From 1f61097d4d2c350665c12153adeea66301e3d077 Mon Sep 17 00:00:00 2001 From: Richard Chen Zheng <58443436+rchenzheng@users.noreply.github.com> Date: Mon, 14 Sep 2026 19:11:22 -0400 Subject: [PATCH] helm: grant List to the generated read-only S3 identity (#11318) * helm: grant List to the generated read-only S3 identity The chart's anvReadOnly identity only carried the Read action, so its credentials could GetObject and HeadObject but every ListObjects request was denied: List is a separate action and the identity check is an exact match. Add List so the read-only credentials can list buckets and objects. Writes stay denied. Update the README example to match. Bump the chart to 4.47.1. The chart label is part of the s3 and all-in-one pod templates, so the upgrade rolls the gateways and they reload the identity config, which is only read at startup. Fixes #11317 * helm: roll standalone S3 and all-in-one on s3 config changes Mirror the filer checksum/s3config pod annotation in the standalone S3 and all-in-one deployments so a changed generated S3 secret triggers a rollout during a normal helm upgrade without relying on a chart version bump. --------- Co-authored-by: Chris Lu --- k8s/charts/seaweedfs/Chart.yaml | 2 +- k8s/charts/seaweedfs/README.md | 2 +- .../templates/all-in-one/all-in-one-deployment.yaml | 7 +++++++ k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml | 6 ++++++ k8s/charts/seaweedfs/templates/s3/s3-secret.yaml | 2 +- 5 files changed, 16 insertions(+), 3 deletions(-) diff --git a/k8s/charts/seaweedfs/Chart.yaml b/k8s/charts/seaweedfs/Chart.yaml index 3c2efbacb..871233c80 100644 --- a/k8s/charts/seaweedfs/Chart.yaml +++ b/k8s/charts/seaweedfs/Chart.yaml @@ -3,4 +3,4 @@ description: SeaweedFS name: seaweedfs appVersion: "4.47" # Dev note: Trigger a helm chart release by `git tag -a helm-` -version: 4.47.0 +version: 4.47.1 diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md index bf4943b63..69bcd180c 100644 --- a/k8s/charts/seaweedfs/README.md +++ b/k8s/charts/seaweedfs/README.md @@ -286,7 +286,7 @@ metadata: app.kubernetes.io/component: s3 stringData: # this key must be an inline json config file - seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"snu8yoP6QAlY0ne4","secretKey":"PNzBcmeLNEdR0oviwm04NQAicOrDH1Km"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"SCigFee6c5lbi04A","secretKey":"kgFhbT38R8WUYVtiFQ1OiSVOrYr3NKku"}],"actions":["Read"]}]}' + seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"snu8yoP6QAlY0ne4","secretKey":"PNzBcmeLNEdR0oviwm04NQAicOrDH1Km"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"SCigFee6c5lbi04A","secretKey":"kgFhbT38R8WUYVtiFQ1OiSVOrYr3NKku"}],"actions":["Read","List"]}]}' ``` #### Source S3 credentials from an existing Secret diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml index 9202ae8cd..ba1fcfdfc 100644 --- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml +++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml @@ -44,6 +44,13 @@ spec: {{- with .Values.allInOne.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} + {{- $existingS3ConfigSecret := or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret }} + {{- if $existingS3ConfigSecret }} + {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace $existingS3ConfigSecret) | default dict }} + checksum/s3config: {{ $configSecret | toYaml | sha256sum }} + {{- else }} + checksum/s3config: {{ include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum }} + {{- end }} spec: restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.allInOne.restartPolicy }} {{- if .Values.allInOne.affinity }} diff --git a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml index 88c7afd24..756607cea 100644 --- a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml +++ b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml @@ -42,6 +42,12 @@ spec: {{- with .Values.s3.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} + {{- if .Values.s3.existingConfigSecret }} + {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.s3.existingConfigSecret) | default dict }} + checksum/s3config: {{ $configSecret | toYaml | sha256sum }} + {{- else }} + checksum/s3config: {{ include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum }} + {{- end }} spec: restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.s3.restartPolicy }} {{- if .Values.s3.affinity }} diff --git a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml index 2c1d87da5..595d9091d 100644 --- a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml +++ b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml @@ -60,7 +60,7 @@ stringData: read_access_key_id: {{ $access_key_read }} read_secret_access_key: {{ $secret_key_read }} {{- end }} - seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"{{ $access_key_admin }}","secretKey":"{{ $secret_key_admin }}"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"{{ $access_key_read }}","secretKey":"{{ $secret_key_read }}"}],"actions":["Read"]}]}' + seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"{{ $access_key_admin }}","secretKey":"{{ $secret_key_admin }}"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"{{ $access_key_read }}","secretKey":"{{ $secret_key_read }}"}],"actions":["Read","List"]}]}' {{- if .Values.filer.s3.auditLogConfig }} filer_s3_auditLogConfig.json: | {{ toJson .Values.filer.s3.auditLogConfig | nindent 4 }}