551a31e156
* Implement IAM propagation to S3 servers - Add PropagatingCredentialStore to propagate IAM changes to S3 servers via gRPC - Add Policy management RPCs to S3 proto and S3ApiServer - Update CredentialManager to use PropagatingCredentialStore when MasterClient is available - Wire FilerServer to enable propagation * Implement parallel IAM propagation and fix S3 cluster registration - Parallelized IAM change propagation with 10s timeout. - Refined context usage in PropagatingCredentialStore. - Added S3Type support to cluster node management. - Enabled S3 servers to register with gRPC address to the master. - Ensured IAM configuration reload after policy updates via gRPC. * Optimize IAM propagation with direct in-memory cache updates * Secure IAM propagation: Use metadata to skip persistence only on propagation * pb: refactor IAM and S3 services for unidirectional IAM propagation - Move SeaweedS3IamCache service from iam.proto to s3.proto. - Remove legacy IAM management RPCs and empty SeaweedS3 service from s3.proto. - Enforce that S3 servers only use the synchronization interface. * pb: regenerate Go code for IAM and S3 services Updated generated code following the proto refactoring of IAM synchronization services. * s3api: implement read-only mode for Embedded IAM API - Add readOnly flag to EmbeddedIamApi to reject write operations via HTTP. - Enable read-only mode by default in S3ApiServer. - Handle AccessDenied error in writeIamErrorResponse. - Embed SeaweedS3IamCacheServer in S3ApiServer. * credential: refactor PropagatingCredentialStore for unidirectional IAM flow - Update to use s3_pb.SeaweedS3IamCacheClient for propagation to S3 servers. - Propagate full Identity object via PutIdentity for consistency. - Remove redundant propagation of specific user/account/policy management RPCs. - Add timeout context for propagation calls. * s3api: implement SeaweedS3IamCacheServer for unidirectional sync - Update S3ApiServer to implement the cache synchronization gRPC interface. - Methods (PutIdentity, RemoveIdentity, etc.) now perform direct in-memory cache updates. - Register SeaweedS3IamCacheServer in command/s3.go. - Remove registration for the legacy and now empty SeaweedS3 service. * s3api: update tests for read-only IAM and propagation - Added TestEmbeddedIamReadOnly to verify rejection of write operations in read-only mode. - Update test setup to pass readOnly=false to NewEmbeddedIamApi in routing tests. - Updated EmbeddedIamApiForTest helper with read-only checks matching production behavior. * s3api: add back temporary debug logs for IAM updates Log IAM updates received via: - gRPC propagation (PutIdentity, PutPolicy, etc.) - Metadata configuration reloads (LoadS3ApiConfigurationFromCredentialManager) - Core identity management (UpsertIdentity, RemoveIdentity) * IAM: finalize propagation fix with reduced logging and clarified architecture * Allow configuring IAM read-only mode for S3 server integration tests * s3api: add defensive validation to UpsertIdentity * s3api: fix log message to reference correct IAM read-only flag * test/s3/iam: ensure WaitForS3Service checks for IAM write permissions * test: enable writable IAM in Makefile for integration tests * IAM: add GetPolicy/ListPolicies RPCs to s3.proto * S3: add GetBucketPolicy and ListBucketPolicies helpers * S3: support storing generic IAM policies in IdentityAccessManagement * S3: implement IAM policy RPCs using IdentityAccessManagement * IAM: fix stale user identity on rename propagation
62 lines
1.8 KiB
Protocol Buffer
62 lines
1.8 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package messaging_pb;
|
|
|
|
option go_package = "github.com/seaweedfs/seaweedfs/weed/pb/s3_pb";
|
|
option java_package = "seaweedfs.client";
|
|
option java_outer_classname = "S3Proto";
|
|
|
|
//////////////////////////////////////////////////
|
|
|
|
import "iam.proto";
|
|
|
|
// Designed for unidirectional propagation from Filer to S3 Servers
|
|
service SeaweedS3IamCache {
|
|
rpc PutIdentity (iam_pb.PutIdentityRequest) returns (iam_pb.PutIdentityResponse);
|
|
rpc RemoveIdentity (iam_pb.RemoveIdentityRequest) returns (iam_pb.RemoveIdentityResponse);
|
|
rpc PutPolicy (iam_pb.PutPolicyRequest) returns (iam_pb.PutPolicyResponse);
|
|
rpc GetPolicy (iam_pb.GetPolicyRequest) returns (iam_pb.GetPolicyResponse);
|
|
rpc ListPolicies (iam_pb.ListPoliciesRequest) returns (iam_pb.ListPoliciesResponse);
|
|
rpc DeletePolicy (iam_pb.DeletePolicyRequest) returns (iam_pb.DeletePolicyResponse);
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
|
|
message S3CircuitBreakerConfig {
|
|
S3CircuitBreakerOptions global=1;
|
|
map<string, S3CircuitBreakerOptions> buckets= 2;
|
|
}
|
|
|
|
message S3CircuitBreakerOptions {
|
|
bool enabled=1;
|
|
map<string, int64> actions = 2;
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
// Bucket Metadata
|
|
|
|
message CORSRule {
|
|
repeated string allowed_headers = 1;
|
|
repeated string allowed_methods = 2;
|
|
repeated string allowed_origins = 3;
|
|
repeated string expose_headers = 4;
|
|
int32 max_age_seconds = 5;
|
|
string id = 6;
|
|
}
|
|
|
|
message CORSConfiguration {
|
|
repeated CORSRule cors_rules = 1;
|
|
}
|
|
|
|
message BucketMetadata {
|
|
map<string, string> tags = 1;
|
|
CORSConfiguration cors = 2;
|
|
EncryptionConfiguration encryption = 3;
|
|
}
|
|
|
|
message EncryptionConfiguration {
|
|
string sse_algorithm = 1; // "AES256" or "aws:kms"
|
|
string kms_key_id = 2; // KMS key ID (optional for aws:kms)
|
|
bool bucket_key_enabled = 3; // S3 Bucket Keys optimization
|
|
}
|