Conversation
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
nklaassen
force-pushed
the
nklaassen/fix-kms-deleteunusedkeys
branch
from
9d499a2 to
6f14411
Compare
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
codingllama
left a comment
codingllama
left a comment
There was a problem hiding this comment.
Only minor comments, looks good.
This PR fixes the cleanup code for unused keys in GCP KMS which is currently failing to delete unused keys and emitting confusing warning logs whenever keys have been generated by multiple different Auth servers (no actual functionality is currently broken). This bug was introduced in #25025. This issue introduced there is that the function now checks that all currently active keys have actually been found in the keyring, but the ListCryptoKeys call used a filter that excluded all keys created by different Auth servers. This fix improves some of the error messages, and also uses a more permissive filter in the ListCryptoKeys call to make sure we can list keys created by any auth server, but will only delete keys created by the local auth server. changelog: Fix cleanup of unused GCP KMS keys
nklaassen
force-pushed
the
nklaassen/fix-kms-deleteunusedkeys
branch
from
3f8e328 to
41c55b0
Compare
|
@nklaassen See the table below for backport results.
|
5 participants
Fixes #31375
This PR fixes the cleanup code for unused keys in GCP KMS which is currently failing to delete unused keys and emitting confusing warning logs whenever keys have been generated by multiple different Auth servers (no actual functionality is currently broken).
This bug was introduced in #25025. This issue introduced there is that the function now checks that all currently active keys have actually been found in the keyring, but the ListCryptoKeys call used a filter that excluded all keys created by different Auth servers.
This fix improves some of the error messages, and also uses a more permissive filter in the ListCryptoKeys call to make sure we can list keys created by any auth server, but will only delete keys created by the local auth server.
changelog: Fix cleanup of unused GCP KMS keys