RustFS 1.0.0-rc.1 (rc)

What's Changed

• fix(ecstore): start with unresolved Kubernetes peers by @cxymds in #5460
• ci(release): isolate preview releases from latest channels by @overtrue in #5462
• fix(ecstore): quarantine rejected format members by @cxymds in #5463
• test(e2e): accept backpressure unknown terminal status by @houseme in #5464
• refactor(sse): decouple ecstore and harden KMS lifecycle by @reatang in #5435
• fix(obs): label node-local metrics by server by @houseme in #5465
• fix(ci): generate release notes with the correct baseline by @overtrue in #5467
• docs(obs): add Grafana server-label dashboard by @houseme in #5468
• fix(kms): make local backend persistence crash-durable by @overtrue in #5471
• feat(kms): add operation timeout and typed retry policy engine by @overtrue in #5472
• fix(kms): fail closed on missing or corrupt key material by @overtrue in #5475
• fix(kms): report accurate Vault KV2 security contract and disable unsafe rotation by @overtrue in #5474
• docs(kms): document local backend durability and deployment support matrix by @overtrue in #5478
• feat(kms): add master key version to data key envelope contract by @overtrue in #5480
• fix(kms): pass attempt timeout to Vault test clients by @overtrue in #5479
• fix(kms): pass attempt timeout in vault kv2 tests by @overtrue in #5482
• refactor(kms): route Vault clients through a rotatable credential provider by @overtrue in #5481
• feat(kms): retain historical master key versions for Vault KV2 rotation by @overtrue in #5484
• feat: add opt-in hotpath profiling by @houseme in #5488
• feat(kms): add backup manifest and responsibility contract types by @overtrue in #5483
• test(kms): pin rotation contracts across backends and document retention by @overtrue in #5486
• feat(kms): add backend capability discovery by @overtrue in #5485
• feat(kms): AppRole login with background token renewal and fail-closed expiry by @overtrue in #5487
• feat(kms): enforce shared key state machine across backends by @overtrue in #5489
• fix(iam): separate OIDC role and claim policies by @overtrue in #5493
• fix(admin): keep data usage endpoint available by @overtrue in #5494
• feat(kms): route Vault operations through the retry policy engine by @overtrue in #5495
• feat(admin): add KMS key lifecycle endpoints and deletion reference gate by @overtrue in #5496
• feat: add hotpath primitive profiling coverage by @houseme in #5492
• perf(ecstore): deduplicate concurrent lazy bucket-metadata loads by @overtrue in #5498
• feat(kms): record operation metrics in the retry policy engine by @overtrue in #5500
• feat: extend hotpath coverage across crates by @houseme in #5505
• refactor(kms): fold the KmsClient layer into KmsBackend and complete lifecycle overrides by @overtrue in #5501
• test: add formal hotpath ABBA runner by @houseme in #5507
• feat(kms): export local backend key material as sealed backup bundles by @overtrue in #5499
• fix(s3): allow CopyObject COPY request metadata by @houseme in #5514
• fix(kms): drop stale KmsClient trait import in local_export tests by @overtrue in #5519
• docs(kms): add observability dashboard, alert rules and runbook by @overtrue in #5517
• fix(config): fence persisted config updates and reloads by @cxymds in #5512
• docs: make validation proportional to change risk by @overtrue in #5527
• test(s3): cover delete marker list visibility by @overtrue in #5503
• fix(kms): make Vault KV2 lifecycle writes check-and-set by @overtrue in #5518
• fix(kms): CAS Transit metadata writes and bound the metadata cache by @overtrue in #5520
• feat(policy): parse and match KMS key resources with a kms:Decrypt action by @overtrue in #5515
• feat(kms): restore local backend key material from sealed backup bundles by @overtrue in #5522
• test(object-lock): cover unretained version cleanup by @overtrue in #5504
• feat(hotpath): use mimalloc in inner counting allocator by @houseme in #5523
• ci: stop running expensive jobs that cannot inform the result by @overtrue in #5528
• ci: gate expensive jobs on Quick Checks and stop a failed PR run early by @overtrue in #5529
• ci: fit the Rust caches back inside the 10GB quota by @overtrue in #5532
• ci: write the Rust caches from a workflow that is not cancelled by @overtrue in #5536
• fix(storage): harden scanner and recovery edge cases by @houseme in #5521
• ci: bound every job's runtime and stop pasting inputs into shell by @overtrue in #5537
• fix(ecstore): settle lease-deferred data-dir deletes before bucket removal by @overtrue in #5516
• ci: stop the weekly flake.lock bot from running the whole pipeline by @overtrue in #5539
• ci: narrow the io_uring lane and make the sampler attributable by @overtrue in #5540
• docs(kms): record the compliance position and mixed-version constraints by @overtrue in #5541
• ci: drop the docker layer cache and stop installing unused tooling by @overtrue in #5544
• ci: add an opt-in cargo --timings run to decide the sccache question by @overtrue in #5545
• fix(scanner): remove total timeout from heal walks by @overtrue in #5502
• ci: clear the checkout token in every job that does not push by @overtrue in #5547
• fix(sts): align AssumeRole authorization by @GatewayJ in #5281
• ci: drop cla.yml to least privilege by @overtrue in #5548
• feat(kms): wire OperationContext into an audit event contract by @overtrue in #5534
• feat(admin): scope KMS admin authorization to the target key by @overtrue in #5533
• feat(kms): add a synthetic encrypt-decrypt probe worker by @overtrue in #5543
• feat(kms): record real cache hit, miss and eviction metrics by @overtrue in #5531
• feat(sse): enforce per-key KMS authorization on the SSE-KMS data path by @overtrue in #5538
• feat(kms): converge KMS configuration across nodes after a runtime change by @overtrue in #5551
• feat(kms): expose key lifecycle and Vault credential gauges by @overtrue in #5542
• feat(kms): add an AWS KMS backend by @overtrue in #5553
• feat(kms): allow key description and tag updates by @overtrue in #5546
• fix(hotpath): pin mimalloc allocator backend by @houseme in #5550
• Expose replication backlog gauges by @houseme in #5557
• fix(ecstore): harden HotPath profiling boundaries by @houseme in #5555
• fix(oidc): warn on request-header redirect fallback by @GatewayJ in #5561
• test(e2e): classify failed lock nodes as quorum loss by @overtrue in #5513
• ci: stop archiving every dependency's unpacked source in each cache by @overtrue in #5566
• fix(replication): harden backlog observability by @houseme in #5564
• feat(admin): emit KMS management audit events by @overtrue in #5554
• feat(health): drive KMS readiness from the probe status by @overtrue in #5552
• fix(s3select): preserve ScanRange across file partitions by @GatewayJ in #5562
• ci: stop main pushes from starving dispatched Cache Warm runs by @overtrue in #5567
• fix(s3select): honor custom CSV record delimiters by @GatewayJ in #5558
• fix(s3select): parse JSON source paths from SQL AST by @GatewayJ in #5559
• ci: make the cache size report readable from the API by @overtrue in #5568
• ci: raise CARGO_BUILD_JOBS to 3 on main pushes as a measured experiment by @overtrue in #5571
• feat(kms): orchestrate and verify Vault-backed restores by @overtrue in #5549
• ci: let the CARGO_BUILD_JOBS experiment collect samples on demand by @overtrue in #5572
• fix(kms): make the deletion waiting window non-bypassable by @overtrue in #5535
• test(replication): distinguish backlog from failed counters by @houseme in #5570
• perf: harden HotPath closure evidence by @houseme in #5573
• fix(obs): retire replication backlog metric series by @houseme in #5574
• fix(kms): honour the configured metadata cache TTL and metrics switch by @overtrue in #5569
• ci: add nightly GNU build by @overtrue in #5576
• fix(s3select): cancel queries after client disconnect by @GatewayJ in #5560
• docs(agents): require worktree and disk hygiene by @overtrue in #5580
• feat(sse): attach KMS attribution to S3 audit entries by @overtrue in #5577
• fix(kms): refuse to rotate a Vault key whose baseline version was erased by @overtrue in #5578
• feat(admin): expose KMS backup and restore behind explicit guards by @overtrue in #5579
• chore(s3-types): guard the EventName mask bit budget by @overtrue in #5582
• fix(replication): enforce bucket replication switches by @reatang in #5449
• test(perf): strengthen HotPath evidence contracts by @houseme in #5581
• feat(admin): expose KMS key description and tag endpoints by @overtrue in #5575
• test(perf): cover ABBA evidence binding matrix by @houseme in #5585
• fix(s3select): guarantee terminal event delivery by @GatewayJ in #5563
• fix(s3select): support two-byte CSV record delimiters by @GatewayJ in #5565
• Expose target-scoped durable MRF backlog metrics by @houseme in #5584
• docs(kms): correct operator claims that later changes invalidated by @overtrue in #5590
• feat(policy): add built-in KMS role policies and a negative authorization matrix by @overtrue in #5588
• feat(kms): add a disaster-recovery drill harness for KMS backups by @overtrue in #5587
• fix(admin): refuse immediate KMS key deletion through the query string by @overtrue in #5589
• test(kms): cover decryption of pre-rotation envelopes offline by @overtrue in #5591
• feat(kms): accept the AWS backend through KMS configuration by @overtrue in #5592
• docs(kms): correct the claim that rotation is not admin-reachable by @overtrue in #5593
• fix(kms): page key listings so the deletion sweep sees every key by @overtrue in #5595
• docs(kms): correct the static backend's MinIO compatibility claim by @overtrue in #5596
• fix(kms): persist and report the Vault KV2 key rotation timestamp by @overtrue in #5594
• feat(kms): report the configuration references that block a key deletion by @overtrue in #5598
• fix(s3): strip every encryption marker from a copy destination by @overtrue in #5597
• docs(kms): drop claims about an interface that no longer exists by @overtrue in #5602
• docs: state that MinIO-encrypted objects do not migrate by @overtrue in #5600
• refactor(kms): drop the dead duplicate api_types::DeleteKeyRequest by @overtrue in #5601
• fix(replication): harden live delete admission by @cxymds in #5599
• docs(kms): define the bulk object rekey job contract by @overtrue in #5605
• fix(kms): fail closed on Local key records that cannot be interpreted by @overtrue in #5606
• feat(kms): add the data key rewrap primitive by @overtrue in #5607
• feat(admin): apply the requested key listing filters by @overtrue in #5608
• chore(deps): update flake.lock by @houseme in #5611
• fix(scanner): bound corrupt metadata traversal by @marshawcoco in #5609
• fix(authz): restrict recursive force-delete scope by @cxymds in #5610
• fix(lifecycle): count the first transition sample for each tier by @overtrue in #5612
• fix(authz): preserve direct delete usecase callers by @cxymds in #5614
• chore(kms): remove dead key-management types from api_types by @overtrue in #5620
• fix(admin): preflight webhook outbound policy by @overtrue in #5619
• fix(scanner): surface per-tier usage in the data-usage snapshot by @overtrue in #5623
• docs(kms): guard outward FIPS wording by @overtrue in #5624
• fix(sse): rewrite data when a same-key copy changes encryption by @overtrue in #5618
• test(kms): pin admin KMS response shapes where they are served by @overtrue in #5626
• docs(kms): record CLI and console admin handoff matrix by @overtrue in #5639
• fix(lifecycle): bind delete replication admission by @cxymds in #5621
• fix(replication): reject unsupported target options by @cxymds in #5622
• fix(authz): gate replication-only PUT headers by @cxymds in #5625
• fix(replication): make sync delivery target-granular by @cxymds in #5630
• test(admin): audit KMS deletion guard outcomes by @overtrue in #5628
• fix(replication): enforce bucket write contract by @cxymds in #5629
• feat(replication): bound DeleteObjects queue admission by @cxymds in #5637
• fix(replication): propagate metadata changes by @cxymds in #5635
• fix(replication): honor target TLS in health checks by @reatang in #5613
• fix(targets): explain webhook outbound allowlist failures by @overtrue in #5616
• test(iam): freeze OIDC federation behavior by @GatewayJ in #5627
• test(e2e): add replication acceptance matrix by @cxymds in #5642
• ci: require MinIO interop reader matrix by @overtrue in #5640
• test(kms): pin AWS timeout and contract divergence by @overtrue in #5636
• fix(kms): cover concurrent Vault KV2 rotation races by @overtrue in #5632
• feat(admin): expose versioned replication capabilities by @cxymds in #5631
• fix(replication): fail closed on destination encryption by @cxymds in #5633
• feat(table-catalog): paginate Iceberg REST listings by @marshawcoco in #5466
• fix(replication): preserve durable MRF delete admission by @cxymds in #5643
• fix(replication): snapshot existing object admission targets by @cxymds in #5634
• fix(kms): version local key records safely by @overtrue in #5638
• test(kms): verify AppRole against live Vault by @overtrue in #5650
• fix(kms): bound persisted format parsing by @overtrue in #5652
• fix(ecstore): make transitioned deletes durable by @cxymds in #5644
• feat(kms): bound backend concurrency and failures by @overtrue in #5651
• test(kms): exercise real Vault Raft failover by @overtrue in #5653
• fix(ci): keep PR e2e smoke lane from timing out by @cxymds in #5649
• feat(obs): add bounded metrics dimensions by @houseme in #5645
• fix(replication): persist force-delete handoff state by @cxymds in #5641
• test(ci): serialize cross-node metadata writes by @overtrue in #5654
• fix(metrics): close dimension review gaps by @houseme in #5656
• chore(deps): refresh hotpath allocator support by @houseme in #5660
• fix(replication): harden MRF replay durability by @cxymds in #5659
• fix(ecstore): allow Windows renames under guarded parents by @marshawcoco in #5663
• fix(s3): stop authorizing DeleteBucketWebsite with a read action by @overtrue in #5665
• fix(replication): fence force-delete journal updates by @cxymds in #5661
• fix(helm): exclude external hosts from mTLS certificate by @ccccpj in #5666
• fix(lock): let waiters hear releases and let acquisition succeed past registered waiters by @themiguelamador in #5670
• fix(replication): retain MRF entries until completion by @cxymds in #5671
• feat(replication): add dormant MRF v2 reader by @cxymds in #5672
• test(replication): add mixed-version MRF acceptance matrix by @cxymds in #5673
• fix(replication): preserve multipart source mtime by @ccccpj in #5669
• fix(kms): repair unopenable ciphertext and cover the Vault backends by @reatang in #5668
• feat(replication): purge delete markers by the target's own version id by @overtrue in #5676
• fix: address rc.1 release blockers by @overtrue in #5648
• perf(ecstore): batch local EC shard preads on GET by @rdiperri-wasabi in #5679
• fix(replication): retain MRF failures during recovery by @cxymds in #5667
• fix(ecstore): address review comments for batch shard pread by @overtrue in #5680
• fix(replication): fence journal snapshots with CAS by @cxymds in #5674
• fix(ecstore): don't exclude pool when has_space_for is indeterminate (#5497) by @overtrue in #5682
• fix(audit): move audit init after IAM bootstrap to fix startup ordering by @overtrue in #5685
• fix(ecstore): skip walkdir total timeout for listing operations by @overtrue in #5684
• fix(ecstore): treat transient network errors as unformatted during bootstrap by @overtrue in #5683
• refactor(table-catalog): modularize catalog implementation by @marshawcoco in #5678
• fix(replication): fence MRF journal updates by @cxymds in #5686
• fix(ecstore): split internal get metadata metrics by @houseme in #5687
• fix(filemeta): preserve FileInfo wire compatibility by @overtrue in #5689
• test(e2e): restore webhook redelivery regression coverage by @overtrue in #5690
• fix(heal): surface stale versions from all disks during heal walk by @overtrue in #5692
• fix(heal): harden resumable set repair failures by @cxymds in #5693
• fix(list): skip delete markers in single-object fast path for ListObjects by @overtrue in #5691
• fix(observability): fallback mimalloc requested memory stats by @houseme in #5695
• fix(replication): harden resync and MRF recovery by @cxymds in #5694
• fix(policy): require unscoped KMS bundle grants by @overtrue in #5697
• fix(replication): restrict metadata replication targets by @overtrue in #5696
• fix(auth): isolate embedded IAM contexts by @overtrue in #5704
• fix(api): bound bucket rate limiter keys by @overtrue in #5706
• fix(s3select): enforce SSE-KMS read authorization by @overtrue in #5698
• fix(auth): enforce object-lock actions for POST uploads by @overtrue in #5701
• fix(ecstore): isolate inline rollback cleanup by @overtrue in #5703
• fix(ecstore): retain namespace read locks for streaming GETs to prevent quota-bypass by @overtrue in #5699
• fix(ci): block PR-controlled execution in performance A/B workflow by @overtrue in #5705
• refactor(time): migrate audit and notify timestamps to jiff by @houseme in #5707
• perf(observability): avoid sampler stat allocations by @houseme in #5708
• fix(compose): set log directory and wait for permission helper by @lqb in #5646
• test(e2e): add P0/P1 regression tests for recurring issue patterns by @overtrue in #5709
• fix(iam): disambiguate OIDC virtual parent IDs by @overtrue in #5700
• perf(observability): avoid cgroup path allocation by @houseme in #5711
• refactor(metrics): migrate scanner report timestamps to jiff by @houseme in #5710
• fix(replication): report FAILED when replication put options cannot be built by @overtrue in #5717
• fix(iam): invalidate peer STS caches on revocation by @overtrue in #5718
• fix(quota): admit writes against a persisted usage baseline while authoritative usage is unavailable by @overtrue in #5722
• fix(replication): make bucket replication rules editable from clients by @reatang in #5715
• fix(ecstore): reclaim synthetic inline-rollback dirs after rename commit by @overtrue in #5724
• fix(filemeta): redact sealed keys and elide inline data in FileInfo Debug by @overtrue in #5725
• fix(heal): bound per-object logging by @anthonymartin in #5719
• fix(targets): surface redacted construction error detail in target failures by @overtrue in #5729
• fix(heal): demote per-object heal logs and cap erasure-set failure warns by @overtrue in #5727
• fix(quota): keep the degraded-baseline fallback off the write path's stack by @overtrue in #5728
• fix(ecstore): make inline-rollback reclamation file-precise to keep #5703's child-key safety by @overtrue in #5732
• fix(s3): degrade multipart listings per upload instead of failing the bucket by @overtrue in #5721
• fix(ecstore): make local disk map initialization replace stale topology by @overtrue in #5734
• test(ecstore): deflake multipart listing tests under plain cargo test by @overtrue in #5730
• refactor(ecstore): unify remaining heal logs to structured event style by @overtrue in #5720
• chore(deps): refresh mimalloc revision by @houseme in #5736
• ci(scripts): add s3s footprint ratchet ahead of s3gate migration by @overtrue in #5739
• fix(auth): restore filtered ListBuckets fallback by @overtrue in #5726
• feat(ci): add DEB/RPM packaging workflow by @majinghe in #5738
• fix: bump s3_error! footprint baseline to 1687 for auth ListBuckets fix by @overtrue in #5747
• fix(auth): route ListBuckets denial through ApiError to hold s3s ratchet by @reatang in #5755
• fix(site-replication): send peer join to MinIO peer/join route with encrypted payload by @reatang in #5748
• fix(madmin): accept MinIO PascalCase SRInfo fields and nil-map nulls by @reatang in #5749
• feat(table-catalog): complete namespace REST contracts by @marshawcoco in #5745
• fix(replication): send source versionId as query param to remote targets by @reatang in #5752
• fix(replication): accept remote target healthCheckDuration nanoseconds by @reatang in #5754
• fix(site-replication): use MinIO-compatible sts-account IAM item type by @reatang in #5750
• fix(table-catalog): route read_bounded_json_body errors through ApiError to hold s3s ratchet by @overtrue in #5759
• fix(replication): schedule replication for CopyObject and snowball extracted objects by @reatang in #5753
• fix(auth): log structured denial reasons for generic AccessDenied responses by @overtrue in #5761
• fix(ecstore): preserve checksums through write transforms by @anthonymartin in #5765
• perf: add RPC auth profiling diagnostics by @houseme in #5775
• obs: mirror log attributes into loki lines by @houseme in #5776
• fix(site-replication): translate policy mapping userType at MinIO wire boundary by @reatang in #5751
• fix(kms): report unreadable keys and bound list-keys page size by @overtrue in #5764
• test(admin): pin the KMS admin route contract as a snapshot by @overtrue in #5766
• fix(kms): hold the Local key directory and its files owner-only by @overtrue in #5768
• feat(table-catalog): validate Iceberg metadata graphs by @marshawcoco in #5758
• fix(replication): report remote target latency as Go duration nanoseconds by @reatang in #5771
• test(heal): cover partial rename retry admission by @cxymds in #5772
• fix(auth): align ListBuckets discovery with IAM policies by @GatewayJ in #5746
• fix(logging): bound hot-path span amplification by @anthonymartin in #5763
• feat(kms): report which keys have outlived their rotation period by @overtrue in #5769
• perf(metrics): count internode RPC auth failures by @houseme in #5777
• fix(capacity): back off timed-out scans by @anthonymartin in #5770
• feat(rpc): expose and auto-size replay cache capacity by @houseme in #5781
• fix(scanner): publish bounded observational usage by @anthonymartin in #5742
• fix(ecstore): heal partial ordinary puts by @cxymds in #5783
• fix(ci): ignore strings in s3s footprint ratchet by @cxymds in #5787
• fix(ecstore): bind multipart convergence heal versions by @cxymds in #5786
• fix(ecstore): parse ARN region and id in display order by @reatang in #5790
• fix(ecstore): fence data movement source cleanup by @cxymds in #5794
• fix(replication): tolerate Go zero-value expiration and ignore latency in remote target requests by @reatang in #5789
• fix(rebalance): commit stats after source cleanup by @cxymds in #5795
• fix(s3): resume in-flight GET streams after rebalance relocation by @deadspacewii in #5791
• ci: install awscurl for full e2e tests by @cxymds in #5796
• fix(capacity): stop background schedulers on shutdown by @cxymds in #5797
• fix(ecstore): preserve newer writes during data movement by @cxymds in #5798
• fix(ecstore): reject over-NAME_MAX key segments up front; classify irreconcilable parity as corrupt metadata by @overtrue in #5804
• fix(admin): stop logging STS AssumeRole JWT claims by @overtrue in #5802
• fix(replication): madmin reset/diff wire compat and config validation by @reatang in #5799
• ci(e2e): stabilize full-gate tooling by @cxymds in #5805
• perf(ecstore): memoize bucket-incarnation fence validation under lifecycle read-lock coverage by @overtrue in #5782
• perf(storage): skip read-version JSON for bin peers by @houseme in #5808
• fix(s3select): replace deprecated parquet reader by @houseme in #5811
• fix(scanner): retry a superseded usage snapshot in seconds, not a full cycle by @overtrue in #5814
• docs(runtime): document allocator reclaim runtime by @houseme in #5800
• fix(admin): serve the usage a scan measured instead of blanking the whole snapshot by @overtrue in #5818
• perf(utils): avoid metadata key lowercase allocation by @houseme in #5823
• perf(ecstore): cache modern erasure codec construction by @houseme in #5824
• fix(ecstore): enforce the NAME_MAX segment budget on the write path too by @overtrue in #5826
• fix(storage): reserve internal encryption prefixes in user metadata by @reatang in #5819
• refactor(kms): close the low-severity follow-ups from the #5668 adversarial re-review by @reatang in #5817
• fix(policy): support version ID condition keys by @cxymds in #5810
• feat(rpc): advertise cross-pool fence capability by @cxymds in #5809
• test(e2e): make scanner snapshot tests deterministic by @cxymds in #5812
• test(ecstore): stabilize free-version enqueue retry by @cxymds in #5813
• test(e2e): align backpressure assertion with recovery by @cxymds in #5815
• test(e2e): wait for authoritative quota usage by @cxymds in #5816
• fix(table-catalog): fix object kind validation by @kinolaev in #5784
• fix(rebalance): drain entry tasks before listing retry by @cxymds in #5820
• fix(rpc): skip batch read-version JSON for msgpack peers by @houseme in #5825
• docs(agents): make the structured-logging rule reachable and enforceable by @overtrue in #5828
• fix(ecstore): purge the stale destination data dir on healing rename_data commits by @terem42 in #5822
• fix(rebalance): defer changed source cleanup by @cxymds in #5829
• fix(ecstore): raise replay cache auto capacity by @houseme in #5833
• chore(release): bump version to 1.0.0-rc.1 by @overtrue in #5834

New Contributors

• @ccccpj made their first contribution in #5666
• @themiguelamador made their first contribution in #5670
• @rdiperri-wasabi made their first contribution in #5679
• @lqb made their first contribution in #5646
• @anthonymartin made their first contribution in #5719
• @deadspacewii made their first contribution in #5791
• @kinolaev made their first contribution in #5784
• @terem42 made their first contribution in #5822

Full Changelog: 1.0.0-beta.12...1.0.0-rc.1