[STACKED on #952] feat(kms): return configured historical root keys - #955
Closed
kvinwang wants to merge 8 commits into
Closed
[STACKED on #952] feat(kms): return configured historical root keys#955kvinwang wants to merge 8 commits into
kvinwang wants to merge 8 commits into
Conversation
kvinwang
force-pushed
the
codex/feat-kms-historical-root-keys
branch
from
August 3, 2026 14:53
e8e3825 to
92e2d3f
Compare
kvinwang
force-pushed
the
codex/feat-kms-historical-root-keys
branch
from
August 3, 2026 16:39
92e2d3f to
246ed7e
Compare
kvinwang
force-pushed
the
codex/feat-kms-historical-root-keys
branch
from
August 3, 2026 16:57
246ed7e to
7a87e21
Compare
Defect: Onboard.Finish terminated the process inside the RPC handler before Rocket could flush the documented Empty response. Observed symptom: clients received RemoteDisconnected and the graceful-response regression failed. Fix: return success immediately and schedule process exit after a short response-drain interval.
kvinwang
force-pushed
the
codex/feat-kms-historical-root-keys
branch
from
August 4, 2026 02:26
7a87e21 to
af6c3bc
Compare
Collaborator
Author
|
Closing because KMS does not currently implement a complete root-key rotation flow. This change only returns configured historical keys, while the onboarding client still requires exactly one key and neither persists nor uses historical keys, so configuring them would break onboarding rather than provide an end-to-end recovery path. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
KMS retained historical root keys for compatibility/recovery but its API returned only the active root. Guests needing to decrypt or verify state created under an older configured root could not obtain it.
Root cause and fix
Return the configured historical roots together with the active key under the explicit historical-key response contract.
Implementation
The branch records the following focused implementation work:
feat(kms): return configured historical root keystest(kms): cover historical root key inventorydocs(kms): define cold backup recovery procedureChanged paths:
dstack/kms/README.mddstack/kms/kms.tomldstack/kms/src/config.rsdstack/kms/src/main_service.rsScope
This PR addresses one logical
kmsfinding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.Dependency and merge order
codex/fix-kms-ca-restartVerification
git diff --check origin/codex/fix-kms-ca-restart..origin/codex/feat-kms-historical-root-keys: passed.