enhance:[2.6] force CRC32C when OpenSSL FIPS is enabled#50360
Conversation
This change makes Milvus automatically use CRC32C for S3 PutObject requests when OpenSSL FIPS mode is active. In FIPS mode, checksum choices are more constrained, so relying on the configured MinIO checksum behavior can lead to requests using an algorithm that is not acceptable in that runtime. The implementation moves OpenSSL FIPS enablement into the shared `pkg/util/fips` package and makes it return whether FIPS was actually enabled. That lets startup code keep enabling OpenSSL FIPS as before, while paramtable can also reuse the same state during config initialization. When FIPS is successfully enabled and `minio.ssl.useCRC32C` is still false, Milvus now logs a warning and temporarily overrides the runtime value to true. This keeps the user-facing config unchanged, but makes the effective runtime behavior compatible with FIPS requirements. Signed-off-by: jiaqizho <jiaqi.zhou@zilliz.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jiaqizho The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@jiaqizho Please associate the related pr of master to the body of your Pull Request. (eg. "pr: #") |
mergify
Bot
added
dco-passed
|
[ci-v2-notice] To rerun ci-v2 checks, comment with:
If you have any questions or requests, please contact @zhikunyao. |
|
@jiaqizho Please associate the related issue to the body of your Pull Request. (eg. "issue: #") |
sre-ci-robot
added
do-not-merge/need-merge-master-first
|
[INFO] PR Label Summary by Default
[WARNING] Milestone not set
You can set milestone by commenting: Use /refresh-label to update related check and label manually |
mergify
Bot
removed
do-not-merge/missing-related-issue
do-not-merge/missing-related-pr
labels
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 2.6 #50360 +/- ##
==========================================
+ Coverage 76.99% 77.73% +0.73%
==========================================
Files 1700 2000 +300
Lines 262533 328898 +66365
==========================================
+ Hits 202142 255670 +53528
- Misses 53550 65385 +11835
- Partials 6841 7843 +1002
🚀 New features to boost your workflow:
|
|
/ci-rerun-e2e-default |
|
/ci-rerun-ut-integration |
sre-ci-robot
added
the
low-code-coverage
|
/ci-rerun-ut-cpp |
2 participants
issue: #48359
pr: #50239
This change makes Milvus automatically use CRC32C for S3 PutObject requests when OpenSSL FIPS mode is active. In FIPS mode, checksum choices are more constrained, so relying on the configured MinIO checksum behavior can lead to requests using an algorithm that is not acceptable in that runtime.
The implementation moves OpenSSL FIPS enablement into the shared
pkg/util/fipspackage and makes it return whether FIPS was actually enabled. That lets startup code keep enabling OpenSSL FIPS as before, while paramtable can also reuse the same state during config initialization.When FIPS is successfully enabled and
minio.ssl.useCRC32Cis still false, Milvus now logs a warning and temporarily overrides the runtime value to true. This keeps the user-facing config unchanged, but makes the effective runtime behavior compatible with FIPS requirements.