From 87627c2d72055bd57646036612302a04eee01b13 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Sun, 8 Nov 2026 05:55:40 -0800 Subject: [PATCH] S3 Vectors: help text for weed-vector, weed-vector-cli and weed-worker (#12486) vector: the engine's, CLI's and worker's help say what they do now weed-vector's --masters and --filer-group said "reads through" and --security-toml named only gRPC TLS, though the engine keeps tables on the filers and volume servers and takes https.client, the read JWT key and the SSE-S3 keys from it too; weed-vector-cli called itself a "query spike"; weed-worker's --filer-signing-key spoke of write credentials the namespace no longer vends. Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK Co-authored-by: Claude Opus 5.5 --- seaweed-vector/crates/core/src/main.rs | 5 ++++- seaweed-vector/crates/server/src/main.rs | 14 ++++++++------ seaweed-worker/crates/lance/src/main.rs | 10 +++++----- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/seaweed-vector/crates/core/src/main.rs b/seaweed-vector/crates/core/src/main.rs index a8b059e1eb..694b565ebe 100644 --- a/seaweed-vector/crates/core/src/main.rs +++ b/seaweed-vector/crates/core/src/main.rs @@ -12,7 +12,10 @@ use weed_vector_core::table::VectorTable; /// namespace that says where a table is, and the masters whose filers hold /// it. #[derive(Parser, Debug)] -#[command(name = "weed-vector", about = "SeaweedFS vector query spike")] +#[command( + name = "weed-vector", + about = "Describe, query and index S3 Vectors tables" +)] struct Args { /// Lance namespace the tables live in. #[arg( diff --git a/seaweed-vector/crates/server/src/main.rs b/seaweed-vector/crates/server/src/main.rs index 31fa171d7d..f244beb7c3 100644 --- a/seaweed-vector/crates/server/src/main.rs +++ b/seaweed-vector/crates/server/src/main.rs @@ -19,7 +19,8 @@ struct Args { #[arg(long, env = "WEED_VECTOR_LISTEN", default_value = "127.0.0.1:8090")] listen: String, /// Comma-separated master addresses. The engine registers with them, so - /// the gateway finds it, and asks them for the filers it reads through. + /// the gateway finds it, and asks them for the filers it keeps tables + /// through. #[arg(long, alias = "master", env = "WEED_VECTOR_MASTERS")] masters: String, /// Encrypt every chunk written for the volume servers, as `weed s3 @@ -30,7 +31,7 @@ struct Args { env = "WEED_VECTOR_ENCRYPT_VOLUME_DATA" )] encrypt_volume_data: bool, - /// The filer group whose filers the engine reads through. + /// The filer group whose filers the engine keeps tables through. #[arg( long, alias = "filer.group", @@ -45,10 +46,11 @@ struct Args { /// tenth of the index's partitions, at least 8; more under a filter. #[arg(long, env = "WEED_VECTOR_NPROBES")] nprobes: Option, - /// The cluster's security.toml, for gRPC TLS: this server's identity is - /// [grpc.vector], the masters are dialed with [grpc.client]. By default - /// the file weed processes find in -config_dir, ., ~/.seaweedfs and - /// /etc/seaweedfs. + /// The cluster's security.toml: [grpc.vector] for this server, + /// [grpc.client] for the masters and filers, https.client for volume + /// servers under HTTPS, jwt.signing.read.key for signed volume reads, + /// s3.sse.kek or s3.sse.key for SSE-S3 buckets. By default the file weed + /// processes find in -config_dir, ., ~/.seaweedfs and /etc/seaweedfs. #[arg(long, env = "WEED_VECTOR_SECURITY_TOML")] security_toml: Option, /// The directory weed's -config_dir names, searched for security.toml diff --git a/seaweed-worker/crates/lance/src/main.rs b/seaweed-worker/crates/lance/src/main.rs index d5613f6e0d..5c58141c53 100644 --- a/seaweed-worker/crates/lance/src/main.rs +++ b/seaweed-worker/crates/lance/src/main.rs @@ -78,11 +78,11 @@ struct Args { #[arg(long)] tls_server_name: Option, - /// Shared secret for the admin control stream, `jwt.filer_signing.key`. - /// Required by admins that authenticate the worker stream with a signing - /// key. The Lance namespace takes it too: only a holder gets write - /// credentials to vector indexes. When not given, read from where the Go - /// worker reads it: WEED_JWT_FILER_SIGNING_KEY, then security.toml. + /// The cluster's `jwt.filer_signing.key`. The Lance namespace knows the + /// worker by a token derived from it, and admins that authenticate the + /// worker stream with a signing key require it. When not given, read from + /// where the Go worker reads it: WEED_JWT_FILER_SIGNING_KEY, then + /// security.toml. #[arg(long, env = "WEED_FILER_SIGNING_KEY")] filer_signing_key: Option,