Chris LuandClaude Opus 5.5 c2ca83c0bf filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353) ...

* filer: say jwt.filer_signing.key gates only the IAM gRPC service

The key never covered the rest of the filer gRPC port, which can read and
write the IAM store under /etc/iam. Point operators at [grpc.filer] mTLS for a
port reachable beyond a trusted network instead of the key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* filer: note the IAM gRPC OIDC provider and role RPCs are refused without the key

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-02 18:00:59 -08:00

..

admin

admin: configurable file browser upload size limit (#12348)

2026-11-02 11:32:03 -08:00

cluster

vector: weed-vector registers to master; s3 discovers it there (#12146)

2026-10-28 00:58:31 -07:00

command

filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353)

2026-11-02 18:00:59 -08:00

credential

fix: clone protobuf snapshots without copying internal locks (#11968)

2026-10-22 18:38:33 -07:00

ec

ec.balance: spread concurrent shard moves over target nodes (#12283)

2026-10-31 15:05:32 -07:00

filer

filer: reuse IsEqualOrUnder for the rename subdirectory check (#12338)

2026-11-02 10:28:48 -08:00

filer_client

fix: resolve gRPC DNS resolution issues in Kubernetes #8384 (#8387)

2026-02-19 15:46:02 -08:00

glog

go fmt

2026-04-10 17:31:14 -07:00

iam

iam/oidc: drop single-use web-identity tokens and the jti replay cache (#12065)

2026-10-25 12:04:59 -07:00

iamapi

iam: optionally require an iam: grant for self-service access-key actions (#11937)

2026-10-21 20:06:30 -07:00

images

image: add an optional public image processing gateway (#11593)

2026-10-05 19:49:02 +08:00

kms

kms/azure: fix encrypt/decrypt round trip for Azure Key Vault (#11692)

2026-10-10 23:40:19 +08:00

mount

mount: refuse to attach opens to a draining file handle (#12219)

2026-10-29 16:06:57 -07:00

mq

mq/kafka: wait for a filer to register instead of panicking on an empty list (#12019)

2026-10-24 07:09:43 -07:00

notification

filer,pb,mount: keep per-chunk cipher keys out of logs (#12085)

2026-10-26 11:52:56 -07:00

operation

operation: pad the marginal gzip test past Go 1.26's stored block (#12352)

2026-11-02 17:01:40 -08:00

pb

vector: keep ListVectors pages and segments flat as an index grows; read only keys in GetVectors (#12300)

2026-11-01 11:57:44 -08:00

placement

placement: let callers reject candidates placement cannot judge (#10581)

2026-08-05 00:18:22 -07:00

plugin/worker

admin: explain detection cooldowns and skipped scans (#12185)

2026-10-28 22:55:36 -07:00

query

filer: fail the request, not the process, when chunks cannot be resolved (#11685)

2026-10-10 23:39:29 +08:00

remote_storage

remote: reuse one guarded remote storage client per configuration (#12189)

2026-10-29 00:57:37 -07:00

replication

filer.backup: keep local sink writes inside the sink directory (#12310)

2026-11-01 18:33:07 -08:00

s3api

s3vectors: support tag conditions in vector bucket policies (#12351)

2026-11-02 12:43:12 -08:00

security

s3vectors: vend write credentials to index data only to the vector engine and Lance worker (#12316)

2026-11-01 18:49:01 -08:00

sequence

[nfs] Add NFS (#9067)

2026-04-14 20:48:24 -07:00

server

filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353)

2026-11-02 18:00:59 -08:00

sftpd

sftp: fail rm and rmdir of a missing path, and mkdir of an existing one (#12168)

2026-10-28 08:11:21 -07:00

shell

shell: dial volume servers on their registered gRPC port in volume.scrub, ec.scrub, volume.server.state (#12315)

2026-11-01 18:50:48 -08:00

static

adjust logo

2026-04-23 10:05:51 -07:00

stats

fix: clone protobuf snapshots without copying internal locks (#11968)

2026-10-22 18:38:33 -07:00

storage

volume: replicas keep the primary's compression and metadata (#12350)

2026-11-02 11:24:51 -08:00

telemetry

telemetry: keep only clusters that store at least 10 GiB (#11138)

2026-09-03 12:36:00 -07:00

topology

master: deleting a read-only volume no longer drifts the active count (#12285)

2026-10-31 13:28:32 -07:00

util

compression: compress JSON uploads, and match file types by extension (#12339)

2026-11-02 10:15:01 -08:00

wdclient

s3: drop retired volume servers from the gateway location cache (#12281)

2026-10-31 15:05:00 -07:00

worker

iceberg maintenance: cache a remote-only file before reading it (#12191)

2026-10-29 11:13:23 -07:00

Makefile

Move SQL engine and PostgreSQL server to their own binaries (#8417)

2026-02-23 16:27:08 -08:00

weed.go

shell: exit non-zero when a piped command fails (#11117)

2026-09-02 22:12:51 -07:00