create_integration_branches |
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
ConflictA conflict has been raised during the creation of I have not created the integration branch. Here are the steps to resolve this conflict: git fetch
git checkout -B w/9.4/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefix origin/development/9.4
git merge origin/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefix
# <intense conflict resolution>
git commit
git push -u origin w/9.4/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefixThe following options are set: create_integration_branches |
|
/status |
Status
The following options are set: create_integration_branches |
ConflictA conflict has been raised during the creation of I have not created the integration branch. Here are the steps to resolve this conflict: git fetch
git checkout -B w/9.5/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefix origin/development/9.5
git merge origin/w/9.4/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefix
# <intense conflict resolution>
git commit
git push -u origin w/9.5/bugfix/CLDSRV-1058-replace-internal-bucket-keys-with-arn-prefixThe following options are set: create_integration_branches |
Waiting for approvalThe following approvals are needed before I can proceed with the merge:
The following options are set: create_integration_branches |
|
/approve |
|
I have successfully merged the changeset of this pull request
The following branches have NOT changed:
This pull request did not target the following hotfix branch(es) so they
Please check the status of the associated issue CLDSRV-1058. Goodbye dvasilas. The following options are set: approve, create_integration_branches |
With SSE migration configured, a bucket's master key that belongs to the internal KMS is replaced with a key from the default KMS. The replacement happens on the first GetObject, HeadObject, PutObject, CopyObject, or CreateMultipartUpload on the bucket.
Before this PR, only keys stored without an ARN prefix were replaced, that is, keys created before S3C 9.5.
Since S3C 9.5, internal keys are stored as
arn:scality:kms:internal:file:scality:key/<id>, so buckets encrypted on S3C 9.5 or later keep their internal master key, and new objects in them are encrypted with the internal KMS.With this PR, the bucket's master key, created by S3C or set with PutBucketEncryption, is replaced when it belongs to the SSE-migration KMS, with or without the prefix.