[Europa][S5C] CloudStack 4.23 KMS·암호화 및 Usage 키 의존성 통합 - #1036
Merged
dhslove merged 6 commits intoSep 11, 2026
Merged
Conversation
* Add KMS framework * integrate volume encryption with kms * rotate keys wrapped with older versions * allow adding kms key in deploy vm * temp commit * Add some tests * fixups and some ui changes * Change wrapping algo for pkcs * fixups * fix list apis * directly create the key in the store * Add missing license * fixup * Fix missing labels and label generation * Fixup ui bug * fixups * Add smoke test * Fix test failures * fixups * Address comments * fix failing tests * Address comments * Fix pre-commit error * fixup * Fix failing unit tests * fixup * fix UI bug * fixup createHSM in marvin library * Fix bugs * fix failing test * fixup * fixup * fix marvin lib & tests * fix marvin tests * fixup * Make HSM Profile domain scoped * fixup (cherry picked from commit d2c8aa7)
(cherry picked from commit 600201a)
* Fix icon for KMS * Move KMS further down in the left side menu (cherry picked from commit 1400616)
29 tasks
dhslove
merged commit Sep 11, 2026
e4e1abf
into
ablecloud-team:ablestack-europa
9 of 11 checks passed
This was referenced Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apache CloudStack 4.23 KMS 원본 3개(apache#12711, apache#13535, apache#13568)를 Europa에 통합합니다. Database/PKCS#11 provider, KMS/HSM API·UI, 볼륨 키 참조와 Usage 공통 DAO를 추가하며 KVDO·KBOSS·CheckedReservation 및 기존 FTCTL/DR 호출 계약을 보존합니다.
기존 같은 4.23 DB에는 새 S5C 단계만 적용합니다. 기존 passphrase를 한 번 디코딩해 원래 DEK를 감싸고, 전환 트랜잭션·계정/존 검사·클러스터 키 잠금·비밀 마스킹을 추가했습니다. 지정 키 부재 시 임의 새 키 대체를 거부하며 부분 전환 실패를 async job 실패로 보고합니다.
검증: 전체 컴파일, 집중 Java 189개/11 suite, UI 351개/30 suite 통과. 실제 MySQL 신규/014895d8f3/S5B 업그레이드·동일 스냅샷 재실행·DDL 10개 중단 경계 복구 통과. 조립된 Management/Usage의 API·ACL·DAO 주입, DB 오류 rollback, 비활성 HSM/키 거부, 동시 회전·background rewrap 후 QEMU 10.1의 4 MiB 전체 데이터 복호화를 확인했습니다. 최종 SHA의 공식 CI 결과는 아래 완료 기록을 따릅니다.
원본 판정은 Applied 1 / Adapted 2이며 고정 299개 중 Pending 56개가 남습니다. S2 잔여 16개는 유지하고 다음 단계는 S6 #997입니다. 보고서: developer/history/apache-4.23.0.0-europa-2026-09-10/s5c-verification.ko.md
실물 HSM·KVM·SharedMountPoint·LINSTOR 테스트는 #1025에 NOT_RUN으로 기록했고 전체 코드 병합 뒤 S8 #999에서 수행합니다.
Closes #996
최종 Actions 검증
최종 PR HEAD
7bf2899d3db4d70b6a16980714e030d4cc42a226. 공식 backend 14,132 tests / failures0 / errors0 / skipped17.sha256:039bb1ca77fe5085516f9047f7d6f30741e0594d777d603b57514924bec15129sha256:8a83d3e4096625f63a373a9561544070b927181272fe8e4d0f3c09172a511967전체 Lint는 기존13개 실패 범주, 변경 경로 추가 진단0개. Simulator/Coverage/Sonar skipped는 PASS에 포함하지 않습니다. Actions 산출물은 이 S5C 코드의 검증용이며 최종 S8 RC가 아닙니다.
로컬 전체 회귀 테스트도 BUILD SUCCESS: 14,132 tests / failures0 / errors0 / skipped15. 공식 Actions와 로컬의 skipped 수는 각각17/15이며 구분하여 기록합니다.