mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-16 12:16:36 +00:00
Chris LuandGitHub
3ae4e9c563
* azure: authenticate the blob sink with Entra ID Shared account keys have to be distributed and rotated everywhere a sink runs. Leaving account_key empty now falls back to the identity chain, so a workload identity or managed identity carries the authorization instead. * azure: authenticate remote storage with Entra ID The remote storage client demanded an account key and refused to start without one. Fall back to the identity chain when it is absent, and let azure.client_id pin a user-assigned identity. * azure: reject a malformed storage account name The account name is interpolated into the service URL, so a name carrying a "/", "?" or "@" moves the authority elsewhere and an authenticated request follows it. Hold callers to Azure's own naming rule instead. * azure: keep a leftover environment key off the identity path A configured client id asks for Entra ID, but AZURE_STORAGE_ACCESS_KEY still filled in the account key behind it. An old mounted secret would go on authenticating until it rotated, and the failure then blamed the key. * azure: say what the identity path reads from the environment A pinned client id alone is not enough for workload identity: the tenant and the projected token come from the environment, and missing them only surfaces later, when a token is first requested.
82 lines
3.1 KiB
TOML
82 lines
3.1 KiB
TOML
# A sample TOML config file for replicating SeaweedFS filer
|
|
# Used with "weed filer.backup"
|
|
# Using with "weed filer.replicate" is deprecated.
|
|
# Put this file to one of the location, with descending priority
|
|
# ./replication.toml
|
|
# $HOME/.seaweedfs/replication.toml
|
|
# /etc/seaweedfs/replication.toml
|
|
|
|
[source.filer] # deprecated. Only useful with "weed filer.replicate"
|
|
enabled = true
|
|
grpcAddress = "localhost:18888"
|
|
# all files under this directory tree are replicated.
|
|
# this is not a directory on your hard drive, but on your filer.
|
|
# i.e., all files with this "prefix" are sent to notification message queue.
|
|
directory = "/buckets"
|
|
# files from the directory separated by space are excluded from sending notifications
|
|
excludeDirectories = "/buckets/tmp"
|
|
|
|
[sink.local]
|
|
enabled = false
|
|
directory = "/data"
|
|
# all replicated files are under modified time as yyyy-mm-dd directories
|
|
# so each date directory contains all new and updated files.
|
|
is_incremental = false
|
|
|
|
[sink.filer]
|
|
enabled = false
|
|
grpcAddress = "localhost:18888"
|
|
# all replicated files are under this directory tree
|
|
# this is not a directory on your hard drive, but on your filer.
|
|
# i.e., all received files will be "prefixed" to this directory.
|
|
directory = "/backup"
|
|
replication = ""
|
|
collection = ""
|
|
ttlSec = 0
|
|
is_incremental = false
|
|
|
|
[sink.s3]
|
|
# read credentials doc at https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/sessions.html
|
|
# default loads credentials from the shared credentials file (~/.aws/credentials).
|
|
enabled = false
|
|
aws_access_key_id = "" # if empty, loads from the shared credentials file (~/.aws/credentials).
|
|
aws_secret_access_key = "" # if empty, loads from the shared credentials file (~/.aws/credentials).
|
|
region = "us-east-2"
|
|
bucket = "your_bucket_name" # an existing bucket
|
|
directory = "/" # destination directory
|
|
endpoint = ""
|
|
is_incremental = false
|
|
|
|
[sink.google_cloud_storage]
|
|
# read credentials doc at https://cloud.google.com/docs/authentication/getting-started
|
|
enabled = false
|
|
google_application_credentials = "/path/to/x.json" # path to json credential file
|
|
bucket = "your_bucket_seaweedfs" # an existing bucket
|
|
directory = "/" # destination directory
|
|
is_incremental = false
|
|
|
|
[sink.azure]
|
|
# experimental, let me know if it works
|
|
enabled = false
|
|
account_name = ""
|
|
# leave account_key empty to authenticate with Entra ID instead of a shared key,
|
|
# picking up a workload identity or managed identity from the environment. The
|
|
# identity needs a data-plane role such as Storage Blob Data Contributor.
|
|
account_key = ""
|
|
# optional user-assigned identity, when account_key is empty. Workload identity
|
|
# takes its tenant and token from AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE,
|
|
# which the Azure workload identity webhook projects into the pod.
|
|
client_id = ""
|
|
container = "mycontainer" # an existing container
|
|
directory = "/" # destination directory
|
|
is_incremental = false
|
|
|
|
[sink.backblaze]
|
|
enabled = false
|
|
b2_account_id = ""
|
|
b2_master_application_key = ""
|
|
b2_region = ""
|
|
bucket = "mybucket" # an existing bucket
|
|
directory = "/" # destination directory
|
|
is_incremental = false
|