[ENH] CMEK support in storage

[Sicheng-Pan]

Description of changes

Summarize the changes made by this PR.

• Improvements & Bug fixes
  • N/A
• New functionality
  • Implements ChromaHttpClient to be used with object_store, which injects CMEK header according to the extensions field
  • Adds Cmek enum and add cmek: Option<Cmek> in PutOptions, which will be used for put requests if specified

Test plan

How are these changes tested?

• Tests pass locally with pytest for python, yarn test for js, cargo test for rust

Migration plan

Are there any migrations, or any forwards/backwards compatibility changes needed in order to make sure this change deploys reliably?

Observability plan

What is the plan to instrument and monitor this change?

Documentation Changes

Are all docstrings for user-facing APIs updated if required? Do we need to make documentation changes in the docs section?

[github-actions]

Reviewer Checklist

Please leverage this checklist to ensure your code review is thorough before approving

Testing, Bugs, Errors, Logs, Documentation

• Can you think of any use case in which the code does not behave as intended? Have they been tested?
• Can you think of any inputs or external events that could break the code? Is user input validated and safe? Have they been tested?
• If appropriate, are there adequate property based tests?
• If appropriate, are there adequate unit tests?
• Should any logging, debugging, tracing information be added or removed?
• Are error messages user-friendly?
• Have all documentation changes needed been made?
• Have all non-obvious changes been commented?

System Compatibility

• Are there any potential impacts on other parts of the system or backward compatibility?
• Does this change intersect with any items on our roadmap, and if so, is there a plan for fitting them together?

Quality

• Is this code of a unexpectedly high quality (Readability, Modularity, Intuitiveness)

[Sicheng-Pan]

• [ENH] Add CMEK to collection schema #5975
• [ENH] Log service CMEK support #5971
• [ENH] Compactor CMEK support #5964
• [ENH] Update PutOptions #5953
• [ENH] CMEK support in storage #5949 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[propel-code-bot]

Add CMEK plumbing for object storage clients

The PR introduces CMEK-awareness into the storage layer by threading an optional Cmek through PutOptions, teaching the object-store client to attach Google KMS headers via a custom ChromaHttpClient, and extending integration tests to cover GCS CMEK scenarios. Supporting changes include a new Cmek enum in chroma_types, updates to test utilities/signatures to pass nullable CMEK values, refreshed GCS test documentation, and adding chroma-types as a storage dependency.
The review should focus on ensuring the new HTTP connector correctly propagates CMEK headers, that all call sites account for the extended PutOptions::new signature, and that the CMEK-aware tests remain gated behind #[ignore] yet provide clear setup guidance.

Key Changes

• Introduce Cmek enum in chroma_types and plumb optional CMEK through PutOptions, including constructors and defaults
• Add ChromaHttpConnector/ChromaHttpClient so GCS uploads inject x-goog-encryption-kms-key-name when the request’s extensions carry a Cmek
• Update ObjectStorage and AdmissionControlledS3Storage multipart and oneshot put paths to forward CMEK metadata via object-store extensions
• Revise storage integration utilities/tests to accept optional CMEK parameters and add GCS CMEK happy/negative-path coverage (kept ignored by default)
• Refresh GCS test instructions/constants and add chroma-types dependency to the storage crate

Affected Areas

• rust/types/src/collection_schema.rs
• rust/storage/src/lib.rs
• rust/storage/src/object_storage.rs
• rust/storage/src/admissioncontrolleds3.rs
• rust/storage/src/s3.rs
• rust/storage/tests/object_storage_integration_test.rs
• rust/storage/tests/utils.rs
• rust/storage/Cargo.toml

This summary was automatically generated by @propel-code-bot