mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-08 14:23:13 +00:00
overtrue
5caca36bc9
Instrument policy::execute — the single choke point every outbound Vault call and credential exchange already flows through — so no call site needs its own instrumentation: - rustfs_kms_backend_operations_total (counter): operation, op_class, outcome (success / fatal / budget_exhausted / deadline_exceeded / cancelled) - rustfs_kms_backend_attempt_failures_total (counter): operation, error_class (retryable_conn / retryable_status / fatal / attempt_timeout) - rustfs_kms_backend_operation_duration_seconds (histogram): wall-clock duration including retries and backoff - rustfs_kms_backend_operation_attempts (histogram): attempts used Metric labels carry only static enum values (operation names, classes, outcomes) — never key identifiers, key material, ciphertext, or tokens. Emission goes through the process-global metrics facade recorder, the same pattern the rest of the workspace uses, so no new wiring is needed in rustfs/src. Tests drive a paused-clock runtime under a thread-local debugging recorder, so counts, attempts, and even the recorded (virtual-clock) durations are asserted deterministically with zero real sleeps. Refs rustfs/backlog#1569 (part of rustfs/backlog#1562)
87 lines
3.0 KiB
TOML
87 lines
3.0 KiB
TOML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
[package]
|
|
name = "rustfs-kms"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
version.workspace = true
|
|
homepage.workspace = true
|
|
description = "Key Management Service for RustFS, providing secure key generation, storage, and object encryption capabilities."
|
|
keywords = ["kms", "encryption", "key-management", "rustfs", "security"]
|
|
categories = ["cryptography", "web-programming", "authentication"]
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
# Core dependencies
|
|
async-trait = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "io-util", "macros", "rt-multi-thread", "sync", "time"] }
|
|
uuid = { workspace = true, features = ["serde", "v4", "fast-rng", "macro-diagnostics"] }
|
|
jiff = { workspace = true, features = ["serde"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true, features = ["raw_value"] }
|
|
tracing = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
# Operation metrics emitted by the retry policy engine (crate::policy).
|
|
metrics = { workspace = true }
|
|
|
|
# Cryptography
|
|
aes-gcm = { workspace = true, features = ["rand_core"] }
|
|
argon2 = { workspace = true }
|
|
chacha20poly1305 = { workspace = true }
|
|
rand = { workspace = true, features = ["serde"] }
|
|
base64 = { workspace = true }
|
|
hex = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
subtle = { workspace = true }
|
|
zeroize = { workspace = true, features = ["derive"] }
|
|
|
|
# Configuration and storage
|
|
url = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
|
|
# Caching
|
|
moka = { workspace = true, features = ["future"] }
|
|
|
|
# Additional dependencies
|
|
md-5 = { workspace = true }
|
|
arc-swap = { workspace = true }
|
|
rustfs-utils = { workspace = true }
|
|
rustfs-security-governance = { workspace = true }
|
|
|
|
# HTTP client for Vault
|
|
reqwest = { workspace = true }
|
|
vaultrs = { workspace = true }
|
|
# vaultrs surfaces transport-level failures as wrapped rustify errors; the
|
|
# operation policy needs the concrete type to classify them for retry decisions.
|
|
rustify = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
# Debugging recorder for asserting emitted metrics in tests.
|
|
metrics-util = { version = "0.20", features = ["debugging"] }
|
|
insta = { workspace = true, features = ["yaml", "json"] }
|
|
tempfile = { workspace = true }
|
|
temp-env = { workspace = true }
|
|
# "net" backs the scripted loopback Vault used by the policy wiring tests.
|
|
tokio = { workspace = true, features = ["net", "test-util"] }
|
|
|
|
[features]
|
|
default = []
|