gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-30 16:59:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kms): bulk DEK rekey sweep with admin API and kms:Rekey action (#6654)

Browse Source
This commit is contained in:
唐小鸭
2026-08-26 18:19:28 +08:00
committed by GitHub
parent ff47714363
commit 286626c1bd
16 changed files with 823 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/kms-cryptographic-compliance.md
+1 -1
View File
@@ -147,4 +147,4 @@ Retirement moves an algorithm through these states, never skipping one:
### Known gap
Step 3 is currently unreachable for object data. There is no object rewrap or re-encryption capability, so there is no supported way to migrate already-written objects off an algorithm or off a master key version — the same gap that forces the rotation retention rule in [KMS backend security properties](kms-backend-security.md#retention-and-destruction-preconditions). Until a rewrap capability exists, treat every algorithm that has ever been written as permanently read-required, and confine deprecation to step 1.
Step 3 is partially reachable for object data: the bulk rekey sweep (`POST /rustfs/admin/v3/kms/keys/rekey`) migrates stored DEK envelopes off superseded **master key versions** without touching object bodies. It does not re-encrypt object data, so migrating off a data-encryption **algorithm** still has no supported path — treat every algorithm that has ever been written as permanently read-required, and confine algorithm deprecation to step 1.