yandrey321 opened a new pull request, #11972:
URL: https://github.com/apache/ozone/pull/11972
## What changes were proposed in this pull request?
**Change.** Since HDDS-17498, the S3 Gateway accepts SSE-S3 and SSE-KMS on
encrypted (TDE) buckets and returns
`x-amz-server-side-encryption` on write responses. The read responses
didn't, so `aws s3api head-object` and audit
tools reported encrypted objects as unencrypted. `GetObject` and
`HeadObject` now report the encryption of an encrypted
object, as AWS does:
- `AES256` for an object written with `AES256`;
- `aws:kms` with `x-amz-server-side-encryption-aws-kms-key-id` (the object's
KMS key) otherwise;
- nothing for an object that is not encrypted.
**Key decisions.**
- **The algorithm the object was written with is reported.** It is stored in
the key's metadata by `PutObject`,
`CopyObject` and `CreateMultipartUpload`, and the completed upload keeps
it. An object written without an SSE header,
through ofs, or before this change, reports `aws:kms`, which is how Ozone
encrypts it.
- A copy reports the algorithm of its own request, not its source's.
- **The algorithm is stored under an internal key that no user metadata can
have,** `ozone-s3-internal-sse:algorithm`.
An S3 header name cannot contain `:`, so no `x-amz-meta-` header of any
version could have written it. User metadata
`x-amz-meta-x-amz-server-side-encryption`, including existing values, is
stored and returned unchanged. The internal
key is never returned as user metadata.
- **`HeadObject` needs no extra call.** OM already returns the
`FileEncryptionInfo` on head requests, but
`OzoneKey.fromKeyInfo` dropped it. `OzoneKey` now keeps the KMS key name
(`getEncryptionKeyName`, not in the JSON
output), and `OzoneKeyDetails` returns its own.
- **`GetObjectAttributes` is unchanged:** AWS has no SSE field in it.
Co-authored-by: Claude Opus 5.5 <[email protected]>
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-17500
## How was this patch tested?
Unit and integration tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
