fix(kms): tell an empty KV2 prefix from a missing mount on Vault's 404 (#6043)

This commit is contained in:
Zhengchao An
2026-08-13 08:09:17 +08:00
committed by GitHub
parent b2ae430805
commit a70a3787d8
5 changed files with 341 additions and 19 deletions
+5
View File
@@ -142,6 +142,11 @@ data:
RUSTFS_KMS_DEFAULT_KEY_ID: {{ .default_key | quote }}
{{- if eq .vault_backend "vault-transit" }}
RUSTFS_KMS_VAULT_MOUNT_PATH: {{ .vault_mount_path | quote }}
{{- else if .vault_mount_path }}
{{- /* The KV2 backend never calls the Transit engine: its mount is the KV2
one, under a different variable. Emitted only when set, so an unset
value keeps falling back to the "secret" default. */}}
RUSTFS_KMS_VAULT_KV_MOUNT: {{ .vault_mount_path | quote }}
{{- end }}
{{- end }}
{{- end }}