mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-04 02:57:44 +01:00
* seaweed-vector: default --namespace to the gateway's Lance port The old default, http://localhost:8888/lance, is a path nothing serves: the Lance Namespace listens on its own port, 9101 by default on weed s3, weed server, weed filer and weed mini. With it, the filer answered the engine's catalog calls with a 500 and every CreateIndex failed with InternalFailure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * seaweed-vector: default --listen to a port no SeaweedFS server takes 127.0.0.1:8080 is the volume server's default port, so weed-vector next to weed server exited with "Address already in use (os error 98)". 8090 is not among the defaults of master, volume, filer, S3 and its Iceberg and Lance catalogs, IAM, WebDAV, SFTP, the message queue broker and agent, the admin server or weed mini, nor any of their gRPC ports (HTTP + 10000). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * lance: take any key while the S3 server runs without identities Without identities the S3 port accepts any signature and treats the caller as the admin. The Lance catalog still checked an x-api-key or Bearer token against identities that did not exist, so weed-vector started with --storage-option credentials on such a server got 401 on every catalog call. The catalog now skips both checks when S3 auth is off and leaves the caller to the S3 authenticator, which admits it as the admin, as it already did for a request with no key. With identities configured nothing changes: an unknown key is still 401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * lance: tell clients to skip signing while S3 auth is off A client with no credentials of its own could not reach a table's data on a server without identities, though the S3 port takes unsigned requests there: lance fell back to the AWS default credential chain and failed with CredentialsNotLoaded. weed-vector without --storage-option failed every CreateIndex that way. The catalog now adds aws_skip_signature to the storage options it hands out while S3 auth is off, and leaves it out once identities exist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * seaweed-vector: bind the listener before registering with the master The engine spawned its master registration and then bound --listen, so an engine whose port was taken could reach the master before it exited: on weed server with 18080 taken the master logged "vector node 127.0.0.1:18080 added" and removed it in the same millisecond, and the gateway noticed it. Bind first, and name the address in the error instead of "transport error". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * seaweed-worker: keep an unsigned store off the AWS default chain A store the catalog says takes unsigned requests needs no credentials, but lance builds the AWS default credential chain for any store without them, and the chain probes instance metadata on every dataset open. With no credentials of its own, weed-vector spent a second on each query (1030-1066 ms against 32-46 ms with --storage-option ones). The merge of the operator's fallback and the vended options, which the engine and the Lance worker each did in their own copy, moves into table_options, and gives such a store empty credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK * test(s3vectors): serve an index with no identities and no engine credentials A second cluster runs weed s3 without -config and weed-vector without --storage-option, with no AWS credentials in either environment: weed s3 would turn them into an admin identity, and the engine would find them. On master its CreateIndex fails with InternalFailure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
145 lines
5.8 KiB
Rust
145 lines
5.8 KiB
Rust
use anyhow::{Context, Result};
|
|
use clap::Parser;
|
|
use tonic::transport::Server;
|
|
use tonic::transport::server::TcpIncoming;
|
|
use weed_lance_worker::catalog::{NamespaceClient, SigningKey};
|
|
use weed_lance_worker::dataset::FallbackOptions;
|
|
use weed_vector_server::pb::vector::vector_service_server::VectorServiceServer;
|
|
use weed_vector_server::read_cache::ReadCache;
|
|
use weed_vector_server::service::VectorServer;
|
|
|
|
/// The VectorService the S3 gateway fans vector calls out to.
|
|
#[derive(Parser)]
|
|
struct Args {
|
|
/// Lance Namespace base URL: the S3 gateway's Lance port (-s3.port.lance).
|
|
#[arg(
|
|
long,
|
|
env = "WEED_VECTOR_NAMESPACE",
|
|
default_value = "http://localhost:9101"
|
|
)]
|
|
namespace: String,
|
|
/// gRPC listen address.
|
|
#[arg(long, env = "WEED_VECTOR_LISTEN", default_value = "127.0.0.1:8090")]
|
|
listen: String,
|
|
/// object_store option fallback for deployments that vend no credentials:
|
|
/// key=value, repeatable.
|
|
#[arg(long = "storage-option", alias = "storage.option", value_parser = parse_option)]
|
|
storage_options: Vec<(String, String)>,
|
|
/// Comma-separated master addresses to register this server with; the
|
|
/// gateway discovers it via ListClusterNodes(client_type=vector).
|
|
#[arg(long, alias = "master", env = "WEED_VECTOR_MASTERS")]
|
|
masters: Option<String>,
|
|
/// Memory for caching reads of write-once table files, in MiB; 0 disables.
|
|
#[arg(long, env = "WEED_VECTOR_READ_CACHE_MB", default_value_t = 512)]
|
|
read_cache_mb: u64,
|
|
/// The `jwt.filer_signing.key` of the cluster. The Lance namespace vends
|
|
/// credentials that write index data only to a caller holding it.
|
|
#[arg(long, env = "WEED_FILER_SIGNING_KEY")]
|
|
filer_signing_key: Option<String>,
|
|
}
|
|
|
|
fn parse_option(s: &str) -> Result<(String, String), String> {
|
|
s.split_once('=')
|
|
.map(|(k, v)| (k.to_string(), v.to_string()))
|
|
.ok_or_else(|| "expected key=value".to_string())
|
|
}
|
|
|
|
// weed tools take Go-style single-dash long flags; normalize_args converts
|
|
// any -flag to --flag — the same normalization weed-volume's config.rs does —
|
|
// so -master and --masters parse the same. The masters field carries the
|
|
// singular alias clap-side.
|
|
fn normalize_args(args: Vec<String>) -> Vec<String> {
|
|
let mut args = args;
|
|
let mut i = 1; // skip args[0] (binary name)
|
|
while i < args.len() {
|
|
let arg = &args[i];
|
|
if arg == "--" {
|
|
break;
|
|
}
|
|
if arg.starts_with("--") || !arg.starts_with('-') {
|
|
i += 1;
|
|
continue;
|
|
}
|
|
let without_dash = &arg[1..];
|
|
if without_dash.len() > 1 && !without_dash.starts_with(|c: char| c.is_ascii_digit()) {
|
|
args[i] = format!("-{}", arg);
|
|
}
|
|
i += 1;
|
|
}
|
|
args
|
|
}
|
|
|
|
/// A wildcard listen address is not reachable for peers; derive the outbound
|
|
/// IP toward the first master instead — the address the master sees anyway.
|
|
fn advertised_addr(listen: &str, masters: &[String]) -> String {
|
|
let Some((host, _)) = listen.rsplit_once(':') else {
|
|
return listen.to_string();
|
|
};
|
|
if !matches!(host, "0.0.0.0" | "::" | "" | "[::]") {
|
|
return listen.to_string();
|
|
}
|
|
let port = listen.rsplit_once(':').map(|(_, p)| p).unwrap_or_default();
|
|
if let Some(master) = masters.first() {
|
|
// Masters may arrive as host:http.grpc or scheme://host:http —
|
|
// the UDP probe only needs a dialable host:port.
|
|
let probe = master.rsplit_once("://").map(|(_, r)| r).unwrap_or(master);
|
|
let probe = match probe.rsplit_once(':') {
|
|
Some((h, p)) => match p.split_once('.') {
|
|
Some((_, g)) => format!("{h}:{g}"),
|
|
None => probe.to_string(),
|
|
},
|
|
None => probe.to_string(),
|
|
};
|
|
if let Ok(sock) = std::net::UdpSocket::bind((host, 0u16)) {
|
|
if sock.connect(&probe).is_ok() {
|
|
if let Ok(local) = sock.local_addr() {
|
|
return format!("{}:{}", local.ip(), port);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
listen.to_string()
|
|
}
|
|
|
|
#[tokio::main]
|
|
async fn main() -> Result<()> {
|
|
tracing_subscriber::fmt::init();
|
|
let args = Args::parse_from(normalize_args(std::env::args().collect()));
|
|
// Bind before registering, so the master never lists an engine that is
|
|
// about to exit because its port is taken.
|
|
let incoming = TcpIncoming::bind(args.listen.parse()?)
|
|
.with_context(|| format!("listen on {}", args.listen))?
|
|
.with_nodelay(Some(true));
|
|
if let Some(masters) = &args.masters {
|
|
let masters: Vec<String> = masters.split(',').map(|s| s.trim().to_string()).collect();
|
|
for master in &masters {
|
|
weed_vector_server::master_client::grpc_addr(master)?;
|
|
}
|
|
let advertise = advertised_addr(&args.listen, &masters);
|
|
tokio::spawn(weed_vector_server::master_client::keep_connected(
|
|
masters, advertise,
|
|
));
|
|
}
|
|
let fallback: FallbackOptions = args.storage_options.into_iter().collect();
|
|
let signing_key = SigningKey::new(args.filer_signing_key);
|
|
let client = NamespaceClient::new(args.namespace.clone())
|
|
.with_fallback(&fallback)
|
|
.with_signing_key(signing_key.as_ref());
|
|
let mut service = VectorServer::new(client, fallback);
|
|
if args.read_cache_mb > 0 {
|
|
service = service.with_read_cache(ReadCache::new(args.read_cache_mb << 20));
|
|
}
|
|
tracing::info!(namespace = %args.namespace, listen = %args.listen, "weed-vector");
|
|
Server::builder()
|
|
// Match the gateway's 1 GiB cap — put batches over the tonic 4 MiB
|
|
// default otherwise get rejected before they reach the handler.
|
|
.add_service(
|
|
VectorServiceServer::new(service)
|
|
.max_decoding_message_size(1 << 30)
|
|
.max_encoding_message_size(1 << 30),
|
|
)
|
|
.serve_with_incoming(incoming)
|
|
.await?;
|
|
Ok(())
|
|
}
|