Chris LuandGitHub e9cde3e4b1 master: gate raft membership RPCs behind the admin whitelist (#10649) ...

* master: evict a dead peer via the local raft handle

OnPeerUpdate only runs on the leader, and the AddVoter branch right above
mutates the local raft directly. The remove branch instead dialed our own
RaftRemoveServer back over gRPC. Drop the self-dial and remove the peer
through the local handle, matching the add path. This also leaves operator
tooling as the only caller of the RaftRemoveServer RPC.

* master: require whitelist auth for raft membership RPCs

RaftAddServer, RaftRemoveServer and RaftLeadershipTransfer rewrite raft
quorum but had no caller check beyond "am I the leader". Any client that
could reach the master gRPC port could add an unreachable phantom voter
and stall the write path.

Gate the three on the admin whitelist, mirroring the volume server's
checkGrpcAdminAuth. With no whitelist configured the guard allows every
caller, so default and single-master deployments are unaffected;
operators who set -whiteList get these RPCs locked down to it. The
leader's own dead-peer eviction no longer dials these RPCs, so the only
remaining callers are operator tooling.

2026-08-08 09:14:57 -07:00

..

constants

…

filer_ui

Fix UI prefix url encoding (#9344)

2026-05-06 19:14:36 -07:00

master_ui

feat: improve aio support for admin/volume ingress and fix UI links (#8679)

2026-03-18 13:20:55 -07:00

postgres

fix(postgres): prevent uint32 underflow & OOM in message parsing (#10099)

2026-06-24 20:05:43 -07:00

volume_server_ui

…

common_test.go

fix: avoid reading upload body when writing JSON errors (#10073)

2026-06-23 20:20:11 -07:00

common.go

fix: avoid reading upload body when writing JSON errors (#10073)

2026-06-23 20:20:11 -07:00

filer_grpc_server_admin.go

mount: report data sizes to df with -df.logical (#10459)

2026-07-27 14:28:29 -07:00

filer_grpc_server_chunk_condition_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_condition_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_condition.go

filer: conditional UpdateEntry with a chunk-set write condition (#10382)

2026-07-21 00:19:15 -07:00

filer_grpc_server_create_lock_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_dlm_test.go

dlm: resilient distributed locks via consistent hashing + backup replication (#8860)

2026-03-30 23:29:56 -07:00

filer_grpc_server_dlm.go

dlm: resilient distributed locks via consistent hashing + backup replication (#8860)

2026-03-30 23:29:56 -07:00

filer_grpc_server_kv.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_grpc_server_mount_peer_test.go

chore(filer): remove -mount.p2p flag; registry is always on (#9183)

2026-04-21 23:00:11 -07:00

filer_grpc_server_mount_peer.go

chore(filer): remove -mount.p2p flag; registry is always on (#9183)

2026-04-21 23:00:11 -07:00

filer_grpc_server_object_txn_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_object_txn_ttl_test.go

[s3] force filer apply s3 expiry metadata (#10469)

2026-08-05 23:55:20 -07:00

filer_grpc_server_posix_lock_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_posix_lock.go

filer: warm-up + fail-closed cooling for POSIX locks on owner (re)start (#9673)

2026-05-25 13:14:05 -07:00

filer_grpc_server_recompute_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_remote.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_grpc_server_rename_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_rename.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_grpc_server_statistics_test.go

mount: report data sizes to df with -df.logical (#10459)

2026-07-27 14:28:29 -07:00

filer_grpc_server_stream_mutate_bench_test.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate_scheduler_test.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate_scheduler.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_sub_meta_gap_test.go

fix(filer): stop skipping recent unflushed events on metadata subscription gaps (#10501)

2026-08-02 00:06:22 -07:00

filer_grpc_server_sub_meta_prefilter_test.go

Cut per-subscriber replay decode and widen replay concurrency (#9917)

2026-06-10 13:08:34 -07:00

filer_grpc_server_sub_meta_test.go

Cut per-subscriber replay decode and widen replay concurrency (#9917)

2026-06-10 13:08:34 -07:00

filer_grpc_server_sub_meta.go

fix(filer): stop skipping recent unflushed events on metadata subscription gaps (#10501)

2026-08-02 00:06:22 -07:00

filer_grpc_server_subscribers.go

admin: add connected Mount Clients page and dashboard section (#9968)

2026-06-14 21:44:10 -07:00

filer_grpc_server_test.go

fix(filer): apply default disk type after location-prefix resolution in gRPC AssignVolume (#8836)

2026-03-29 14:18:24 -07:00

filer_grpc_server_traverse_meta_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

filer_grpc_server_traverse_meta.go

filer: bound TraverseBfsMetadata memory by queuing directory paths (#9814)

2026-06-03 10:28:42 -07:00

filer_grpc_server.go

filer: list directories without decoding chunk lists (#10616)

2026-08-07 12:03:18 -07:00

filer_jwt_test.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00

filer_pipelined_sender_test.go

fix(filer): stop skipping recent unflushed events on metadata subscription gaps (#10501)

2026-08-02 00:06:22 -07:00

filer_server_handlers_copy_test.go

Use filer-side copy for mounted whole-file copy_file_range (#8747)

2026-03-23 18:35:15 -07:00

filer_server_handlers_copy.go

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

filer_server_handlers_iam_grpc_test.go

filer/iam-grpc: make admin Bearer auth opt-in (fixes #9509) (#9514)

2026-05-15 13:15:20 -07:00

filer_server_handlers_iam_grpc.go

filer/iam-grpc: make admin Bearer auth opt-in (fixes #9509) (#9514)

2026-05-15 13:15:20 -07:00

filer_server_handlers_proxy_test.go

test: stop comparing two JWTs minted a second apart (#10495)

2026-07-30 12:23:12 -07:00

filer_server_handlers_proxy.go

filer: drop a caller's jwt query param on a proxied read (#10440)

2026-07-25 19:54:41 -07:00

filer_server_handlers_read_dir.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_server_handlers_read.go

filer: fix credential handling on the proxyChunkId path (#10434)

2026-07-25 11:17:00 -07:00

filer_server_handlers_tagging.go

filer: reuse the caller's fetched entry in CreateEntry (#9645)

2026-05-23 21:40:41 -07:00

filer_server_handlers_write_autochunk.go

filer: let a nested path rule turn worm off (#10503)

2026-07-31 00:34:22 -07:00

filer_server_handlers_write_merge.go

…

filer_server_handlers_write_upload.go

fix(mount): remove fid pool to stop master over-allocating volumes (#9111)

2026-04-16 15:51:13 -07:00

filer_server_handlers_write.go

filer: add a placement overlay seam for the write path (#10437)

2026-07-25 11:20:41 -07:00

filer_server_handlers.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server_rocksdb.go

go fix

2026-02-20 18:42:00 -08:00

filer_server_tus_handlers.go

filer: configurable TUS max upload size and session expiry (#10638)

2026-08-07 21:56:15 -07:00

filer_server_tus_idor_test.go

filer: configurable TUS max upload size and session expiry (#10638)

2026-08-07 21:56:15 -07:00

filer_server_tus_jwt_test.go

filer: configurable TUS max upload size and session expiry (#10638)

2026-08-07 21:56:15 -07:00

filer_server_tus_session.go

filer: configurable TUS max upload size and session expiry (#10638)

2026-08-07 21:56:15 -07:00

filer_server.go

filer: configurable TUS max upload size and session expiry (#10638)

2026-08-07 21:56:15 -07:00

filer_subscribe_loop_test.go

Stop the filer test helpers from pinning gigabytes of log buffers (#10560)

2026-08-04 11:38:38 -07:00

master_grpc_server_admin_ping_test.go

master: accept volume-server Ping targets on follower masters (#9614)

2026-05-21 10:19:59 -07:00

master_grpc_server_admin.go

shell: show who holds the cluster lock (#10353)

2026-07-17 12:30:42 -07:00

master_grpc_server_assign_test.go

fix(master): let the growth initiator wait instead of shedding itself (#10202)

2026-07-02 15:13:46 -07:00

master_grpc_server_assign.go

master: assign re-picks once after its growth concludes instead of shedding (#10348)

2026-07-16 13:55:38 -07:00

master_grpc_server_changed_volumes_test.go

heartbeat: send only the volumes that changed (#10640)

2026-08-07 23:36:28 -07:00

master_grpc_server_cluster.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

master_grpc_server_collection.go

…

master_grpc_server_digest_test.go

heartbeat: send only the volumes that changed (#10640)

2026-08-07 23:36:28 -07:00

master_grpc_server_raft_auth_test.go

master: gate raft membership RPCs behind the admin whitelist (#10649)

2026-08-08 09:14:57 -07:00

master_grpc_server_raft_test.go

…

master_grpc_server_raft.go

master: gate raft membership RPCs behind the admin whitelist (#10649)

2026-08-08 09:14:57 -07:00

master_grpc_server_statistics_test.go

mount: report data sizes to df with -df.logical (#10459)

2026-07-27 14:28:29 -07:00

master_grpc_server_test.go

fix(master): notify clients after manual volume grow (#9656)

2026-06-01 20:33:37 -07:00

master_grpc_server_volume_move_test.go

topology: follow a volume that moved between a server's disks (#10628)

2026-08-07 19:44:39 -07:00

master_grpc_server_volume.go

mount: report data sizes to df with -df.logical (#10459)

2026-07-27 14:28:29 -07:00

master_grpc_server.go

heartbeat: send only the volumes that changed (#10640)

2026-08-07 23:36:28 -07:00

master_server_handlers_admin.go

fix(master): notify clients after manual volume grow (#9656)

2026-06-01 20:33:37 -07:00

master_server_handlers_ui.go

…

master_server_handlers.go

master: assign re-picks once after its growth concludes instead of shedding (#10348)

2026-07-16 13:55:38 -07:00

master_server.go

master: gate raft membership RPCs behind the admin whitelist (#10649)

2026-08-08 09:14:57 -07:00

raft_common.go

fix: improve raft leader election reliability and failover speed (#8692)

2026-03-18 23:28:07 -07:00

raft_hashicorp_test.go

Normalize hashicorp raft peer ids (#8253)

2026-02-09 07:46:34 -08:00

raft_hashicorp.go

fix: improve raft leader election reliability and failover speed (#8692)

2026-03-18 23:28:07 -07:00

raft_server_handlers.go

fix(wdclient,volume): compare master leader with ServerAddress.Equals (#9089)

2026-04-15 12:29:31 -07:00

raft_server.go

go fmt

2026-04-10 17:31:14 -07:00

volume_grpc_admin_auth_coverage_test.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_admin.go

volume: fix EC decode/reconstruct index locality under -dir.idx (#10442)

2026-07-25 23:45:02 -07:00

volume_grpc_batch_delete_test.go

volume: require admin auth on BatchDelete (#9438)

2026-05-11 13:50:48 -07:00

volume_grpc_batch_delete.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_grpc_client_to_master_test.go

volume server: route VolumeMarkReadonly to raft leader (#10120)

2026-06-26 14:22:57 -07:00

volume_grpc_client_to_master.go

heartbeat: send only the volumes that changed (#10640)

2026-08-07 23:36:28 -07:00

volume_grpc_copy_incremental.go

…

volume_grpc_copy_verify_test.go

fix(replication): verify-before-destroy in VolumeCopy, check.disk, and over-replication trim (#9943)

2026-06-13 20:05:33 -07:00

volume_grpc_copy_writefile_test.go

EC bitrot follow-ups: protect destination sidecar on optional copy; cap sidecar block_size (#9763)

2026-05-31 23:42:33 -07:00

volume_grpc_copy.go

volume: scan for on-disk EC shards when staging a decoded volume (#10465)

2026-07-27 19:37:16 -07:00

volume_grpc_ec_generation_fence_test.go

fix(ec): fence stale-worker EC shard cleanup by encode generation (#9953)

2026-06-14 01:54:04 -07:00

volume_grpc_ec_shared_index_test.go

ec: remove .ecsum sidecars on destroy / shard delete; align Go and Rust cleanup (#10307)

2026-07-10 22:06:36 -07:00

volume_grpc_erasure_coding_recover_test.go

ec: recover EC shards whose .ecx index lives only on a peer server (#10108)

2026-06-25 10:38:14 -07:00

volume_grpc_erasure_coding_recover.go

ec: recover EC shards whose .ecx index lives only on a peer server (#10108)

2026-06-25 10:38:14 -07:00

volume_grpc_erasure_coding_test.go

ec: remove .ecsum sidecars on destroy / shard delete; align Go and Rust cleanup (#10307)

2026-07-10 22:06:36 -07:00

volume_grpc_erasure_coding.go

volume: EC decode onto a clean peer via staged-new-volume adopt (Go+Rust) (#10463)

2026-07-27 17:56:17 -07:00

volume_grpc_query.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_grpc_read_all.go

volume: require admin auth on ReadAllNeedles and VolumeNeedleStatus (#9437)

2026-05-11 13:50:19 -07:00

volume_grpc_read_write.go

Export gRPC file_{read,write}_failures metrics on volume servers. (#9177)

2026-04-22 11:22:21 -07:00

volume_grpc_remote_test.go

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

volume_grpc_remote.go

[volume] preserve compression state during replication (#9946)

2026-06-13 21:52:59 -07:00

volume_grpc_scrub.go

ec: expose force_deleted_needles_check in ScrubEcVolume RPC and shell (#10176)

2026-06-30 23:20:50 -07:00

volume_grpc_state.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_tail.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_tier_download_test.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_tier_download.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_tier_test.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_tier_upload.go

volume: widen the gRPC admin gate and stop it drifting (#10443)

2026-07-25 23:53:29 -07:00

volume_grpc_vacuum.go

fix(volume): add authentication to destructive gRPC admin endpoints (#8876)

2026-05-04 21:14:55 -07:00

volume_server_handlers_admin.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

volume_server_handlers_helper.go

…

volume_server_handlers_read.go

Export file_read_invalid_needles metric for REST read requests on invalid file IDs. (#9241)

2026-04-27 12:22:42 -07:00

volume_server_handlers_ui.go

…

volume_server_handlers_write.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_server_handlers.go

security: hot-reload JWT signing keys on SIGHUP (#9826)

2026-06-04 22:26:08 -07:00

volume_server_parse_path_test.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_server.go

security: hot-reload JWT signing keys on SIGHUP (#9826)

2026-06-04 22:26:08 -07:00

webdav_listed_entries_test.go

webdav: answer PROPFIND child stats from the listing (#10492)

2026-07-30 11:58:14 -07:00

webdav_listed_entries.go

webdav: answer PROPFIND child stats from the listing (#10492)

2026-07-30 11:58:14 -07:00

webdav_server.go

webdav: answer PROPFIND child stats from the listing (#10492)

2026-07-30 11:58:14 -07:00

wrapped_webdav_fs_test.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00

wrapped_webdav_fs.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00