pkg/storage/s3: enable bucket key on encryption settings

using this setting enables a key to be used for the entire bucket
instead of AWS creating one key per object.
for more info see
https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html.

Author: flavianmissi

pkg/storage/s3/s3.go

@@ -794,12 +794,14 @@ func (d *driver) CreateStorage(cr *imageregistryv1.Config) error {
 			encryptionType = s3.ServerSideEncryptionAes256
 		}
 
+		enableBucketKey := true
 		_, err = svc.PutBucketEncryptionWithContext(d.Context, &s3.PutBucketEncryptionInput{
 			Bucket: aws.String(d.Config.Bucket),
 			ServerSideEncryptionConfiguration: &s3.ServerSideEncryptionConfiguration{
 				Rules: []*s3.ServerSideEncryptionRule{
 					{
 						ApplyServerSideEncryptionByDefault: encryption,
+						BucketKeyEnabled:                   &enableBucketKey,
 					},
 				},
 			},

test/e2e/aws_test.go

@@ -226,7 +226,7 @@ func TestAWSDefaults(t *testing.T) {
 					ApplyServerSideEncryptionByDefault: &s3.ServerSideEncryptionByDefault{
 						SSEAlgorithm: aws.String(s3.ServerSideEncryptionAes256),
 					},
-					BucketKeyEnabled: aws.Bool(false),
+					BucketKeyEnabled: aws.Bool(true),
 				},
 			},
 		}
@@ -552,7 +552,7 @@ func TestAWSChangeS3Encryption(t *testing.T) {
 				ApplyServerSideEncryptionByDefault: &s3.ServerSideEncryptionByDefault{
 					SSEAlgorithm: aws.String(s3.ServerSideEncryptionAes256),
 				},
-				BucketKeyEnabled: aws.Bool(false),
+				BucketKeyEnabled: aws.Bool(true),
 			},
 		},
 	}
@@ -602,7 +602,7 @@ func TestAWSChangeS3Encryption(t *testing.T) {
 							SSEAlgorithm:   aws.String(s3.ServerSideEncryptionAwsKms),
 							KMSMasterKeyID: aws.String("testKey"),
 						},
-						BucketKeyEnabled: aws.Bool(false),
+						BucketKeyEnabled: aws.Bool(true),
 					},
 				},
 			}