From cd828f650355b2bb2a97a8866ac07a340b29694a Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 24 Jun 2026 16:26:08 -0700 Subject: [PATCH] s3: propagate IAM changes from standalone weed s3 to peer pods (#10095) Standalone weed s3 created a master client and registered the receiving SeaweedS3IamCache gRPC service, but never wrapped its credential store with the propagating store. Only the filer-embedded path called SetMasterClient, so IAM mutations on one s3 pod never reached peers; they served a stale in-memory identity cache and returned InvalidAccessKeyId until restarted. Wrap the credential store with the master client when one is available, mirroring the filer path, so mutations fan out over the existing gRPC cache service. --- weed/s3api/s3api_server.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/weed/s3api/s3api_server.go b/weed/s3api/s3api_server.go index 53565dca2..ed3431ad8 100644 --- a/weed/s3api/s3api_server.go +++ b/weed/s3api/s3api_server.go @@ -216,6 +216,12 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl // Update credential store to use FilerClient's current filer for HA iam.SetFilerClient(filerClient) + // Fan IAM mutations out to peer S3 servers, mirroring the filer-embedded path. + iamPropagationEnabled := masterClient != nil && iam.credentialManager != nil + if iamPropagationEnabled { + iam.credentialManager.SetMasterClient(masterClient, option.GrpcDialOption) + } + // Keep attempting to load configuration from filer now that we have a client // The initial load in NewIdentityAccessManagementWithStore might have failed if client was nil go func() { @@ -381,8 +387,10 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl s3ApiServer.embeddedIam = NewEmbeddedIamApi(s3ApiServer.credentialManager, iam, option.IamReadOnly) if option.IamReadOnly { glog.V(1).Infof("Embedded IAM API initialized in read-only mode (use -s3.iam.readOnly=false to enable write operations)") + } else if iamPropagationEnabled { + glog.V(1).Infof("Embedded IAM API initialized in writable mode (updates propagate to other S3 servers)") } else { - glog.V(1).Infof("Embedded IAM API initialized in writable mode (WARNING: updates will not be propagated to other S3 servers)") + glog.Warningf("Embedded IAM API initialized in writable mode but no master is configured; updates will not be propagated to other S3 servers") } }