mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-20 13:30:46 +02:00
Chris Lu
3ae4e9c563
* azure: authenticate the blob sink with Entra ID Shared account keys have to be distributed and rotated everywhere a sink runs. Leaving account_key empty now falls back to the identity chain, so a workload identity or managed identity carries the authorization instead. * azure: authenticate remote storage with Entra ID The remote storage client demanded an account key and refused to start without one. Fall back to the identity chain when it is absent, and let azure.client_id pin a user-assigned identity. * azure: reject a malformed storage account name The account name is interpolated into the service URL, so a name carrying a "/", "?" or "@" moves the authority elsewhere and an authenticated request follows it. Hold callers to Azure's own naming rule instead. * azure: keep a leftover environment key off the identity path A configured client id asks for Entra ID, but AZURE_STORAGE_ACCESS_KEY still filled in the account key behind it. An old mounted secret would go on authenticating until it rotated, and the failure then blamed the key. * azure: say what the identity path reads from the environment A pinned client id alone is not enough for workload identity: the tenant and the projected token come from the environment, and missing them only surfaces later, when a token is first requested.
79 lines
2.0 KiB
Protocol Buffer
79 lines
2.0 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package remote_pb;
|
|
|
|
option go_package = "github.com/seaweedfs/seaweedfs/weed/pb/remote_pb";
|
|
option java_package = "seaweedfs.client";
|
|
option java_outer_classname = "FilerProto";
|
|
|
|
/////////////////////////
|
|
// Remote Storage related
|
|
/////////////////////////
|
|
message RemoteConf {
|
|
string type = 1;
|
|
string name = 2;
|
|
string s3_access_key = 4;
|
|
string s3_secret_key = 5;
|
|
string s3_region = 6;
|
|
string s3_endpoint = 7;
|
|
string s3_storage_class = 8;
|
|
bool s3_force_path_style = 9;
|
|
bool s3_support_tagging = 13;
|
|
bool s3_v4_signature = 11;
|
|
|
|
string gcs_google_application_credentials = 10;
|
|
string gcs_project_id = 12;
|
|
|
|
string azure_account_name = 15;
|
|
string azure_account_key = 16;
|
|
string azure_client_id = 17;
|
|
|
|
string backblaze_key_id = 20;
|
|
string backblaze_application_key = 21;
|
|
string backblaze_endpoint = 22;
|
|
string backblaze_region = 23;
|
|
|
|
string aliyun_access_key = 25;
|
|
string aliyun_secret_key = 26;
|
|
string aliyun_endpoint = 27;
|
|
string aliyun_region = 28;
|
|
|
|
string tencent_secret_id = 30;
|
|
string tencent_secret_key = 31;
|
|
string tencent_endpoint = 32;
|
|
|
|
string baidu_access_key = 35;
|
|
string baidu_secret_key = 36;
|
|
string baidu_endpoint = 37;
|
|
string baidu_region = 38;
|
|
|
|
string wasabi_access_key = 40;
|
|
string wasabi_secret_key = 41;
|
|
string wasabi_endpoint = 42;
|
|
string wasabi_region = 43;
|
|
|
|
string filebase_access_key = 60;
|
|
string filebase_secret_key = 61;
|
|
string filebase_endpoint = 62;
|
|
|
|
string storj_access_key = 65;
|
|
string storj_secret_key = 66;
|
|
string storj_endpoint = 67;
|
|
|
|
string contabo_access_key = 68;
|
|
string contabo_secret_key = 69;
|
|
string contabo_endpoint = 70;
|
|
string contabo_region = 71;
|
|
}
|
|
|
|
message RemoteStorageMapping {
|
|
map<string,RemoteStorageLocation> mappings = 1;
|
|
string primary_bucket_storage_name = 2;
|
|
}
|
|
message RemoteStorageLocation {
|
|
string name = 1;
|
|
string bucket = 2;
|
|
string path = 3;
|
|
int32 listing_cache_ttl_seconds = 4; // 0 = disabled; >0 enables on-demand directory listing with this TTL in seconds
|
|
}
|