Github-Mirror/seaweedfs
1
0 Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-11-05 03:27:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

s3: keep service account keys when a pushed identity replaces its parent (#12394)

Browse Source 
* s3: keep service account keys when a pushed identity replaces its parent

Service account changes push the parent user, whose proto carries only
the user's own keys. The merge replaced the cached parent with that
proto and dropped every service account key until a restart. Read the
parent's service accounts from the credential store so the push
rebuilds them, deleted and disabled ones included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3: test that a parent identity push keeps its service account keys

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3: test a sibling service account survives a deletion push

Also check the restored secret and status, not just the key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Chris LuandClaude Opus 5.5 authored and GitHub committed 2026-11-04 05:26:07 -08:00
1 parent 92bdfeaf29
commit a0f30afe5f
2 files changed
+82
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

weed/s3api/auth_credentials.go
+11
View File
@@ -1412,6 +1412,17 @@ func (iam *IdentityAccessManagement) UpsertIdentity(ident *iam_pb.Identity) erro
config.Policies = append(config.Policies, &iam_pb.Policy{Name: runtimeName, Content: string(content)})
}
}
// The proto carries only the user's own keys; the merge replaces the
// identity, so its service account keys have to come from the store.
serviceAccounts, err := iam.credentialManager.ListServiceAccounts(context.Background())
if err != nil {
return err
}
for _, sa := range serviceAccounts {
if sa.ParentUser == ident.Name {
config.ServiceAccounts = append(config.ServiceAccounts, sa)
}
}
}
if err := iam.MergeS3ApiConfiguration(config, false, false); err != nil {
return err