From 71417186cf3c50a760d9cf428da38a754883eb28 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 31 Dec 2025 12:15:51 -0800 Subject: [PATCH 1/5] Updated S3 Nginx Proxy (markdown) --- S3-Nginx-Proxy.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/S3-Nginx-Proxy.md b/S3-Nginx-Proxy.md index ee7701c..386c961 100644 --- a/S3-Nginx-Proxy.md +++ b/S3-Nginx-Proxy.md @@ -156,4 +156,21 @@ server { ssl on; ssl_certificate /{path_to_ssl_cert}/cert.pem; ssl_certificate_key /{path_to_ssl_cert}/key.pem; -} \ No newline at end of file +} + +## Kubernetes Ingress + +When using Kubernetes Ingress (nginx-ingress controller), you must disable request buffering to prevent signature verification failures on write operations (PUT, POST). Without this setting, nginx removes the `Transfer-Encoding: chunked` header that S3 clients include in their signature, causing 403 Forbidden errors on uploads while reads work fine. + +**Required Helm chart configuration:** + +```yaml +s3: + ingress: + enabled: true + className: nginx + host: s3.example.com + annotations: + nginx.ingress.kubernetes.io/proxy-request-buffering: "off" + nginx.ingress.kubernetes.io/proxy-body-size: "0" +``` From 27a9b255756eab7c3d04db91d538d43017c3e23d Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 31 Dec 2025 12:20:52 -0800 Subject: [PATCH 2/5] Updated S3 Nginx Proxy (markdown) --- S3-Nginx-Proxy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/S3-Nginx-Proxy.md b/S3-Nginx-Proxy.md index 386c961..b8012f3 100644 --- a/S3-Nginx-Proxy.md +++ b/S3-Nginx-Proxy.md @@ -157,6 +157,7 @@ server { ssl_certificate /{path_to_ssl_cert}/cert.pem; ssl_certificate_key /{path_to_ssl_cert}/key.pem; } +``` ## Kubernetes Ingress From b4580cf5e78cbc6c0382c571b03e069721f7c46f Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 31 Dec 2025 13:54:20 -0800 Subject: [PATCH 3/5] disk type for Metadata Event Logs --- FAQ.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/FAQ.md b/FAQ.md index 9016542..2535e2f 100644 --- a/FAQ.md +++ b/FAQ.md @@ -23,6 +23,27 @@ The default volume size is 30GB, and default to 8 volumes. Very likely you would SeaweedFS also assumes there is a default disk type, which is either empty or `"hdd"`. If all your disk type is `"ssd"`, you should leave the disk type as empty since the disk type basically is just a tag to group the volumes. +### Metadata Event Logs with All-SSD Clusters + +**Q: I am seeing errors or cannot find a disk type when writing metadata event logs on my all-SSD cluster. What should I do?** + +If your cluster consists entirely of SSDs (with no HDDs), you may encounter issues where the system fails to find a suitable disk type for writing metadata event logs. This happens because by default it is looking for a disk type as empty or hdd. + +**Solution:** +In your configuration, simply leave all disk types empty. This is the recommended approach for homogenous clusters. + +2. **Path-Specific Configuration:** If you cannot leave the disk types empty for any specific reason, you can enforce the disk type using the [path-specific filer configuration](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#path-specific-filer-configuration). + + Example using `weed shell` to configure the metadata log path: + ```bash + # Start the weed shell + weed shell + + # Configure the metadata event log path to use SSD (or another disk type) + # The default path for system logs is /topics/.system/log + fs.configure -locationPrefix=/topics/.system/log -disk=ssd -apply + ``` + ### How do I pre-allocate one or more volumes? To pre-allocate volumes, send a request to the Master server. For example: From a52fe3c761a708d4cf907be24fca44e32ca2fa19 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 31 Dec 2025 14:03:35 -0800 Subject: [PATCH 4/5] docs: add tlsCaCert and tlsInsecureSkipVerify to OIDC config example --- OIDC-Integration.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/OIDC-Integration.md b/OIDC-Integration.md index ce745f2..39f3d07 100644 --- a/OIDC-Integration.md +++ b/OIDC-Integration.md @@ -85,6 +85,8 @@ The IAM configuration file has these main sections: "jwksUri": "https://idp.example.com/.well-known/jwks.json", "userInfoUri": "https://idp.example.com/userinfo", "scopes": ["openid", "profile", "email", "groups"], + "tlsCaCert": "/etc/seaweedfs/certs/ca.pem", + "tlsInsecureSkipVerify": false, "roleMapping": { "rules": [ { "claim": "groups", "value": "admins", "role": "arn:aws:iam::role/S3AdminRole" } @@ -97,6 +99,12 @@ The IAM configuration file has these main sections: } ``` +| Field | Description | +|-------|-------------| +| `tlsCaCert` | Optional path to a CA certificate file for verifying the provider's TLS certificate. | +| `tlsInsecureSkipVerify` | Optional boolean to skip TLS verification (default: false). Use only for testing. | + + ### Policies ```json From 61600d09099e719e4dc200060d5c392f72402328 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 31 Dec 2025 14:05:30 -0800 Subject: [PATCH 5/5] docs: add comprehensive OIDC configuration fields reference table --- OIDC-Integration.md | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/OIDC-Integration.md b/OIDC-Integration.md index 39f3d07..c1158d5 100644 --- a/OIDC-Integration.md +++ b/OIDC-Integration.md @@ -99,10 +99,21 @@ The IAM configuration file has these main sections: } ``` -| Field | Description | -|-------|-------------| -| `tlsCaCert` | Optional path to a CA certificate file for verifying the provider's TLS certificate. | -| `tlsInsecureSkipVerify` | Optional boolean to skip TLS verification (default: false). Use only for testing. | +#### Configuration Fields + +| Field | Required | Type | Description | +|-------|----------|------|-------------| +| `issuer` | Yes | string | OIDC issuer URL (e.g., `https://idp.example.com`) | +| `clientId` | Yes | string | OAuth2 client ID registered with the provider | +| `clientSecret` | No | string | OAuth2 client secret (required for confidential clients) | +| `jwksUri` | No | string | JSON Web Key Set URI. If not specified, defaults to `{issuer}/.well-known/jwks.json` | +| `userInfoUri` | No | string | UserInfo endpoint URI. If not specified, defaults to `{issuer}/userinfo` | +| `scopes` | No | string[] | OAuth2 scopes to request (default: `["openid"]`) | +| `tlsCaCert` | No | string | Path to CA certificate file for verifying the provider's TLS certificate | +| `tlsInsecureSkipVerify` | No | boolean | Skip TLS certificate verification (default: `false`). **Use only for testing** | +| `jwksCacheTTLSeconds` | No | integer | How long to cache JWKS before refresh in seconds (default: `3600`) | +| `roleMapping` | No | object | Configuration for mapping OIDC claims to SeaweedFS roles (see below) | +| `claimsMapping` | No | object | Map OIDC claims to identity attributes | ### Policies