gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: centralize admin runtime sources (#3845)

Browse Source
This commit is contained in:
Zhengchao An
2026-06-25 13:09:02 +08:00
committed by GitHub
parent 1c4a279909
commit 1c4bcd4372
32 changed files with 127 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/migration-progress.md
+25 -6
View File
@@ -5,9 +5,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
## Current Context
- Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660)
- Branch: `overtrue/arch-server-storage-runtime-source-readers`
- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204`.
- Based on: stacked on PR #3828 head after PR #3827.
- Branch: `overtrue/arch-admin-runtime-sources-batch`
- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204/API-205`.
- Based on: `origin/main` after PR #3843.
- PR type for this branch: `consumer-migration`
- Runtime behavior changes: none.
- Rust code changes: route replication pool, outbound TLS generation, runtime
@@ -44,7 +44,8 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
runtime source helpers, plus startup/root KMS, credentials, region,
readiness-time, observability, metrics, buffer, and TLS runtime source
helpers, plus server readiness/audit/event/module-switch runtime source
helpers and storage request/RPC/SSE runtime source helpers,
helpers, storage request/RPC/SSE runtime source helpers, and admin
handler/service/router runtime source helpers,
through AppContext-first or owner-crate resolver boundaries.
- CI/script changes: lock completed owner and test/fuzz boundaries against
bare/glob imports, scattered raw ECStore facade subpaths, and startup
@@ -54,8 +55,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
and storage owner thin bridge regressions, plus app context and notify
event-bridge thin module regressions, plus IAM runtime-source bypasses;
accept the reviewed AppContext resolver reverse dependencies in the layer
baseline.
- Docs changes: record the API-136 through API-204 owner facade and lifecycle
baseline, and block direct admin AppContext resolver consumers outside the
admin runtime-source boundary.
- Docs changes: record the API-136 through API-205 owner facade and lifecycle
runtime-source cleanup.
## Phase 0 Tasks
@@ -4938,6 +4940,20 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
migration/layer guards, diff hygiene, residual direct AppContext scan, Rust
risk scan, fast PR gate, and full PR gate before PR.
- [x] `API-205` Centralize admin runtime source readers.
- Do: route admin handler, router, auth, console, and service runtime
AppContext resolver consumers through the admin runtime-source boundary.
- Acceptance: admin consumers no longer import AppContext resolvers directly,
and migration rules reject new direct admin AppContext resolver consumers
outside `rustfs/src/admin/runtime_sources.rs`.
- Must preserve: admin auth/authorization, IAM readiness errors, KMS manager
fallback, OIDC console behavior, replication status, site replication peer
TLS behavior, dynamic config publication, object-store reads, region
rendering, scanner reports, and bucket metadata/admin storage behavior.
- Verification: focused RustFS admin compile/tests, formatting, migration and
layer guards, diff hygiene, residual direct AppContext scan, Rust risk
scan, fast PR gate, and full PR gate before PR.
## Next PRs
1. `consumer-migration`: continue reducing direct global reads behind AppContext resolver boundaries.
@@ -4946,6 +4962,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
| Expert | Status | Notes |
|---|---|---|
| Quality/architecture | pass | API-205 keeps direct admin AppContext resolver consumers behind the admin runtime-source boundary and adds a guard against regressions. |
| Migration preservation | pass | Admin auth, IAM readiness, KMS manager fallback, site replication TLS, config publication, and object-store resolver behavior preserve existing semantics. |
| Testing/verification | pass | Focused admin compile/tests, formatting, migration/layer guards, residual scan, fast PR gate, and full PR gate are planned before PR. |
| Quality/architecture | pass | API-199 keeps RustFS test tier-config and TLS-generation mutation behind AppContext-owned runtime-source helpers and retires the stale tier-config test compat shim. |
| Migration preservation | pass | Lifecycle transition tier registration and site replication peer-client generation-cache behavior preserve existing semantics. |
| Testing/verification | pass | Focused RustFS tests, formatting, migration/layer guards, residual scan, fast PR gate, and full PR gate are planned before PR. |
rustfs/src/admin/auth.rs
+2 -2
View File
@@ -56,7 +56,7 @@ pub async fn validate_admin_request(
actions: Vec<Action>,
remote_addr: Option<std::net::SocketAddr>,
) -> S3Result<()> {
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
let ctx = AuthContext {
@@ -146,7 +146,7 @@ pub async fn validate_admin_request_with_bucket_object(
remote_addr: Option<std::net::SocketAddr>,
resource: AdminResourceScope<'_>,
) -> S3Result<()> {
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
let ctx = AuthContext {
rustfs/src/admin/console.rs
+1 -1
View File
@@ -13,8 +13,8 @@
// limitations under the License.
use crate::admin::handlers::health::{HealthProbe, build_health_response_parts, collect_dependency_readiness};
use crate::admin::runtime_sources::resolve_oidc_handle;
use crate::app::admin_usecase::DefaultAdminUsecase;
use crate::app::context::resolve_oidc_handle;
use crate::license::has_valid_license;
use crate::server::has_path_prefix;
use crate::server::{
rustfs/src/admin/handlers/account_info.rs
+2 -2
View File
@@ -15,7 +15,7 @@
use super::super::versioning_sys::BucketVersioningSys;
use crate::admin::auth::authenticate_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_action_credentials, resolve_object_store_handle};
use crate::admin::runtime_sources::{resolve_action_credentials, resolve_object_store_handle};
use crate::auth::get_condition_values;
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use http::{HeaderMap, HeaderValue};
@@ -69,7 +69,7 @@ impl Operation for AccountInfoHandler {
let (cred, owner) = authenticate_request(&req.headers, &req.uri, &input_cred).await?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
rustfs/src/admin/handlers/audit_runtime_config.rs
+1 -1
View File
@@ -14,7 +14,7 @@
use super::super::{read_admin_config_without_migrate, save_admin_server_config};
use crate::admin::handlers::target_descriptor::AdminTargetSpec;
use crate::app::context::resolve_object_store_handle;
use crate::admin::runtime_sources::resolve_object_store_handle;
use rustfs_audit::{audit_system, start_audit_system as start_global_audit_system, system::AuditSystemState};
use rustfs_config::DEFAULT_DELIMITER;
use rustfs_config::server_config::Config;
rustfs/src/admin/handlers/config_admin.rs
+1 -1
View File
@@ -19,12 +19,12 @@ use super::super::{
};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{publish_server_config, resolve_object_store_handle, resolve_server_config};
use crate::admin::service::config::{
apply_dynamic_config_for_subsystem, is_dynamic_config_subsystem, signal_config_snapshot_reload, signal_dynamic_config_reload,
validate_server_config,
};
use crate::admin::utils::{encode_compatible_admin_payload, is_compat_admin_request, read_compatible_admin_body};
use crate::app::context::{publish_server_config, resolve_object_store_handle, resolve_server_config};
use crate::auth::{check_key_valid, get_session_token};
use crate::error::ApiError;
use crate::server::{ADMIN_PREFIX, RemoteAddr};
rustfs/src/admin/handlers/group.rs
+5 -5
View File
@@ -115,7 +115,7 @@ impl Operation for ListGroups {
)
.await?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -180,7 +180,7 @@ impl Operation for GetGroup {
GroupQuery::default()
}
};
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -256,7 +256,7 @@ impl Operation for DeleteGroup {
let group = decode_delete_group_name(&params)?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -394,7 +394,7 @@ impl Operation for SetGroupStatus {
return Err(s3_error!(InvalidArgument, "group is required"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -537,7 +537,7 @@ impl Operation for UpdateGroupMembers {
"admin group state"
);
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
rustfs/src/admin/handlers/heal.rs
+1 -1
View File
@@ -16,7 +16,7 @@ use super::super::ecstore_utils::is_valid_object_prefix;
use super::super::is_reserved_or_invalid_bucket;
use crate::admin::auth::{authenticate_request, validate_admin_request};
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::resolve_object_store_handle;
use crate::admin::runtime_sources::resolve_object_store_handle;
use crate::server::ADMIN_PREFIX;
use crate::server::RemoteAddr;
use crate::storage::request_context::spawn_traced;
rustfs/src/admin/handlers/is_admin.rs
+3 -3
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::router::Operation;
use crate::app::context::resolve_action_credentials;
use crate::admin::runtime_sources::resolve_action_credentials;
use crate::auth::{check_key_valid, constant_time_eq, get_condition_values, get_session_token};
use http::{HeaderMap, HeaderValue};
use hyper::StatusCode;
@@ -58,8 +58,8 @@ impl Operation for IsAdminHandler {
true
} else {
let empty_claims = HashMap::new();
let iam_store =
crate::app::context::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "iam not init"))?;
let iam_store = crate::admin::runtime_sources::resolve_ready_iam_handle()
.map_err(|_| s3_error!(InternalError, "iam not init"))?;
let conditions = get_condition_values(&req.headers, &cred, None, None, None);
iam_store
.is_allowed(&Args {
rustfs/src/admin/handlers/kms_dynamic.rs
+1 -1
View File
@@ -17,7 +17,7 @@
use super::super::{read_admin_config, save_admin_config};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{
use crate::admin::runtime_sources::{
resolve_kms_runtime_service_manager, resolve_object_store_handle, resolve_or_init_kms_runtime_service_manager,
};
use crate::auth::{check_key_valid, get_session_token};
rustfs/src/admin/handlers/kms_keys.rs
+1 -1
View File
@@ -16,7 +16,7 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::admin::runtime_sources::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use base64::Engine;
rustfs/src/admin/handlers/kms_management.rs
+1 -1
View File
@@ -17,7 +17,7 @@
use super::kms_keys::{CreateKeyHandler, DescribeKeyHandler, GenerateDataKeyHandler, ListKeysHandler};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::admin::runtime_sources::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use hyper::{HeaderMap, Method, StatusCode};
rustfs/src/admin/handlers/object_zip_download.rs
+1 -1
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::router::{ADMIN_OBJECT_ZIP_DOWNLOADS_PATH, AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_action_credentials, resolve_object_store_handle, resolve_region};
use crate::admin::runtime_sources::{resolve_action_credentials, resolve_object_store_handle, resolve_region};
use crate::auth::{check_key_valid, get_session_token};
use crate::error::ApiError;
use crate::license::license_check;
rustfs/src/admin/handlers/oidc.rs
+1 -1
View File
@@ -16,7 +16,7 @@ use super::super::{read_admin_config_without_migrate, save_admin_server_config};
use super::sts::create_oidc_sts_credentials;
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_object_store_handle, resolve_oidc_handle, resolve_server_config};
use crate::admin::runtime_sources::{resolve_object_store_handle, resolve_oidc_handle, resolve_server_config};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, MINIO_ADMIN_PREFIX, RemoteAddr};
use http::StatusCode;
rustfs/src/admin/handlers/policies.rs
+7 -7
View File
@@ -144,7 +144,7 @@ impl Operation for ListCannedPolicies {
}
};
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -252,7 +252,7 @@ impl Operation for AddCannedPolicy {
if policy.version.is_empty() {
return Err(s3_error!(InvalidArgument, "policy version is required"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -340,7 +340,7 @@ impl Operation for InfoCannedPolicy {
return Err(s3_error!(InvalidArgument, "too many policies"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -401,7 +401,7 @@ impl Operation for RemoveCannedPolicy {
return Err(s3_error!(InvalidArgument, "policy name is required"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -492,7 +492,7 @@ impl Operation for SetPolicyForUserOrGroup {
return Err(s3_error!(InvalidArgument, "user or group is required"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -825,7 +825,7 @@ async fn handle_builtin_policy_entities(req: S3Request<Body>) -> S3Result<S3Resp
let query = parse_policy_entities_query(req.uri.query());
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
@@ -961,7 +961,7 @@ async fn handle_builtin_policy_association(req: S3Request<Body>, is_attach: bool
.map_err(|e| s3_error!(InvalidRequest, "unmarshal policy association body failed, e: {:?}", e))?;
validate_policy_association_req(&assoc_req)?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
rustfs/src/admin/handlers/quota.rs
+1 -1
View File
@@ -19,7 +19,7 @@ use super::super::quota::checker::QuotaChecker;
use super::super::quota::{BucketQuota, QuotaError, QuotaOperation};
use crate::admin::auth::{validate_admin_request, validate_admin_request_with_bucket};
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::{resolve_bucket_metadata_handle, resolve_object_store_handle};
use crate::admin::runtime_sources::{resolve_bucket_metadata_handle, resolve_object_store_handle};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::ADMIN_PREFIX;
use hyper::{Method, StatusCode};
rustfs/src/admin/handlers/replication.rs
+1 -1
View File
@@ -22,8 +22,8 @@ use super::super::target::BucketTarget;
use crate::admin::auth::validate_admin_request;
use crate::admin::handlers::site_replication::site_replication_peer_deployment_id_for_endpoint;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{resolve_object_store_handle, resolve_replication_stats_handle, resolve_runtime_port};
use crate::admin::utils::read_compatible_admin_body;
use crate::app::context::{resolve_object_store_handle, resolve_replication_stats_handle, resolve_runtime_port};
use crate::auth::{check_key_valid, get_session_token};
use crate::error::ApiError;
use crate::server::{ADMIN_PREFIX, RemoteAddr};
rustfs/src/admin/handlers/scanner.rs
+1 -1
View File
@@ -14,7 +14,7 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::resolve_scanner_metrics_report;
use crate::admin::runtime_sources::resolve_scanner_metrics_report;
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use http::{HeaderMap, HeaderValue};
rustfs/src/admin/handlers/service_account.rs
+9 -9
View File
@@ -15,8 +15,8 @@
use super::iam_error::iam_error_to_s3_error;
use crate::admin::access_key_identity;
use crate::admin::handlers::site_replication::site_replication_iam_change_hook;
use crate::admin::runtime_sources::resolve_action_credentials;
use crate::admin::utils::{encode_compatible_admin_payload, has_space_be, is_compat_admin_request, read_compatible_admin_body};
use crate::app::context::resolve_action_credentials;
use crate::auth::{constant_time_eq, get_condition_values, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use crate::{
@@ -292,7 +292,7 @@ impl Operation for AddServiceAccount {
req_is_derived_cred = true;
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -513,7 +513,7 @@ impl Operation for UpdateServiceAccount {
return Err(s3_error!(InvalidRequest, "get cred failed"));
};
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -642,7 +642,7 @@ impl Operation for InfoServiceAccount {
let access_key = query.access_key;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -719,7 +719,7 @@ impl Operation for TemporaryAccountInfo {
let (cred, owner) =
check_key_valid(get_session_token(&req.uri, &req.headers).unwrap_or_default(), &input_cred.access_key).await?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -789,7 +789,7 @@ impl Operation for InfoAccessKey {
query.access_key
};
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -912,7 +912,7 @@ impl Operation for ListServiceAccount {
// cred.parent_user
// };
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1049,7 +1049,7 @@ impl Operation for ListAccessKeysBulk {
let (cred, owner) =
check_key_valid(get_session_token(&req.uri, &req.headers).unwrap_or_default(), &input_cred.access_key).await?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1252,7 +1252,7 @@ impl Operation for DeleteServiceAccount {
return Err(s3_error!(InvalidArgument, "access key is empty"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
rustfs/src/admin/handlers/site_replication.rs
+6 -6
View File
@@ -26,16 +26,16 @@ use super::super::{AdminReplicationConfigExt as _, AdminVersioningConfigExt as _
use super::super::{delete_admin_config, read_admin_config, save_admin_config};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{
resolve_deployment_id, resolve_endpoints_handle, resolve_iam_handle, resolve_object_store_handle, resolve_oidc_handle,
resolve_outbound_tls_generation, resolve_outbound_tls_state, resolve_region, resolve_replication_pool_handle,
resolve_replication_stats_handle, resolve_runtime_port, resolve_server_config, resolve_token_signing_key,
};
use crate::admin::site_replication_identity::{
canonical_endpoint, deployment_id_for_endpoint, normalize_peer_map_by_identity_with, same_identity_endpoint,
site_identity_key,
};
use crate::admin::utils::{encode_compatible_admin_payload, read_compatible_admin_body};
use crate::app::context::{
resolve_deployment_id, resolve_endpoints_handle, resolve_iam_handle, resolve_object_store_handle, resolve_oidc_handle,
resolve_outbound_tls_generation, resolve_outbound_tls_state, resolve_region, resolve_replication_pool_handle,
resolve_replication_stats_handle, resolve_runtime_port, resolve_server_config, resolve_token_signing_key,
};
use crate::auth::{check_key_valid, get_session_token};
use crate::config::get_config_snapshot;
use crate::error::ApiError;
@@ -4603,7 +4603,7 @@ mod tests {
use super::super::super::Endpoint;
use super::super::super::{EndpointServerPools, Endpoints, PoolEndpoints};
use super::*;
use crate::app::context::{resolve_outbound_tls_generation, set_test_outbound_tls_generation};
use crate::admin::runtime_sources::{resolve_outbound_tls_generation, set_test_outbound_tls_generation};
use http::{HeaderMap, HeaderValue, Uri};
use rustfs_policy::policy::action::S3Action;
use serial_test::serial;
rustfs/src/admin/handlers/sts.rs
+2 -2
View File
@@ -188,7 +188,7 @@ async fn handle_assume_role(
return Err(s3_error!(InvalidRequest, "AccessDenied"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
let conditions = crate::auth::get_condition_values(&headers, &cred, None, None, remote_addr);
@@ -441,7 +441,7 @@ pub async fn create_oidc_sts_credentials(
// Store temp user in IAM
let iam_store =
crate::app::context::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "IAM not initialized"))?;
crate::admin::runtime_sources::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "IAM not initialized"))?;
let updated_at = iam_store
.set_temp_user(&new_cred.access_key, &new_cred, None)
rustfs/src/admin/handlers/system.rs
+1 -1
View File
@@ -15,8 +15,8 @@
use super::{cluster_snapshot, metrics};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::resolve_endpoints_handle;
use crate::app::admin_usecase::{DefaultAdminUsecase, QueryServerInfoRequest};
use crate::app::context::resolve_endpoints_handle;
use crate::auth::{check_key_valid, get_session_token};
use crate::runtime_capabilities::{EndpointTopologySnapshotProvider, RustFsObservabilitySnapshotProvider};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
rustfs/src/admin/handlers/table_catalog.rs
+3 -2
View File
@@ -13,12 +13,12 @@
// limitations under the License.
use super::super::{ECStore, metadata::table_catalog_path_hash, metadata_sys};
use crate::admin::runtime_sources::{resolve_object_store_handle, resolve_token_signing_key};
use crate::admin::{
auth::{AdminResourceScope, validate_admin_request, validate_admin_request_with_bucket_object},
router::{AdminOperation, Operation, S3Router},
};
use crate::app::admin_usecase::DefaultAdminUsecase;
use crate::app::context::{resolve_object_store_handle, resolve_token_signing_key};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{RemoteAddr, TABLE_CATALOG_COMPAT_PREFIX, TABLE_CATALOG_PREFIX};
use crate::table_catalog::{DEFAULT_WAREHOUSE_ID, TableCatalogStore};
@@ -713,7 +713,8 @@ impl TableCredentialIssuer for IamTableCredentialIssuer {
.map_err(|err| s3_error!(InternalError, "failed to generate table credentials: {}", err))?;
bind_table_credential_parent(&mut credential, principal);
let iam_store = crate::app::context::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "iam not init"))?;
let iam_store =
crate::admin::runtime_sources::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "iam not init"))?;
iam_store
.set_temp_user(&credential.access_key, &credential, None)
.await
rustfs/src/admin/handlers/tls_debug.rs
+1 -1
View File
@@ -14,7 +14,7 @@
use super::profile::authorize_profile_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::app::context::resolve_outbound_tls_state;
use crate::admin::runtime_sources::resolve_outbound_tls_state;
use crate::server::ADMIN_PREFIX;
use http::StatusCode;
use http::{HeaderMap, HeaderValue};
rustfs/src/admin/handlers/trace.rs
+1 -1
View File
@@ -14,7 +14,7 @@
use super::super::PeerRestClient;
use crate::admin::router::Operation;
use crate::app::context::resolve_endpoints_handle;
use crate::admin::runtime_sources::resolve_endpoints_handle;
use http::StatusCode;
use hyper::Uri;
use matchit::Params;
rustfs/src/admin/handlers/user.rs
+7 -7
View File
@@ -227,7 +227,7 @@ impl Operation for AddUser {
return Err(s3_error!(InvalidArgument, "cannot create a user with the system access key"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -356,7 +356,7 @@ impl Operation for SetUserStatus {
let status = AccountStatus::try_from(query.status.as_deref().unwrap_or_default())
.map_err(|e| S3Error::with_message(S3ErrorCode::InvalidArgument, e))?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -408,7 +408,7 @@ impl Operation for ListUsers {
}
};
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -481,7 +481,7 @@ impl Operation for RemoveUser {
return Err(s3_error!(InvalidArgument, "cannot remove the current user"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -558,7 +558,7 @@ impl Operation for GetUserInfo {
return Err(s3_error!(InvalidArgument, "access key is empty"));
}
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -654,7 +654,7 @@ impl Operation for ExportIam {
)
.await?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -888,7 +888,7 @@ impl Operation for ImportIam {
let mut zip_reader =
ZipArchive::new(Cursor::new(body)).map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, e.to_string()))?;
let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
rustfs/src/admin/mod.rs
+1
View File
@@ -21,6 +21,7 @@ mod plugin_contract;
#[allow(dead_code)]
pub(crate) mod route_policy;
pub mod router;
pub(crate) mod runtime_sources;
pub mod service;
pub mod site_replication_identity;
pub mod utils;
rustfs/src/admin/router.rs
+1 -1
View File
@@ -24,7 +24,7 @@ use super::versioning_sys::BucketVersioningSys;
use super::{AdminReplicationConfigExt as _, AdminVersioningConfigExt as _};
use crate::admin::console::{is_console_path, make_console_server};
use crate::admin::handlers::oidc::is_oidc_path;
use crate::app::context::{
use crate::admin::runtime_sources::{
resolve_boot_time, resolve_bucket_monitor_handle, resolve_deployment_id, resolve_notification_system,
resolve_object_store_handle, resolve_region, resolve_replication_pool_handle, resolve_replication_stats_handle,
resolve_server_config,
rustfs/src/admin/runtime_sources.rs
+26
View File
@@ -0,0 +1,26 @@
// Copyright 2024 RustFS Team
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
pub(crate) use crate::app::context::{
AppContext, get_global_app_context, publish_server_config, publish_storage_class_config, resolve_action_credentials,
resolve_boot_time, resolve_bucket_metadata_handle, resolve_bucket_monitor_handle, resolve_deployment_id,
resolve_endpoints_handle, resolve_iam_handle, resolve_kms_runtime_service_manager, resolve_notification_system,
resolve_object_store_handle, resolve_object_store_handle_for_context, resolve_oidc_handle,
resolve_or_init_kms_runtime_service_manager, resolve_outbound_tls_generation, resolve_outbound_tls_state,
resolve_ready_iam_handle, resolve_region, resolve_replication_pool_handle, resolve_replication_stats_handle,
resolve_runtime_port, resolve_scanner_metrics_report, resolve_server_config, resolve_token_signing_key,
};
#[cfg(test)]
pub(crate) use crate::app::context::set_test_outbound_tls_generation;
rustfs/src/admin/service/config.rs
+1 -1
View File
@@ -14,7 +14,7 @@
use super::super::storageclass;
use super::super::{STORAGE_CLASS_SUB_SYS, read_admin_config_without_migrate};
use crate::app::context::{
use crate::admin::runtime_sources::{
AppContext, get_global_app_context, publish_server_config, publish_storage_class_config, resolve_notification_system,
resolve_object_store_handle, resolve_object_store_handle_for_context,
};
rustfs/src/admin/service/site_replication.rs
+1 -1
View File
@@ -14,8 +14,8 @@
use super::super::Error as StorageError;
use super::super::{read_admin_config, save_admin_config};
use crate::admin::runtime_sources::{AppContext, get_global_app_context, resolve_object_store_handle_for_context};
use crate::admin::site_replication_identity::{deployment_id_for_endpoint, normalize_peer_map_by_identity_with};
use crate::app::context::{AppContext, get_global_app_context, resolve_object_store_handle_for_context};
use rustfs_madmin::PeerInfo;
use s3s::{S3Error, S3ErrorCode, S3Result};
use serde_json::{Map, Value};
scripts/check_architecture_migration_rules.sh
+11
View File
@@ -156,6 +156,7 @@ RUSTFS_APP_CONTEXT_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_app_contex
RUSTFS_STARTUP_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_startup_runtime_source_bypass_hits.txt"
RUSTFS_SERVER_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_server_runtime_source_bypass_hits.txt"
RUSTFS_STORAGE_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_storage_runtime_source_bypass_hits.txt"
RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_admin_runtime_source_bypass_hits.txt"
awk '
/^## PR Types$/ {
@@ -1372,6 +1373,16 @@ if [[ -s "$RUSTFS_STORAGE_RUNTIME_SOURCE_BYPASS_HITS_FILE" ]]; then
report_failure "RustFS storage runtime source reads must stay behind rustfs/src/storage/runtime_sources.rs: $(paste -sd '; ' "$RUSTFS_STORAGE_RUNTIME_SOURCE_BYPASS_HITS_FILE")"
fi
(
cd "$ROOT_DIR"
rg -n --with-filename 'crate::app::context::|use crate::app::context' rustfs/src/admin \
| rg -v '^rustfs/src/admin/runtime_sources\.rs:' || true
) >"$RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE"
if [[ -s "$RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE" ]]; then
report_failure "RustFS admin runtime source reads must stay behind rustfs/src/admin/runtime_sources.rs: $(paste -sd '; ' "$RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE")"
fi
(
cd "$ROOT_DIR"
rg -n --with-filename 'rustfs_ecstore::api::' \