fix(iam): preserve portable IAM storage and derived auth#2713
Merged
Conversation
The object-backed IAM store previously encrypted every serialized IAM record with operator credentials when no dedicated IAM key was set. That made persisted identity data depend on mutable startup credentials. This keeps explicit IAM master-key encryption while making the default storage bytes the JSON payload. The read path still accepts plaintext plus prior encrypted encodings so existing deployments can load old records. Constraint: IAM storage must load existing encrypted records during upgrade Rejected: Require an IAM master key for all writes | would break default deployments and existing plaintext-compatible behavior Confidence: high Scope-risk: narrow Directive: Do not reintroduce credential-derived IAM write encryption without a migration and key-rotation story Tested: cargo fmt --all --check Tested: cargo clippy --workspace --all-features --all-targets -- -D warnings Tested: make pre-commit Not-tested: Manual cluster upgrade against persisted legacy IAM objects
Created STS credentials live in sts_accounts while service accounts live in users, and service accounts also satisfy generic temporary-credential checks because they carry session tokens. The authorization and listing paths now resolve the service-account case first and enumerate STS entries from the STS cache. Constraint: IAM derived credentials are split between users and sts_accounts caches Rejected: Collapse service and STS entries into one cache | broader migration risk for a narrow authorization/listing bug Confidence: high Scope-risk: narrow Directive: Check service-account identity before generic temp identity whenever session-token based credentials can overlap Tested: cargo fmt --all --check Tested: git diff --check Tested: cargo test -p rustfs-iam --lib Tested: cargo clippy -p rustfs-iam --all-features --all-targets -- -D warnings Tested: cargo clippy --workspace --all-features --all-targets -- -D warnings Tested: cargo check --all-targets Tested: cargo nextest run --all --exclude e2e_test Tested: cargo test --all --doc Not-tested: Manual admin API run against a live cluster
Contributor
|
CLA requirements are satisfied for this pull request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of Change
Related Issues
Summary of Changes
Checklist
make pre-commitImpact
Additional Notes
Verification:
make pre-commitcargo fmt --all --checkgit diff --checkcargo test -p rustfs-iam --libcargo clippy -p rustfs-iam --all-features --all-targets -- -D warningscargo clippy --workspace --all-features --all-targets -- -D warningscargo check --all-targetscargo nextest run --all --exclude e2e_testcargo test --all --docNot tested:
Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md). If this is your first contribution, review the CLA document and sign it by commenting
I have read and agree to the CLA.on the PR.