mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
MorezMartinandAthena 🏛️
27b2411cdd
* fix(chart): serve S3 internal gRPC with mTLS when security enabled The security.toml generated by the chart has no [grpc.s3] section, so security.LoadServerTLS(viper, "grpc.s3") returns nil in weed/command/s3.go and the S3 server listens plaintext on its gRPC port (httpPort+10000 = 18333 by default). Workers dial that port with mTLS credentials (grpc.worker), producing: walker dispatch ...: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake" This breaks the s3_lifecycle worker's LifecycleDelete RPC path (recovery walk, daily replay) and any S3->S3 IAM cache propagation would fail the same way if clients enforced TLS. Add [grpc.s3] reusing the client cert already mounted on s3 pods (or s3.tlsSecret when set, mirroring the seaweedfs.s3.tlsArgs helper for the HTTPS listener). Co-Authored-By: Athena 🏛️ <hermes-agent@local> (custom / Qwen3.6-35B-A3B-UD-Q4_K_XL.gguf) * fix(chart): always use internal client cert for grpc.s3 identity s3.tlsSecret is the public HTTPS listener certificate (possibly issued by a public CA); internal gRPC peers only trust grpc.ca, so presenting it on the internal gRPC port would break lifecycle/IAM RPC verification. Keep the two trust domains separate. Co-Authored-By: Athena 🏛️ <hermes-agent@local> (custom / Qwen3.8-Flash-Next-ROCmFP4)