MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

kms: add MINIO_KMS_REPLICATE_KEYID option (#20909)

Browse Source 
This commit adds the `MINIO_KMS_REPLICATE_KEYID` env. variable.
By default - if not specified or not set to `off` - MinIO will
replicate the KMS key ID of an object.

If `MINIO_KMS_REPLICATE_KEYID=off`, MinIO does not include the
object's KMS Key ID when replicating an object. However, it always
sets the SSE-KMS encryption header. This ensures that the object
gets encrypted using SSE-KMS. The target site chooses the KMS key
ID that gets used based on the site and bucket config.

Signed-off-by: Andreas Auernhammer <github@aead.dev>
This commit is contained in:
Andreas Auernhammer
2025-02-08 00:21:09 +01:00
committed by GitHub
parent b8dde47d4e
commit 703f51164d
3 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
internal/kms/config.go
View File

@@ -28,6 +28,7 @@ import (
"os"
"path/filepath"
"strings"
"sync"
"sync/atomic"
"syscall"
"time"
@@ -64,10 +65,32 @@ const (
EnvKMSSecretKeyFile = "MINIO_KMS_SECRET_KEY_FILE" // Path to a file to read the static KMS key from
)
// EnvKMSReplicateKeyID is an env. variable that controls whether MinIO
// replicates the KMS key ID. By default, KMS key ID replication is enabled
// but can be turned off.
const EnvKMSReplicateKeyID = "MINIO_KMS_REPLICATE_KEYID"
const (
tlsClientSessionCacheSize = 100
)
var replicateKeyID = sync.OnceValue(func() bool {
if v, ok := os.LookupEnv(EnvKMSReplicateKeyID); ok && strings.ToLower(v) == "off" {
return false
}
return true // by default, replicating KMS key IDs is enabled
})
// ReplicateKeyID reports whether KMS key IDs should be included when
// replicating objects. It's enabled by default. To disable it, set:
//
// MINIO_KMS_REPLICATE_KEYID=off
//
// Some deployments use different KMS clusters with destinct keys on
// each site. Trying to replicate the KMS key ID can cause requests
// to fail in such setups.
func ReplicateKeyID() bool { return replicateKeyID() }
// ConnectionOptions is a structure containing options for connecting
// to a KMS.
type ConnectionOptions struct {