Zhengchao An a29ae4e5cd fix(kms): persist and report the Vault KV2 key rotation timestamp (#5594) ...

* fix(kms): persist and report the Vault KV2 key rotation timestamp

The rotation-age gauge reads KeyInfo::rotated_at and falls back to
created_at when it is absent. The KV2 backend never persisted a rotation
time and hardcoded None in describe_key, so a key rotated many times and
a key that was never rotated reported the same age.

Record the rotation time on the same check-and-set write that switches
the current version, and report the stored value from describe_key and
from the recovered-create path. Records written before the field existed
keep deserializing and stay unstamped: no timestamp is invented for a
rotation this node cannot vouch for.

* test(kms): cover Vault KV2 rotation timestamp persistence and legacy records

2026-08-02 05:31:51 +08:00

..

atomic-object-undo.md

fix(object): make version undo preconditions atomic (#5225)

2026-07-25 19:26:50 +08:00

authing-oidc-integration.md

fix(admin): support external OIDC browser redirects (#4280)

2026-07-09 18:07:49 +08:00

dial9-runtime-profiling.md

fix(obs): remove the dial9 task-dump switch that could never work; correct measured claims (#4688)

2026-07-10 17:34:59 +00:00

drive-timeout-tuning.md

fix(cluster): clarify peer health and listing timeouts (#5086)

2026-07-21 11:11:24 +00:00

durability-modes.md

fix(heal): report no-parity bitrot as unrecoverable (#5192)

2026-07-24 20:20:40 +08:00

hotpath-warp-ab-runbook.md

perf(rustfs): remove the fake s3_operations benchmark (#4817)

2026-07-15 11:10:48 +08:00

hotpath-warp-abba-runbook.md

test: add formal hotpath ABBA runner (#5507)

2026-07-31 11:33:10 +00:00

internode-grpc-benchmark-runbook.md

feat(internode): track msgpack decode traffic (#5309)

2026-07-26 17:03:58 +00:00

internode-msgpack-json-convergence-runbook.md

feat(internode): track msgpack decode traffic (#5309)

2026-07-26 17:03:58 +00:00

keycloak-oidc-integration.md

fix(iam): route issuer-relative JWKS through config URL (#5150)

2026-07-23 13:46:51 +08:00

kms-backend-security.md

docs(kms): correct the claim that rotation is not admin-reachable (#5593)

2026-08-02 04:18:43 +08:00

kms-cryptographic-compliance.md

docs(kms): record the compliance position and mixed-version constraints (#5541)

2026-08-01 11:34:04 +08:00

kms-disaster-recovery-drill.md

feat(kms): add a disaster-recovery drill harness for KMS backups (#5587)

2026-08-01 19:38:20 +00:00

kms-observability-runbook.md

fix(kms): persist and report the Vault KV2 key rotation timestamp (#5594)

2026-08-02 05:31:51 +08:00

kms-per-key-authorization.md

feat(policy): add built-in KMS role policies and a negative authorization matrix (#5588)

2026-08-01 19:33:33 +00:00

log-diagnose.md

feat: offline log fault-analysis system (rustfs diagnose) (#4876)

2026-07-18 15:00:34 +00:00

nats-jetstream.md

feat: add an opt-in NATS JetStream publish path for the notify and audit targets (#4634)

2026-07-14 15:36:14 +08:00

no-parity-bitrot-recovery.md

fix(heal): report no-parity bitrot as unrecoverable (#5192)

2026-07-24 20:20:40 +08:00

openid-compatibility-issues-for-vendor.md

fix(admin): support external OIDC browser redirects (#4280)

2026-07-09 18:07:49 +08:00

outbound-connection-policy.md

docs: clarify outbound allowlist scope (#5336)

2026-07-27 19:57:22 +08:00

replication-check.md

feat(replication): structure active check results (#5208)

2026-07-25 01:28:03 +08:00

reverse-proxy.md

fix(server): stop closing idle proxy keep-alive connections + reverse-proxy hardening (#3076) (#4360)

2026-07-07 15:25:31 +08:00

rolling-restart.md

fix(kms): unify persisted SSE data key envelopes (#5343)

2026-07-28 17:02:18 +08:00

scanner-benchmark-runbook.md

feat(scanner): define replication boundary contract (#3630)

2026-06-23 21:35:36 +08:00

scanner-runtime-controls.md

fix(scanner): make distributed usage convergence authoritative (#5151)

2026-07-25 18:45:16 +08:00

sftp.md

docs(sftp): document server operations (#3391)

2026-06-12 22:52:00 +08:00

tier-ilm-debugging.md

fix(tiering): bind recovery to transaction metadata (#5409)

2026-07-29 18:44:44 +00:00

vault-kms-authentication.md

feat(kms): AppRole login with background token renewal and fail-closed expiry (#5487)

2026-07-30 22:29:49 +00:00