chore(ci): push release artifacts to Cloudflare R2 instead of AWS S3 - #6241
Merged
Conversation
Retarget uploads from AWS S3 bucket dl.influxdata.com to Cloudflare R2 bucket dl-influxdata-com. Artifact key paths are unchanged. - build.py: read AWS_ENDPOINT_URL_S3, use region auto for R2, drop per-object public-read ACL (R2 rejects canned ACLs), drop IMDS tuning - config.yml: update --bucket args; replace aws-s3 orb signature sync with plain aws s3 sync against the R2 endpoint
bednar
requested changes
Aug 3, 2026
bednar
left a comment
bednar
left a comment
Contributor
There was a problem hiding this comment.
Requesting the inline change described below.
AWS CLI v1 (current botocore) defaults request checksums to CRC32, which Cloudflare R2 may reject on single-part PutObject uploads. Set AWS_REQUEST_CHECKSUM_CALCULATION=when_required, matching the pattern used by telegraf and influxctl. Integrity remains protected via the SigV4 x-amz-content-sha256 hash and R2's MD5 ETag.
bednar
approved these changes
Aug 4, 2026
bednar
left a comment
bednar
left a comment
Contributor
There was a problem hiding this comment.
The requested checksum compatibility change has been addressed. The updated diff and CI checks look good.
This was referenced Aug 4, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Briefly describe your proposed changes:
Retargets CI artifact uploads from the AWS S3 bucket
dl.influxdata.comto theCloudflare R2 bucket
dl-influxdata-com. Artifact key paths are unchanged(
chronograf/releases/...,chronograf/artifacts/...).What was the problem?
Build artifacts and package signatures were pushed to AWS S3; distribution has
moved to Cloudflare R2. Finishing this will allow us to stop our Sippy replication
job.
What was the solution?
etc/build.py:upload_packages()now reads the standardAWS_ENDPOINT_URL_S3environmentvariable and passes it to the boto3 client with
region_name="auto"(requiredby R2). If the variable is unset, behavior falls back to plain AWS S3.
DEFAULT_BUCKETchanged todl-influxdata-com/chronograf/artifacts.public-readACL — R2 rejects canned ACLs; publicaccess is served via the bucket's custom domain (dl.influxdata.com).
.circleci/config.yml:--bucketnowdl-influxdata-com/chronograf/releasesin deploy-nightly,deploy-pre-release, and deploy-release.
packages-upload-signaturesreplaces theaws-s3orb with a plainaws s3 sync --endpoint-url "${AWS_ENDPOINT_URL_S3}" --region auto; theunused orb was removed.
Rollout (before merge):
AWS_ENDPOINT_URL_S3variable created in CircleCI project settingsAWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEYvalues to the R2 token pair in CircleCI
py_compileclean