Chris Lu 69da20bdae volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441) ...

volume: require admin auth and refuse loopback endpoints in FetchAndWriteNeedle

Gate the RPC behind checkGrpcAdminAuth for parity with the rest of the
destructive volume-server RPCs, and reject cluster-internal remote S3
endpoints (loopback / link-local / IMDS / RFC 1918 / CGNAT) before
dialing. Pin the validated address against DNS rebinding by routing the
AWS SDK through an HTTP transport whose DialContext re-resolves the host
and re-applies the deny list on every dial, so an endpoint that resolves
to a public IP at validate-time and then flips to 127.0.0.1 at connect
time is refused. Operators that legitimately fetch from private hosts
can opt out with -volume.allowUntrustedRemoteEndpoints.

2026-05-12 10:11:20 -07:00

..

azure

fix(remote-storage/azure): fix re-cache of large remote blobs (#9174) (#9179)

2026-04-21 14:56:36 -07:00

gcs

feat(filer): add lazy directory listing for remote mounts (#8615)

2026-03-13 09:36:54 -07:00

s3

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

remote_storage.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

track_sync_offset.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00