Andrei Kvapil 078e9f0daa fix(keycloak): require a persistent DEK set for the KMS proxy ...

Without encryption.deksetSecretName the proxy mints a new DEK set on
every start and keeps it only in memory. After any restart of the
proxy pod it can no longer decrypt the rows it wrote before, so the
default configuration loses access to all encrypted user data on the
first rollout, drain or OOM.

Refuse to render the proxy without a DEK set unless encryption.fields
is "disabled". Passthrough keeps a way for the static backend to get
its KEK Secret created before the DEK set is minted with it.

Assisted-by: LLM
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

2026-10-19 17:43:36 +00:00

..

apps

feat(bucket): add a ui flag to skip the s3manager web UI (#4881)

2026-10-12 17:49:41 +03:00

core

fix(e2e): keep chainsaw asserts polling through transient API errors (#4867)

2026-10-12 17:25:39 +03:00

extra

fix(etcd): leave compaction to etcd and pass the real quota to defrag

2026-10-11 20:21:26 +03:00

library

feat(kubernetes-nodes): let CDI trust a self-hosted Talos image factory

2026-10-10 22:36:49 +03:00

system

fix(keycloak): require a persistent DEK set for the KMS proxy

2026-10-19 17:43:36 +00:00

tests/cozy-lib-tests

feat(kubernetes-nodes): let CDI trust a self-hosted Talos image factory

2026-10-10 22:36:49 +03:00