* S3: Implement IAM defaults and STS signing key fallback logic * S3: Refactor startup order to init SSE-S3 key manager before IAM * S3: Derive STS signing key from KEK using HKDF for security isolation * S3: Document STS signing key fallback in security.toml * fix(s3api): refine anonymous access logic and secure-by-default behavior - Initialize anonymous identity by default in `NewIdentityAccessManagement` to prevent nil pointer exceptions. - Ensure `ReplaceS3ApiConfiguration` preserves the anonymous identity if not present in the new configuration. - Update `NewIdentityAccessManagement` signature to accept `filerClient`. - In legacy mode (no policy engine), anonymous defaults to Deny (no actions), preserving secure-by-default behavior. - Use specific `LookupAnonymous` method instead of generic map lookup. - Update tests to accommodate signature changes and verify improved anonymous handling. * feat(s3api): make IAM configuration optional - Start S3 API server without a configuration file if `EnableIam` option is set. - Default to `Allow` effect for policy engine when no configuration is provided (Zero-Config mode). - Handle empty configuration path gracefully in `loadIAMManagerFromConfig`. - Add integration test `iam_optional_test.go` to verify empty config behavior. * fix(iamapi): fix signature mismatch in NewIdentityAccessManagementWithStore * fix(iamapi): properly initialize FilerClient instead of passing nil * fix(iamapi): properly initialize filer client for IAM management - Instead of passing `nil`, construct a `wdclient.FilerClient` using the provided `Filers` addresses. - Ensure `NewIdentityAccessManagementWithStore` receives a valid `filerClient` to avoid potential nil pointer dereferences or limited functionality. * clean: remove dead code in s3api_server.go * refactor(s3api): improve IAM initialization, safety and anonymous access security * fix(s3api): ensure IAM config loads from filer after client init * fix(s3): resolve test failures in integration, CORS, and tagging tests - Fix CORS tests by providing explicit anonymous permissions config - Fix S3 integration tests by setting admin credentials in init - Align tagging test credentials in CI with IAM defaults - Added goroutine to retry IAM config load in iamapi server * fix(s3): allow anonymous access to health targets and S3 Tables when identities are present * fix(ci): use /healthz for Caddy health check in awscli tests * iam, s3api: expose DefaultAllow from IAM and Policy Engine This allows checking the global "Open by Default" configuration from other components like S3 Tables. * s3api/s3tables: support DefaultAllow in permission logic and handler Updated CheckPermissionWithContext to respect the DefaultAllow flag in PolicyContext. This enables "Open by Default" behavior for unauthenticated access in zero-config environments. Added a targeted unit test to verify the logic. * s3api/s3tables: propagate DefaultAllow through handlers Propagated the DefaultAllow flag to individual handlers for namespaces, buckets, tables, policies, and tagging. This ensures consistent "Open by Default" behavior across all S3 Tables API endpoints. * s3api: wire up DefaultAllow for S3 Tables API initialization Updated registerS3TablesRoutes to query the global IAM configuration and set the DefaultAllow flag on the S3 Tables API server. This completes the end-to-end propagation required for anonymous access in zero-config environments. Added a SetDefaultAllow method to S3TablesApiServer to facilitate this. * s3api: fix tests by adding DefaultAllow to mock IAM integrations The IAMIntegration interface was updated to include DefaultAllow(), breaking several mock implementations in tests. This commit fixes the build errors by adding the missing method to the mocks. * env * ensure ports * env * env * fix default allow * add one more test using non-anonymous user * debug * add more debug * less logs
542 lines
15 KiB
YAML
542 lines
15 KiB
YAML
name: "S3 Go Tests"
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.head_ref }}/s3-go-tests
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: weed
|
|
|
|
jobs:
|
|
s3-versioning-tests:
|
|
name: S3 Versioning Tests
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 30
|
|
strategy:
|
|
matrix:
|
|
test-type: ["quick", "comprehensive"]
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Versioning Tests - ${{ matrix.test-type }}
|
|
timeout-minutes: 25
|
|
working-directory: test/s3/versioning
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
df -h
|
|
echo "=== Starting Tests ==="
|
|
|
|
# Run tests with automatic server management
|
|
# The test-with-server target handles server startup/shutdown automatically
|
|
if [ "${{ matrix.test-type }}" = "quick" ]; then
|
|
# Override TEST_PATTERN for quick tests only
|
|
make test-with-server TEST_PATTERN="TestBucketListReturnDataVersioning|TestVersioningBasicWorkflow|TestVersioningDeleteMarkers"
|
|
else
|
|
# Run all versioning tests
|
|
make test-with-server
|
|
fi
|
|
|
|
- name: Show server logs on failure
|
|
if: failure()
|
|
working-directory: test/s3/versioning
|
|
run: |
|
|
echo "=== Server Logs ==="
|
|
if [ -f weed-test.log ]; then
|
|
echo "Last 100 lines of server logs:"
|
|
tail -100 weed-test.log
|
|
else
|
|
echo "No server log file found"
|
|
fi
|
|
|
|
echo "=== Test Environment ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
netstat -tlnp | grep -E "(8333|9333|8080)" || true
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-versioning-test-logs-${{ matrix.test-type }}
|
|
path: test/s3/versioning/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-versioning-compatibility:
|
|
name: S3 Versioning Compatibility Test
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run Core Versioning Test (Python s3tests equivalent)
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/versioning
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Run the specific test that is equivalent to the Python s3tests
|
|
make test-with-server || {
|
|
echo "❌ Test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -100 weed-test.log
|
|
fi
|
|
echo "=== Process information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
exit 1
|
|
}
|
|
|
|
- name: Upload server logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-versioning-compatibility-logs
|
|
path: test/s3/versioning/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-cors-compatibility:
|
|
name: S3 CORS Compatibility Test
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run Core CORS Test (AWS S3 compatible)
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/cors
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Run the specific test that is equivalent to AWS S3 CORS behavior
|
|
make test-with-server || {
|
|
echo "❌ Test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -100 weed-test.log
|
|
fi
|
|
echo "=== Process information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
exit 1
|
|
}
|
|
|
|
- name: Upload server logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-cors-compatibility-logs
|
|
path: test/s3/cors/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-retention-tests:
|
|
name: S3 Retention Tests
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 30
|
|
strategy:
|
|
matrix:
|
|
test-type: ["quick", "comprehensive"]
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Retention Tests - ${{ matrix.test-type }}
|
|
timeout-minutes: 25
|
|
working-directory: test/s3/retention
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
df -h
|
|
echo "=== Starting Tests ==="
|
|
|
|
# Run tests with automatic server management
|
|
# The test-with-server target handles server startup/shutdown automatically
|
|
if [ "${{ matrix.test-type }}" = "quick" ]; then
|
|
# Override TEST_PATTERN for quick tests only
|
|
make test-with-server TEST_PATTERN="TestBasicRetentionWorkflow|TestRetentionModeCompliance|TestLegalHoldWorkflow"
|
|
else
|
|
# Run all retention tests
|
|
make test-with-server
|
|
fi
|
|
|
|
- name: Show server logs on failure
|
|
if: failure()
|
|
working-directory: test/s3/retention
|
|
run: |
|
|
echo "=== Server Logs ==="
|
|
if [ -f weed-test.log ]; then
|
|
echo "Last 100 lines of server logs:"
|
|
tail -100 weed-test.log
|
|
else
|
|
echo "No server log file found"
|
|
fi
|
|
|
|
echo "=== Test Environment ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
netstat -tlnp | grep -E "(8333|9333|8080)" || true
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-retention-test-logs-${{ matrix.test-type }}
|
|
path: test/s3/retention/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-cors-tests:
|
|
name: S3 CORS Tests
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 30
|
|
strategy:
|
|
matrix:
|
|
test-type: ["quick", "comprehensive"]
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 CORS Tests - ${{ matrix.test-type }}
|
|
timeout-minutes: 25
|
|
working-directory: test/s3/cors
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
df -h
|
|
echo "=== Starting Tests ==="
|
|
|
|
# Run tests with automatic server management
|
|
# The test-with-server target handles server startup/shutdown automatically
|
|
if [ "${{ matrix.test-type }}" = "quick" ]; then
|
|
# Override TEST_PATTERN for quick tests only
|
|
make test-with-server TEST_PATTERN="TestCORSConfigurationManagement|TestServiceLevelCORS|TestCORSBasicWorkflow"
|
|
else
|
|
# Run all CORS tests
|
|
make test-with-server
|
|
fi
|
|
|
|
- name: Show server logs on failure
|
|
if: failure()
|
|
working-directory: test/s3/cors
|
|
run: |
|
|
echo "=== Server Logs ==="
|
|
if [ -f weed-test.log ]; then
|
|
echo "Last 100 lines of server logs:"
|
|
tail -100 weed-test.log
|
|
else
|
|
echo "No server log file found"
|
|
fi
|
|
|
|
echo "=== Test Environment ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
netstat -tlnp | grep -E "(8333|9333|8080)" || true
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-cors-test-logs-${{ matrix.test-type }}
|
|
path: test/s3/cors/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-retention-worm:
|
|
name: S3 Retention WORM Integration Test
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run WORM Integration Tests
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/retention
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Run the WORM integration tests with automatic server management
|
|
# The test-with-server target handles server startup/shutdown automatically
|
|
make test-with-server TEST_PATTERN="TestWORM|TestRetentionExtendedAttributes|TestRetentionConcurrentOperations" || {
|
|
echo "❌ WORM integration test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -100 weed-test.log
|
|
fi
|
|
echo "=== Process information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
exit 1
|
|
}
|
|
|
|
- name: Upload server logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-retention-worm-logs
|
|
path: test/s3/retention/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-versioning-stress:
|
|
name: S3 Versioning Stress Test
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 35
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Versioning Stress Tests
|
|
timeout-minutes: 30
|
|
working-directory: test/s3/versioning
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Start server for stress tests
|
|
make start-server
|
|
|
|
# Run stress tests (concurrent operations)
|
|
make test-versioning-stress || {
|
|
echo "❌ Stress test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -200 weed-test.log
|
|
fi
|
|
make stop-server
|
|
make clean
|
|
exit 1
|
|
}
|
|
|
|
# Run pagination stress tests (>1000 versions)
|
|
echo "=== Running pagination stress tests ==="
|
|
make test-versioning-pagination-stress || {
|
|
echo "❌ Pagination stress test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -200 weed-test.log
|
|
fi
|
|
make stop-server
|
|
make clean
|
|
exit 1
|
|
}
|
|
|
|
make stop-server
|
|
make clean
|
|
|
|
- name: Upload stress test logs
|
|
if: always()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-versioning-stress-logs
|
|
path: test/s3/versioning/weed-test*.log
|
|
retention-days: 7
|
|
|
|
s3-tagging-tests:
|
|
# CI job for S3 object tagging tests
|
|
name: S3 Tagging Tests
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Tagging Tests
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/tagging
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Set environment variables for the test
|
|
export S3_ENDPOINT="http://localhost:8006"
|
|
export S3_ACCESS_KEY="0555b35654ad1656d804"
|
|
export S3_SECRET_KEY="h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q=="
|
|
export AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY"
|
|
export AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY"
|
|
|
|
# Run the specific test that is equivalent to AWS S3 tagging behavior
|
|
make test-with-server || {
|
|
echo "❌ Test failed, checking logs..."
|
|
if [ -f weed-test.log ]; then
|
|
echo "=== Server logs ==="
|
|
tail -100 weed-test.log
|
|
fi
|
|
echo "=== Process information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
exit 1
|
|
}
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-tagging-test-logs
|
|
path: test/s3/tagging/weed-test*.log
|
|
retention-days: 3
|
|
|
|
s3-remote-cache-tests:
|
|
name: S3 Remote Cache Tests
|
|
runs-on: ubuntu-22.04
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
id: go
|
|
|
|
- name: Install SeaweedFS
|
|
run: |
|
|
go install -buildvcs=false
|
|
|
|
- name: Run S3 Remote Cache Tests
|
|
timeout-minutes: 15
|
|
working-directory: test/s3/remote_cache
|
|
run: |
|
|
set -x
|
|
echo "=== System Information ==="
|
|
uname -a
|
|
free -h
|
|
|
|
# Run the remote cache integration tests
|
|
# Tests singleflight deduplication for caching remote objects
|
|
make test-with-server || {
|
|
echo "❌ Test failed, checking logs..."
|
|
if [ -f primary-weed.log ]; then
|
|
echo "=== Primary server logs ==="
|
|
tail -100 primary-weed.log
|
|
fi
|
|
if [ -f remote-weed.log ]; then
|
|
echo "=== Remote server logs ==="
|
|
tail -100 remote-weed.log
|
|
fi
|
|
echo "=== Process information ==="
|
|
ps aux | grep -E "(weed|test)" || true
|
|
exit 1
|
|
}
|
|
|
|
- name: Upload test logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: s3-remote-cache-test-logs
|
|
path: |
|
|
test/s3/remote_cache/primary-weed.log
|
|
test/s3/remote_cache/remote-weed.log
|
|
retention-days: 3
|
|
|
|
# Removed SSE-C integration tests and compatibility job |