gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-14 17:13:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(kms): tell an empty KV2 prefix from a missing mount on Vault's 404 (#6043)

Browse Source
This commit is contained in:
Zhengchao An
2026-08-13 08:09:17 +08:00
committed by GitHub
parent b2ae430805
commit a70a3787d8
5 changed files with 341 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/rustfs/templates/configmap.yaml
+5
View File
@@ -142,6 +142,11 @@ data:
RUSTFS_KMS_DEFAULT_KEY_ID: {{ .default_key | quote }}
{{- if eq .vault_backend "vault-transit" }}
RUSTFS_KMS_VAULT_MOUNT_PATH: {{ .vault_mount_path | quote }}
{{- else if .vault_mount_path }}
{{- /* The KV2 backend never calls the Transit engine: its mount is the KV2
one, under a different variable. Emitted only when set, so an unset
value keeps falling back to the "secret" default. */}}
RUSTFS_KMS_VAULT_KV_MOUNT: {{ .vault_mount_path | quote }}
{{- end }}
{{- end }}
{{- end }}
helm/rustfs/values.yaml
+1 -1
View File
@@ -230,7 +230,7 @@ config:
vault_backend: "" # Only support vault kv2 and vault transit.
vault_address: ""
vault_token: "" # Rendered into a dedicated Secret, never into the config ConfigMap.
vault_mount_path: ""
vault_mount_path: "" # Transit engine mount for vault-transit; KV2 engine mount for vault. Unset means "secret" for KV2, which only a dev-mode Vault has by default.
default_key: ""