mirrors/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-08-20 06:07:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

s3: propagate IAM changes from standalone weed s3 to peer pods (#10095)

Browse Source 
Standalone weed s3 created a master client and registered the receiving
SeaweedS3IamCache gRPC service, but never wrapped its credential store
with the propagating store. Only the filer-embedded path called
SetMasterClient, so IAM mutations on one s3 pod never reached peers; they
served a stale in-memory identity cache and returned InvalidAccessKeyId
until restarted.

Wrap the credential store with the master client when one is available,
mirroring the filer path, so mutations fan out over the existing gRPC
cache service.
This commit is contained in:
Chris Lu
2026-06-24 16:26:08 -07:00
committed by GitHub
parent c15989387b
commit cd828f6503
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
weed/s3api/s3api_server.go
+9 -1
View File
@@ -216,6 +216,12 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
// Update credential store to use FilerClient's current filer for HA
iam.SetFilerClient(filerClient)
// Fan IAM mutations out to peer S3 servers, mirroring the filer-embedded path.
iamPropagationEnabled := masterClient != nil && iam.credentialManager != nil
if iamPropagationEnabled {
iam.credentialManager.SetMasterClient(masterClient, option.GrpcDialOption)
}
// Keep attempting to load configuration from filer now that we have a client
// The initial load in NewIdentityAccessManagementWithStore might have failed if client was nil
go func() {
@@ -381,8 +387,10 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
s3ApiServer.embeddedIam = NewEmbeddedIamApi(s3ApiServer.credentialManager, iam, option.IamReadOnly)
if option.IamReadOnly {
glog.V(1).Infof("Embedded IAM API initialized in read-only mode (use -s3.iam.readOnly=false to enable write operations)")
} else if iamPropagationEnabled {
glog.V(1).Infof("Embedded IAM API initialized in writable mode (updates propagate to other S3 servers)")
} else {
glog.V(1).Infof("Embedded IAM API initialized in writable mode (WARNING: updates will not be propagated to other S3 servers)")
glog.Warningf("Embedded IAM API initialized in writable mode but no master is configured; updates will not be propagated to other S3 servers")
}
}