munendrasn opened a new pull request, #18151: URL: https://github.com/apache/iceberg/pull/18151
Currently, GCS supports only CSEK. The user can configure `gcs.encryption-key`, where the raw key is sent to GCS on every request. This PR adds CMEK support via a new `gcs.kms-key-name` property, the caller passes only the Cloud KMS key resource name, and GCS performs encryption/decryption server-side. The reads require no change since CMEK decryption is automatic. CSEK and CMEK are mutually exclusive (GCS rejects both on one object), enforced at property-parse time with a fail-fast Preconditions check. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
