mirror of
https://github.com/versity/versitygw.git
synced 2026-09-23 00:14:15 +00:00
niksis02
966a6a8650
Closes #2322 The admin API could not be served under a path prefix. Admin requests are SigV4-signed over the full path, so a reverse proxy or Gateway API route cannot strip a prefix before forwarding. That made it impossible to serve the WebUI and the admin API under one hostname. The new `--admin-path-prefix` (`VGW_ADMIN_PATH_PREFIX`) option mounts the admin routes under a single-segment prefix such as `/admin`, on `--admin-port` or, when that is unset, on the S3 port. Admin clients include the prefix in their endpoint URL, which the admin CLI and the WebUI already support. The prefix is limited to unreserved characters, because clients and the gateway encode other characters differently when signing. When the admin API shares the S3 port, the prefix must also differ from `--webui-s3-prefix`, otherwise the WebUI mount answers the admin requests. Auto-detected WebUI admin gateway URLs and the startup banner now include the prefix. The admin routes served on the S3 port now reuse `S3AdminRouter` instead of a duplicated route list. This also stops the standalone admin server from recording bucket creation under the `ActionAdminListBuckets` action. The Helm chart now exposes `webui.pathPrefix`, `webui.s3Prefix` and `admin.pathPrefix`. The WebUI gateway lists are also passed when only `webui.s3Prefix` is set, since the WebUI hosted on the S3 port does not require `webui.enabled`. Internal IAM data can now live on its own volume. `iam.dir` sets the IAM directory, and `iam.persistence` creates or references a dedicated PVC when `iam.enabled` is true and `iam.type` is `internal`. Otherwise IAM data stays in the `iam` subdirectory of the backend data volume, so existing releases are unaffected. The chart now rejects overlapping storage directories. `iam.dir` must be an absolute path outside `/mnt/data`, `gateway.backend.sidecarDir` and `gateway.backend.versioningDir`, and those three directories must not overlap each other. Deleting a bucket removes `<dir>/<bucket>` from the sidecar and versioning directories, so with nested directories, deleting a suitably named bucket could wipe IAM accounts, object versions or the entire backend data directory.
58 lines
3.3 KiB
YAML
58 lines
3.3 KiB
YAML
name: Lint Helm Chart
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Lint chart
|
|
run: helm lint chart/ --strict --set auth.accessKey=dummy --set auth.secretKey=dummy
|
|
|
|
- name: Lint standalone IAM configurations
|
|
run: |
|
|
scenarios=(
|
|
# existingSecret-based mTLS for both sides, plus NetworkPolicy
|
|
"--set iam.enabled=true --set iam.type=standalone --set iam.standalone.certificate.existingSecret=iam-client-tls --set iamServer.enabled=true --set iamServer.private.certificate.existingSecret=iam-server-tls --set networkPolicy.enabled=true"
|
|
# cert-manager-issued mTLS, plus TLS on the public control-plane API
|
|
"--set iam.enabled=true --set iam.type=standalone --set iam.standalone.certificate.create=true --set iam.standalone.certificate.issuerRef.name=internal-ca --set iamServer.enabled=true --set iamServer.private.certificate.create=true --set iamServer.private.certificate.issuerRef.name=internal-ca --set iamServer.tls.enabled=true --set iamServer.tls.secretName=iam-public-tls"
|
|
# Vault storage with multiple iamServer replicas
|
|
"--set iamServer.enabled=true --set iamServer.replicaCount=2 --set iamServer.storage.type=vault --set iamServer.storage.vault.endpointUrl=https://vault.example.test --set iamServer.storage.vault.existingSecret=vault-auth --set iamServer.storage.vault.tlsExistingSecret=vault-tls --set iamServer.private.certificate.existingSecret=iam-server-tls"
|
|
# externally managed standalone IAM service (no in-chart iamServer)
|
|
"--set iam.enabled=true --set iam.type=standalone --set iam.standalone.endpoint=iam.example.test:7443 --set iam.standalone.certificate.existingSecret=iam-client-tls"
|
|
)
|
|
|
|
for scenario in "${scenarios[@]}"; do
|
|
echo "::group::helm lint --set ${scenario}"
|
|
# shellcheck disable=SC2086
|
|
helm lint chart/ --strict --set auth.existingSecret=root-credentials ${scenario}
|
|
echo "::endgroup::"
|
|
done
|
|
|
|
- name: Lint path prefix and internal IAM storage configurations
|
|
run: |
|
|
scenarios=(
|
|
# admin API and WebUI on their own ports under path prefixes
|
|
"--set admin.enabled=true --set admin.pathPrefix=/admin --set webui.enabled=true --set webui.pathPrefix=/ui"
|
|
# admin API and WebUI on the S3 port under path prefixes
|
|
"--set admin.pathPrefix=/admin --set webui.s3Prefix=/ui --set webui.apiGateways[0]=https://s3.example.test"
|
|
# internal IAM on its own PVC with ephemeral backend data
|
|
"--set iam.enabled=true --set iam.persistence.enabled=true --set iam.dir=/var/lib/versitygw/iam --set persistence.enabled=false"
|
|
# internal IAM on an existing PVC
|
|
"--set iam.enabled=true --set iam.persistence.enabled=true --set iam.persistence.create=false --set iam.persistence.claimName=versitygw-iam"
|
|
)
|
|
|
|
for scenario in "${scenarios[@]}"; do
|
|
echo "::group::helm lint --set ${scenario}"
|
|
# shellcheck disable=SC2086
|
|
helm lint chart/ --strict --set auth.existingSecret=root-credentials ${scenario}
|
|
echo "::endgroup::"
|
|
done
|