mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-20 06:54:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

AWS: add support for arbitrary SSE algorithms, e.g. AES256 (#1869)

Browse Source 
* AWS: add support for arbitrary SSE algorithms, e.g. AES256

Signed-off-by: Steve Kriss <krisss@vmware.com>
This commit is contained in:
Steve Kriss
2019-09-12 10:13:46 -07:00
committed by KubeKween
parent 756c66c408
commit bc60412f29
3 changed files with 34 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudprovider/aws/object_store.go
+32 -22
View File
@@ -36,13 +36,14 @@ import (
)
const (
s3URLKey = "s3Url"
publicURLKey = "publicUrl"
kmsKeyIDKey = "kmsKeyId"
s3ForcePathStyleKey = "s3ForcePathStyle"
bucketKey = "bucket"
signatureVersionKey = "signatureVersion"
credentialProfileKey = "profile"
s3URLKey = "s3Url"
publicURLKey = "publicUrl"
kmsKeyIDKey = "kmsKeyId"
s3ForcePathStyleKey = "s3ForcePathStyle"
bucketKey = "bucket"
signatureVersionKey = "signatureVersion"
credentialProfileKey = "profile"
serverSideEncryptionKey = "serverSideEncryption"
)
type s3Interface interface {
@@ -54,12 +55,13 @@ type s3Interface interface {
}
type ObjectStore struct {
log logrus.FieldLogger
s3 s3Interface
preSignS3 s3Interface
s3Uploader *s3manager.Uploader
kmsKeyID string
signatureVersion string
log logrus.FieldLogger
s3 s3Interface
preSignS3 s3Interface
s3Uploader *s3manager.Uploader
kmsKeyID string
signatureVersion string
serverSideEncryption string
}
func NewObjectStore(logger logrus.FieldLogger) *ObjectStore {
@@ -83,18 +85,20 @@ func (o *ObjectStore) Init(config map[string]string) error {
s3ForcePathStyleKey,
signatureVersionKey,
credentialProfileKey,
serverSideEncryptionKey,
); err != nil {
return err
}
var (
region = config[regionKey]
s3URL = config[s3URLKey]
publicURL = config[publicURLKey]
kmsKeyID = config[kmsKeyIDKey]
s3ForcePathStyleVal = config[s3ForcePathStyleKey]
signatureVersion = config[signatureVersionKey]
credentialProfile = config[credentialProfileKey]
region = config[regionKey]
s3URL = config[s3URLKey]
publicURL = config[publicURLKey]
kmsKeyID = config[kmsKeyIDKey]
s3ForcePathStyleVal = config[s3ForcePathStyleKey]
signatureVersion = config[signatureVersionKey]
credentialProfile = config[credentialProfileKey]
serverSideEncryption = config[serverSideEncryptionKey]
// note that bucket is automatically added to the config map
// by the server from the ObjectStorageProviderConfig so
@@ -135,6 +139,7 @@ func (o *ObjectStore) Init(config map[string]string) error {
o.s3 = s3.New(serverSession)
o.s3Uploader = s3manager.NewUploader(serverSession)
o.kmsKeyID = kmsKeyID
o.serverSideEncryption = serverSideEncryption
if signatureVersion != "" {
if !isValidSignatureVersion(signatureVersion) {
@@ -193,10 +198,15 @@ func (o *ObjectStore) PutObject(bucket, key string, body io.Reader) error {
Body: body,
}
// if kmsKeyID is not empty, enable "aws:kms" encryption
if o.kmsKeyID != "" {
switch {
// if kmsKeyID is not empty, assume a server-side encryption (SSE)
// algorithm of "aws:kms"
case o.kmsKeyID != "":
req.ServerSideEncryption = aws.String("aws:kms")
req.SSEKMSKeyId = &o.kmsKeyID
// otherwise, use the SSE algorithm specified, if any
case o.serverSideEncryption != "":
req.ServerSideEncryption = aws.String(o.serverSideEncryption)
}
_, err := o.s3Uploader.Upload(req)