gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: route admin runtime sources through current helpers (#3944)

Browse Source
This commit is contained in:
Zhengchao An
2026-06-27 14:19:18 +08:00
committed by GitHub
parent cc41a50efe
commit 261e16a446
27 changed files with 194 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/migration-progress.md
+30 -9
View File
@@ -5,24 +5,26 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
## Current Context
- Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660)
- Branch: `overtrue/arch-global-admin-context-consumer-batch`
- Branch: `overtrue/arch-global-runtime-owner-consumer-batch`
- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204/API-205/API-206/API-207/API-208/API-209/API-210/API-211/API-212/API-213/API-214/API-215/API-216/API-217/API-218/API-219/API-220/API-221/API-222/API-223/API-224/API-225/API-226/API-227/API-228/API-229/API-230/API-231/API-232/API-233/API-234/API-235/API-236/API-237/API-238/API-239/API-240/API-241/API-242/API-243/API-244/API-245/API-246/API-247/API-248/API-249/API-250/API-251/API-252/API-253/API-254/CTX-002`.
- Current baseline also includes API-255 from PR #3923, API-256 from PR
#3925, CFG-009 from PR #3927, C-007/C-009 from PR #3935, C-008/C-010
from PR #3936, and DOC-001/DOC-002/DOC-003/DOC-004/DOC-005/
TEST-DOC-001 from PR #3938, GLOB-001/GLOB-002/GLOB-003/GLOB-004/
GLOB-005/CRATE-001/CRATE-002 from PR #3939, GLOB-006 from PR #3941,
and the first GLOB-007 admin runtime context handoff from PR #3942.
- Current phase PR: GLOB-007 admin context consumer batch.
- Based on: `origin/main` after PR #3942 merged.
the first GLOB-007 admin runtime context handoff from PR #3942, and the
GLOB-007 admin object-store/notification/server-config consumer batch from
PR #3943.
- Current phase PR: GLOB-007 admin runtime helper alias batch.
- Based on: `origin/main` after PR #3943 merged.
- PR type for this branch: `ci-gate`.
- Runtime behavior changes: none intended.
- Rust code changes: add admin current-runtime resolver helpers and route the
remaining admin handler/router object-store, notification-system, and
server-config consumers through AppContext-aware boundaries before legacy
fallbacks.
- Rust code changes: route remaining admin IAM, KMS, OIDC, action-credential,
region, endpoint, replication, tier, scanner, TLS, and system runtime-source
reads through admin `current_*` helper names while preserving the existing
AppContext-first resolver behavior and fallback boundaries.
- CI/script changes: none intended.
- Docs changes: update this progress ledger for the admin context consumer
- Docs changes: update this progress ledger for the admin runtime helper alias
batch.
## Phase 0 Tasks
@@ -2785,6 +2787,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
object-store, notification-system, and server-config consumers through
admin current-runtime helpers backed by AppContext-aware resolver
boundaries.
- Current slice: route remaining admin runtime-source reads for IAM, KMS,
OIDC, action credentials, region, endpoint, replication, tier, scanner,
TLS, and system runtime handles through admin `current_*` helper names.
- Remaining work: remove one fallback family per PR only after scans prove no
production caller depends on it; this slice keeps the fallback behavior
because broader app/storage/server consumers still use the root resolvers.
@@ -6054,6 +6059,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
| Expert | Status | Notes |
|---|---|---|
| Quality/architecture | pass | GLOB-007 adds admin `current_*` helper aliases for the remaining runtime-source families and moves admin IAM, KMS, OIDC, action-credential, region, endpoint, replication, tier, scanner, TLS, and system consumers off direct root resolver names. |
| Migration preservation | pass | The helper aliases delegate to the same AppContext-first runtime resolvers and keep all existing fallback paths, so this is a naming/boundary cleanup with no admin auth, IAM, KMS, replication, tier, scanner, TLS, or route behavior change. |
| Testing/verification | pass | RustFS lib compile, formatting, architecture guard, diff hygiene, admin resolver residual scan, and diff-added Rust risk scan passed before the full PR gate. |
| Quality/architecture | pass | GLOB-007 adds admin current-runtime resolver helpers and moves remaining admin handler/router object-store, notification-system, and server-config consumers off direct root resolver calls without changing owner boundaries. |
| Migration preservation | pass | The helpers call `current_app_context()` and delegate to the same AppContext-aware resolver/fallback paths from PR #3942, so account, bucket metadata, heal, zip download, pool, quota, rebalance, replication, site replication, table catalog, tier, and router behavior stays unchanged. |
| Testing/verification | pass | Focused RustFS compile/tests, admin test-target compile, admin resolver residual scan, formatting, architecture guard, diff hygiene, Rust risk scan, and full `make pre-pr` passed before PR. |
@@ -6417,6 +6425,19 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
Passed before push:
- Issue #660 GLOB-007 admin runtime helper alias slice:
- Branch freshness check: created from `origin/main` after PR #3943 merged.
- `cargo check -p rustfs --lib`: passed.
- `cargo fmt --all --check`: passed.
- `git diff --check`: passed.
- `./scripts/check_architecture_migration_rules.sh`: passed.
- Admin resolver residual scan: passed.
- Diff-added Rust risk scan: passed; no new production unwrap/expect,
unchecked narrow casts, stringly errors, or ad-hoc stdout/stderr.
- Three-expert review: passed.
- `make pre-pr`: passed, including 6912 nextest tests passed, 112 skipped,
and doctests.
- Issue #660 GLOB-007 admin context consumer slice:
- Branch freshness check: rebased onto `origin/main` after PR #3942 merged.
- `cargo fmt --all --check`: passed.
rustfs/src/admin/auth.rs
+2 -2
View File
@@ -56,7 +56,7 @@ pub async fn validate_admin_request(
actions: Vec<Action>,
remote_addr: Option<std::net::SocketAddr>,
) -> S3Result<()> {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
let ctx = AuthContext {
@@ -146,7 +146,7 @@ pub async fn validate_admin_request_with_bucket_object(
remote_addr: Option<std::net::SocketAddr>,
resource: AdminResourceScope<'_>,
) -> S3Result<()> {
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
let ctx = AuthContext {
rustfs/src/admin/console.rs
+2 -2
View File
@@ -12,7 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
use crate::admin::runtime_sources::{default_admin_usecase, resolve_oidc_handle};
use crate::admin::runtime_sources::{current_oidc_handle, default_admin_usecase};
use crate::admin::storage_api::access::RequestContext;
use crate::license::has_valid_license;
use crate::server::has_path_prefix;
@@ -134,7 +134,7 @@ impl Config {
let http_prefix = rustfs_config::RUSTFS_HTTP_PREFIX;
// Collect OIDC provider info if available
let oidc = resolve_oidc_handle()
let oidc = current_oidc_handle()
.map(|sys| {
sys.list_visible_providers()
.into_iter()
rustfs/src/admin/handlers/account_info.rs
+3 -3
View File
@@ -14,7 +14,7 @@
use crate::admin::auth::authenticate_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{current_object_store_handle, resolve_action_credentials};
use crate::admin::runtime_sources::{current_action_credentials, current_object_store_handle};
use crate::admin::storage_api::bucket::versioning_sys::BucketVersioningSys;
use crate::admin::storage_api::contract::admin::StorageAdminApi;
use crate::admin::storage_api::contract::bucket::{BucketOperations, BucketOptions};
@@ -70,7 +70,7 @@ impl Operation for AccountInfoHandler {
let (cred, owner) = authenticate_request(&req.headers, &req.uri, &input_cred).await?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -145,7 +145,7 @@ impl Operation for AccountInfoHandler {
cred.access_key.clone()
};
let Some(admin_cred) = resolve_action_credentials() else {
let Some(admin_cred) = current_action_credentials() else {
return Err(S3Error::with_message(
S3ErrorCode::InternalError,
"action credentials are not initialized".to_string(),
rustfs/src/admin/handlers/group.rs
+7 -7
View File
@@ -14,7 +14,7 @@
use super::iam_error::iam_error_to_s3_error;
use crate::{
admin::runtime_sources::resolve_action_credentials,
admin::runtime_sources::current_action_credentials,
admin::{
auth::validate_admin_request,
handlers::site_replication::site_replication_iam_change_hook,
@@ -115,7 +115,7 @@ impl Operation for ListGroups {
)
.await?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -180,7 +180,7 @@ impl Operation for GetGroup {
GroupQuery::default()
}
};
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -256,7 +256,7 @@ impl Operation for DeleteGroup {
let group = decode_delete_group_name(&params)?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -394,7 +394,7 @@ impl Operation for SetGroupStatus {
return Err(s3_error!(InvalidArgument, "group is required"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -537,7 +537,7 @@ impl Operation for UpdateGroupMembers {
"admin group state"
);
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -551,7 +551,7 @@ impl Operation for UpdateGroupMembers {
));
}
resolve_action_credentials()
current_action_credentials()
.map(|cred| {
if constant_time_eq(&cred.access_key, member) {
return Err(S3Error::with_message(
rustfs/src/admin/handlers/is_admin.rs
+3 -3
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::router::Operation;
use crate::admin::runtime_sources::resolve_action_credentials;
use crate::admin::runtime_sources::current_action_credentials;
use crate::auth::{check_key_valid, constant_time_eq, get_condition_values, get_session_token};
use http::{HeaderMap, HeaderValue};
use hyper::StatusCode;
@@ -47,7 +47,7 @@ impl Operation for IsAdminHandler {
let access_key_to_check = input_cred.access_key.clone();
// Check if the user is admin: root user check, then evaluate through the policy engine
let is_admin = if let Some(sys_cred) = resolve_action_credentials() {
let is_admin = if let Some(sys_cred) = current_action_credentials() {
constant_time_eq(&access_key_to_check, &sys_cred.access_key)
|| constant_time_eq(&cred.parent_user, &sys_cred.access_key)
} else {
@@ -58,7 +58,7 @@ impl Operation for IsAdminHandler {
true
} else {
let empty_claims = HashMap::new();
let iam_store = crate::admin::runtime_sources::resolve_ready_iam_handle()
let iam_store = crate::admin::runtime_sources::current_ready_iam_handle()
.map_err(|_| s3_error!(InternalError, "iam not init"))?;
let conditions = get_condition_values(&req.headers, &cred, None, None, None);
iam_store
rustfs/src/admin/handlers/kms_dynamic.rs
+4 -4
View File
@@ -17,8 +17,8 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{
current_app_context, resolve_kms_runtime_service_manager, resolve_object_store_handle_for_context,
resolve_or_init_kms_runtime_service_manager,
current_app_context, current_kms_runtime_service_manager, current_or_init_kms_runtime_service_manager,
resolve_object_store_handle_for_context,
};
use crate::admin::storage_api::config::{read_admin_config, save_admin_config};
use crate::auth::{check_key_valid, get_session_token};
@@ -41,7 +41,7 @@ const LOG_SUBSYSTEM_KMS: &str = "kms";
const EVENT_ADMIN_KMS_DYNAMIC_STATE: &str = "admin_kms_dynamic_state";
fn kms_service_manager_from_context() -> std::sync::Arc<rustfs_kms::KmsServiceManager> {
resolve_kms_runtime_service_manager().unwrap_or_else(|| {
current_kms_runtime_service_manager().unwrap_or_else(|| {
warn!(
component = LOG_COMPONENT_ADMIN,
subsystem = LOG_SUBSYSTEM_KMS,
@@ -49,7 +49,7 @@ fn kms_service_manager_from_context() -> std::sync::Arc<rustfs_kms::KmsServiceMa
result = "service_manager_fallback_initialized",
"admin kms dynamic state"
);
resolve_or_init_kms_runtime_service_manager()
current_or_init_kms_runtime_service_manager()
})
}
rustfs/src/admin/handlers/kms_keys.rs
+3 -3
View File
@@ -16,7 +16,7 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::admin::runtime_sources::{current_kms_runtime_service_manager, current_or_init_kms_runtime_service_manager};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use base64::Engine;
@@ -117,11 +117,11 @@ fn extract_key_id(uri: &hyper::Uri) -> Option<String> {
}
fn kms_service_manager_from_context() -> Option<std::sync::Arc<rustfs_kms::KmsServiceManager>> {
resolve_kms_runtime_service_manager()
current_kms_runtime_service_manager()
}
async fn kms_encryption_service_from_context() -> Option<std::sync::Arc<rustfs_kms::ObjectEncryptionService>> {
let manager = resolve_or_init_kms_runtime_service_manager();
let manager = current_or_init_kms_runtime_service_manager();
manager.get_encryption_service().await
}
rustfs/src/admin/handlers/kms_management.rs
+3 -3
View File
@@ -17,7 +17,7 @@
use super::kms_keys::{CreateKeyHandler, DescribeKeyHandler, GenerateDataKeyHandler, ListKeysHandler};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{resolve_kms_runtime_service_manager, resolve_or_init_kms_runtime_service_manager};
use crate::admin::runtime_sources::{current_kms_runtime_service_manager, current_or_init_kms_runtime_service_manager};
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use hyper::{HeaderMap, Method, StatusCode};
@@ -35,11 +35,11 @@ async fn kms_encryption_service_from_context() -> Option<std::sync::Arc<rustfs_k
}
fn kms_service_manager_from_context() -> std::sync::Arc<rustfs_kms::KmsServiceManager> {
match resolve_kms_runtime_service_manager() {
match current_kms_runtime_service_manager() {
Some(manager) => manager,
None => {
warn!("KMS service manager not initialized, initializing now as fallback");
resolve_or_init_kms_runtime_service_manager()
current_or_init_kms_runtime_service_manager()
}
}
}
rustfs/src/admin/handlers/object_zip_download.rs
+8 -8
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::router::{ADMIN_OBJECT_ZIP_DOWNLOADS_PATH, AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{current_object_store_handle, resolve_action_credentials, resolve_region};
use crate::admin::runtime_sources::{current_action_credentials, current_object_store_handle, current_region};
use crate::admin::storage_api::access::{ReqInfo, authorize_request};
use crate::admin::storage_api::contract::bucket::{BucketOperations, BucketOptions};
use crate::admin::storage_api::contract::list::ListOperations as _;
@@ -205,7 +205,7 @@ impl From<ObjectZipDownloadReqInfoSnapshot> for ReqInfo {
bucket: snapshot.bucket,
object: snapshot.object,
version_id: snapshot.version_id,
region: resolve_region(),
region: current_region(),
request_context: None,
}
}
@@ -283,7 +283,7 @@ impl From<ClientInfoSnapshot> for ClientInfo {
fn download_token_encryption_key() -> S3Result<[u8; 32]> {
let credentials =
resolve_action_credentials().ok_or_else(|| s3_error!(InternalError, "global action credentials are not initialized"))?;
current_action_credentials().ok_or_else(|| s3_error!(InternalError, "global action credentials are not initialized"))?;
if credentials.secret_key.is_empty() {
return Err(s3_error!(InternalError, "global action credentials are not initialized"));
}
@@ -400,7 +400,7 @@ async fn authenticate_object_zip_download_request(req: &mut S3Request<Body>) ->
req.extensions.insert(ReqInfo {
cred: Some(cred),
is_owner: owner,
region: resolve_region(),
region: current_region(),
request_context: req.extensions.get().cloned(),
..Default::default()
});
@@ -697,7 +697,7 @@ async fn authorize_zip_items_for_download(record: &ObjectZipDownloadToken, items
extensions
},
credentials: None,
region: resolve_region(),
region: current_region(),
service: None,
trailing_headers: None,
};
@@ -1092,7 +1092,7 @@ mod tests {
"object ZIP download token should carry an authenticated payload"
);
assert!(
src.contains("resolve_action_credentials"),
src.contains("current_action_credentials"),
"object ZIP download token should be verifiable by any node sharing global credentials"
);
assert!(
@@ -1377,7 +1377,7 @@ mod tests {
}
fn ensure_test_signing_credentials() {
if resolve_action_credentials().is_none() {
if current_action_credentials().is_none() {
let _ = init_global_action_credentials(
Some("TESTROOTACCESSKEY".to_string()),
Some("TESTROOTSECRET1234567890".to_string()),
@@ -1400,7 +1400,7 @@ mod tests {
bucket: Some("photos".to_string()),
object: None,
version_id: None,
region: resolve_region(),
region: current_region(),
request_context: None,
}
}
rustfs/src/admin/handlers/oidc.rs
+6 -6
View File
@@ -16,7 +16,7 @@ use super::sts::create_oidc_sts_credentials;
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{
current_app_context, resolve_object_store_handle_for_context, resolve_oidc_handle, resolve_server_config_for_context,
current_app_context, current_oidc_handle, resolve_object_store_handle_for_context, resolve_server_config_for_context,
};
use crate::admin::storage_api::config::{read_admin_config_without_migrate, save_admin_server_config};
use crate::auth::{check_key_valid, get_session_token};
@@ -270,7 +270,7 @@ pub struct ListOidcProvidersHandler {}
#[async_trait::async_trait]
impl Operation for ListOidcProvidersHandler {
async fn call(&self, _req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
let oidc_sys = resolve_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let oidc_sys = current_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let providers = oidc_sys.list_visible_providers();
let json_body = serde_json::to_vec(&providers)
@@ -441,7 +441,7 @@ impl Operation for OidcAuthorizeHandler {
return Err(s3_error!(InvalidRequest, "invalid provider_id"));
}
let oidc_sys = resolve_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let oidc_sys = current_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
// Derive the callback redirect URI from the request
let redirect_uri = derive_callback_uri(&req, provider_id)?;
@@ -514,7 +514,7 @@ impl Operation for OidcCallbackHandler {
));
}
let oidc_sys = resolve_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let oidc_sys = current_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let redirect_uri = derive_callback_uri(&req, provider_id)?;
@@ -601,7 +601,7 @@ impl Operation for OidcLogoutHandler {
return redirect_response(&fallback_location);
};
let location = match resolve_oidc_handle() {
let location = match current_oidc_handle() {
Some(oidc_sys) => match oidc_sys.build_logout_url(&logout_token, &fallback_location).await {
Ok(Some(url)) => url,
Ok(None) => fallback_location.clone(),
@@ -630,7 +630,7 @@ impl Operation for OidcLogoutHandler {
/// an explicit redirect_uri is recommended to prevent header manipulation.
fn derive_callback_uri(req: &S3Request<Body>, provider_id: &str) -> S3Result<String> {
// Use explicitly configured redirect_uri if available
if let Some(oidc_sys) = resolve_oidc_handle()
if let Some(oidc_sys) = current_oidc_handle()
&& let Some(config) = oidc_sys.get_provider_config(provider_id)
{
if let Some(ref uri) = config.redirect_uri {
rustfs/src/admin/handlers/policies.rs
+10 -10
View File
@@ -14,7 +14,7 @@
use super::iam_error::iam_error_to_s3_error;
use crate::{
admin::runtime_sources::resolve_action_credentials,
admin::runtime_sources::current_action_credentials,
admin::{
auth::validate_admin_request,
handlers::site_replication::site_replication_iam_change_hook,
@@ -144,7 +144,7 @@ impl Operation for ListCannedPolicies {
}
};
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -252,7 +252,7 @@ impl Operation for AddCannedPolicy {
if policy.version.is_empty() {
return Err(s3_error!(InvalidArgument, "policy version is required"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -340,7 +340,7 @@ impl Operation for InfoCannedPolicy {
return Err(s3_error!(InvalidArgument, "too many policies"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -401,7 +401,7 @@ impl Operation for RemoveCannedPolicy {
return Err(s3_error!(InvalidArgument, "policy name is required"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -492,7 +492,7 @@ impl Operation for SetPolicyForUserOrGroup {
return Err(s3_error!(InvalidArgument, "user or group is required"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -520,7 +520,7 @@ impl Operation for SetPolicyForUserOrGroup {
}
};
let Some(sys_cred) = resolve_action_credentials() else {
let Some(sys_cred) = current_action_credentials() else {
return Err(s3_error!(InternalError, "failed to load global credentials"));
};
@@ -825,7 +825,7 @@ async fn handle_builtin_policy_entities(req: S3Request<Body>) -> S3Result<S3Resp
let query = parse_policy_entities_query(req.uri.query());
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
@@ -961,7 +961,7 @@ async fn handle_builtin_policy_association(req: S3Request<Body>, is_attach: bool
.map_err(|e| s3_error!(InvalidRequest, "unmarshal policy association body failed, e: {:?}", e))?;
validate_policy_association_req(&assoc_req)?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam not init"));
};
@@ -986,7 +986,7 @@ async fn handle_builtin_policy_association(req: S3Request<Body>, is_attach: bool
}
}
let Some(sys_cred) = resolve_action_credentials() else {
let Some(sys_cred) = current_action_credentials() else {
return Err(s3_error!(InternalError, "get global action cred failed"));
};
rustfs/src/admin/handlers/pools.rs
+3 -3
View File
@@ -26,8 +26,8 @@ use tracing::{error, info, warn};
use crate::{
admin::runtime_sources::{
AdminPoolStatus, QueryPoolStatusRequest, current_notification_system, current_object_store_handle, default_admin_usecase,
resolve_endpoints_handle,
AdminPoolStatus, QueryPoolStatusRequest, current_endpoints_handle, current_notification_system,
current_object_store_handle, default_admin_usecase,
},
admin::{
auth::validate_admin_request,
@@ -214,7 +214,7 @@ macro_rules! log_pool_response_emitted {
}
fn endpoints_from_context() -> Option<crate::admin::storage_api::runtime::EndpointServerPools> {
resolve_endpoints_handle()
current_endpoints_handle()
}
fn validate_start_decommission_guards(decommission_running: bool, rebalance_running: bool) -> s3s::S3Result<()> {
rustfs/src/admin/handlers/quota.rs
+2 -2
View File
@@ -16,7 +16,7 @@
use crate::admin::auth::{validate_admin_request, validate_admin_request_with_bucket};
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{current_object_store_handle, resolve_bucket_metadata_handle};
use crate::admin::runtime_sources::{current_bucket_metadata_handle, current_object_store_handle};
use crate::admin::storage_api::bucket::metadata_sys::BucketMetadataSys;
use crate::admin::storage_api::bucket::quota::checker::QuotaChecker;
use crate::admin::storage_api::bucket::quota::{BucketQuota, QuotaError, QuotaOperation};
@@ -167,7 +167,7 @@ pub struct GetBucketQuotaStatsHandler;
pub struct CheckBucketQuotaHandler;
fn bucket_metadata_from_context() -> Option<Arc<RwLock<BucketMetadataSys>>> {
resolve_bucket_metadata_handle()
current_bucket_metadata_handle()
}
async fn current_usage_from_context(bucket: &str) -> u64 {
rustfs/src/admin/handlers/replication.rs
+3 -3
View File
@@ -15,7 +15,7 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::handlers::site_replication::site_replication_peer_deployment_id_for_endpoint;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{current_object_store_handle, resolve_replication_stats_handle, resolve_runtime_port};
use crate::admin::runtime_sources::{current_object_store_handle, current_replication_stats_handle, current_runtime_port};
use crate::admin::storage_api::bucket::metadata::BUCKET_TARGETS_FILE;
use crate::admin::storage_api::bucket::metadata_sys;
use crate::admin::storage_api::bucket::metadata_sys::get_replication_config;
@@ -175,7 +175,7 @@ impl Operation for GetReplicationMetricsHandler {
// TODO cluster cache
// In actual implementation, statistics would be obtained from cluster
// This is simplified to get from local cache
let bucket_stats = match resolve_replication_stats_handle() {
let bucket_stats = match current_replication_stats_handle() {
Some(s) => s.get_latest_replication_stats(bucket).await,
None => BucketStats::default(),
};
@@ -240,7 +240,7 @@ impl Operation for SetRemoteTargetHandler {
let same_target = rustfs_utils::net::is_local_host(
target_url.host().unwrap_or(Host::Domain("localhost")),
target_url.port().unwrap_or(80),
resolve_runtime_port(),
current_runtime_port(),
)
.unwrap_or_default();
rustfs/src/admin/handlers/scanner.rs
+2 -2
View File
@@ -14,7 +14,7 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::resolve_scanner_metrics_report;
use crate::admin::runtime_sources::current_scanner_metrics_report;
use crate::auth::{check_key_valid, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
use http::{HeaderMap, HeaderValue};
@@ -85,7 +85,7 @@ impl Operation for ScannerStatusHandler {
async fn call(&self, req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
let _cred = validate_scanner_status_request(&req).await?;
let response = ScannerStatusResponse {
metrics: resolve_scanner_metrics_report().await,
metrics: current_scanner_metrics_report().await,
runtime_config: rustfs_scanner::scanner_runtime_config_status(),
};
let body = serde_json::to_vec(&response).map_err(|err| {
rustfs/src/admin/handlers/service_account.rs
+11 -11
View File
@@ -15,7 +15,7 @@
use super::iam_error::iam_error_to_s3_error;
use crate::admin::access_key_identity;
use crate::admin::handlers::site_replication::site_replication_iam_change_hook;
use crate::admin::runtime_sources::resolve_action_credentials;
use crate::admin::runtime_sources::current_action_credentials;
use crate::admin::utils::{encode_compatible_admin_payload, has_space_be, is_compat_admin_request, read_compatible_admin_body};
use crate::auth::{constant_time_eq, get_condition_values, get_session_token};
use crate::server::{ADMIN_PREFIX, RemoteAddr};
@@ -268,7 +268,7 @@ impl Operation for AddServiceAccount {
None
};
let Some(sys_cred) = resolve_action_credentials() else {
let Some(sys_cred) = current_action_credentials() else {
return Err(s3_error!(InvalidRequest, "get sys cred failed"));
};
@@ -292,7 +292,7 @@ impl Operation for AddServiceAccount {
req_is_derived_cred = true;
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -513,7 +513,7 @@ impl Operation for UpdateServiceAccount {
return Err(s3_error!(InvalidRequest, "get cred failed"));
};
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -642,7 +642,7 @@ impl Operation for InfoServiceAccount {
let access_key = query.access_key;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -719,7 +719,7 @@ impl Operation for TemporaryAccountInfo {
let (cred, owner) =
check_key_valid(get_session_token(&req.uri, &req.headers).unwrap_or_default(), &input_cred.access_key).await?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -789,7 +789,7 @@ impl Operation for InfoAccessKey {
query.access_key
};
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -912,7 +912,7 @@ impl Operation for ListServiceAccount {
// cred.parent_user
// };
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1049,7 +1049,7 @@ impl Operation for ListAccessKeysBulk {
let (cred, owner) =
check_key_valid(get_session_token(&req.uri, &req.headers).unwrap_or_default(), &input_cred.access_key).await?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1121,7 +1121,7 @@ impl Operation for ListAccessKeysBulk {
.into_keys()
.collect::<Vec<_>>();
if let Some(sys_cred) = resolve_action_credentials() {
if let Some(sys_cred) = current_action_credentials() {
users.push(sys_cred.access_key);
}
users
@@ -1252,7 +1252,7 @@ impl Operation for DeleteServiceAccount {
return Err(s3_error!(InvalidArgument, "access key is empty"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
rustfs/src/admin/handlers/site_replication.rs
+30 -30
View File
@@ -15,9 +15,9 @@
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{
current_object_store_handle, current_server_config, resolve_deployment_id, resolve_endpoints_handle, resolve_iam_handle,
resolve_oidc_handle, resolve_outbound_tls_generation, resolve_outbound_tls_state, resolve_region,
resolve_replication_pool_handle, resolve_replication_stats_handle, resolve_runtime_port, resolve_token_signing_key,
current_deployment_id, current_endpoints_handle, current_iam_handle, current_object_store_handle, current_oidc_handle,
current_outbound_tls_generation, current_outbound_tls_state, current_region, current_replication_pool_handle,
current_replication_stats_handle, current_runtime_port, current_server_config, current_token_signing_key,
};
use crate::admin::site_replication_identity::{
canonical_endpoint, deployment_id_for_endpoint, normalize_peer_map_by_identity_with, same_identity_endpoint,
@@ -687,14 +687,14 @@ fn build_site_replication_peer_client(outbound_tls: &GlobalPublishedOutboundTlsS
}
async fn site_replication_peer_client() -> S3Result<reqwest::Client> {
let generation = resolve_outbound_tls_generation().0;
let generation = current_outbound_tls_generation().0;
let cache = SITE_REPLICATION_PEER_CLIENT.lock().await;
if let Some(hit) = site_replication_peer_client_cache_hit(&cache, generation) {
return hit;
}
drop(cache);
let outbound_tls = resolve_outbound_tls_state().await;
let outbound_tls = current_outbound_tls_state().await;
let built = build_site_replication_peer_client(&outbound_tls);
let cache_entry = match &built {
Ok(client) => SiteReplicationPeerClientCacheEntry::Ready(client.clone()),
@@ -732,7 +732,7 @@ fn runtime_tls_enabled_with(endpoints: Option<&crate::admin::storage_api::runtim
}
fn runtime_tls_enabled() -> bool {
let endpoints = resolve_endpoints_handle();
let endpoints = current_endpoints_handle();
runtime_tls_enabled_with(endpoints.as_ref())
}
@@ -883,7 +883,7 @@ fn request_endpoint(uri: &Uri, headers: &HeaderMap) -> String {
.map(str::to_string)
.or_else(|| uri.authority().map(|value| value.as_str().to_string()))
.or_else(|| {
resolve_endpoints_handle().and_then(|endpoints| {
current_endpoints_handle().and_then(|endpoints| {
endpoints
.as_ref()
.iter()
@@ -892,7 +892,7 @@ fn request_endpoint(uri: &Uri, headers: &HeaderMap) -> String {
.map(|endpoint| endpoint.host_port())
})
})
.unwrap_or_else(|| format!("127.0.0.1:{}", resolve_runtime_port()));
.unwrap_or_else(|| format!("127.0.0.1:{}", current_runtime_port()));
format!("{scheme}://{host}")
}
@@ -920,7 +920,7 @@ fn site_replication_local_endpoint(uri: &Uri, headers: &HeaderMap) -> String {
if !matches!(parsed.scheme(), "http" | "https") || parsed.host_str().is_none() {
return request_endpoint(&Uri::from_static("/"), &HeaderMap::new());
}
if parsed.port_or_known_default() == runtime_console_port() && parsed.set_port(Some(resolve_runtime_port())).is_ok() {
if parsed.port_or_known_default() == runtime_console_port() && parsed.set_port(Some(current_runtime_port())).is_ok() {
parsed.to_string().trim_end_matches('/').to_string()
} else {
endpoint
@@ -960,7 +960,7 @@ fn non_negative_u64(value: i64) -> u64 {
fn current_local_peer(req: &S3Request<Body>, state: &SiteReplicationState) -> PeerInfo {
let endpoint = site_replication_local_endpoint(&req.uri, &req.headers);
let deployment_id = resolve_deployment_id().unwrap_or_else(|| deployment_id_for_endpoint(&endpoint));
let deployment_id = current_deployment_id().unwrap_or_else(|| deployment_id_for_endpoint(&endpoint));
let stored_peer = state.peers.get(&deployment_id);
PeerInfo {
@@ -984,7 +984,7 @@ fn current_local_peer(req: &S3Request<Body>, state: &SiteReplicationState) -> Pe
fn current_local_runtime_peer(state: &SiteReplicationState) -> PeerInfo {
let endpoint = current_local_runtime_endpoint();
let deployment_id = resolve_deployment_id().unwrap_or_else(|| deployment_id_for_endpoint(&endpoint));
let deployment_id = current_deployment_id().unwrap_or_else(|| deployment_id_for_endpoint(&endpoint));
let stored_peer = state.peers.get(&deployment_id);
PeerInfo {
@@ -1567,7 +1567,7 @@ fn reconcile_peer_with_actual_identity(mut state: SiteReplicationState, actual_p
}
async fn site_replicator_service_account_secret(access_key: &str) -> S3Result<String> {
let Some(iam_sys) = resolve_iam_handle() else {
let Some(iam_sys) = current_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1584,7 +1584,7 @@ fn legacy_site_replicator_state_secret(state: &SiteReplicationState) -> Option<S
}
async fn set_site_replicator_service_account_secret(parent_user: &str, secret_key: String) -> S3Result<String> {
let Some(iam_sys) = resolve_iam_handle() else {
let Some(iam_sys) = current_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1630,7 +1630,7 @@ async fn set_site_replicator_service_account_secret(parent_user: &str, secret_ke
}
async fn ensure_site_replicator_service_account(parent_user: &str, rotate_secret: bool) -> S3Result<(String, String)> {
let Some(iam_sys) = resolve_iam_handle() else {
let Some(iam_sys) = current_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -1716,7 +1716,7 @@ async fn send_peer_admin_request<T: Serialize>(
access_key,
secret_key,
"",
resolve_region()
current_region()
.map(|region| region.to_string())
.as_deref()
.unwrap_or("us-east-1"),
@@ -1830,7 +1830,7 @@ async fn send_peer_admin_get_request(endpoint: &str, path: &str, access_key: &st
access_key,
secret_key,
"",
resolve_region()
current_region()
.map(|region| region.to_string())
.as_deref()
.unwrap_or("us-east-1"),
@@ -2204,7 +2204,7 @@ async fn build_sr_info(state: &SiteReplicationState, local_peer: &PeerInfo) -> S
let mut entry = SRBucketInfo {
bucket: bucket.name.clone(),
created_at: bucket.created,
location: resolve_region().map(|region| region.to_string()).unwrap_or_default(),
location: current_region().map(|region| region.to_string()).unwrap_or_default(),
api_version: Some(SITE_REPL_API_VERSION.to_string()),
..Default::default()
};
@@ -2233,7 +2233,7 @@ async fn build_sr_info(state: &SiteReplicationState, local_peer: &PeerInfo) -> S
info.buckets.insert(bucket.name, entry);
}
if let Some(iam_sys) = resolve_iam_handle() {
if let Some(iam_sys) = current_iam_handle() {
for (name, policy_doc) in iam_sys.list_policy_docs("").await.map_err(ApiError::from)? {
info.policies.insert(
name,
@@ -2292,10 +2292,10 @@ async fn build_sr_info(state: &SiteReplicationState, local_peer: &PeerInfo) -> S
fn local_idp_settings() -> IDPSettings {
let mut settings = IDPSettings::default();
if let Some(oidc) = resolve_oidc_handle() {
if let Some(oidc) = current_oidc_handle() {
let providers = oidc.list_providers();
settings.open_id.enabled = !providers.is_empty();
settings.open_id.region = resolve_region().map(|region| region.to_string()).unwrap_or_default();
settings.open_id.region = current_region().map(|region| region.to_string()).unwrap_or_default();
for provider in providers {
let Some(config) = oidc.get_provider_config(&provider.provider_id) else {
@@ -2391,7 +2391,7 @@ fn filter_sr_info(mut info: SRInfo, opts: &SRStatusOptions) -> SRInfo {
}
async fn build_metrics_summary(local_peer: &PeerInfo) -> SRMetricsSummary {
let Some(stats) = resolve_replication_stats_handle() else {
let Some(stats) = current_replication_stats_handle() else {
return SRMetricsSummary::default();
};
@@ -3608,7 +3608,7 @@ fn site_replication_bucket_target_for_peer(
let port = parsed.port_or_known_default().ok_or_else(|| {
S3Error::with_message(S3ErrorCode::InvalidRequest, format!("peer endpoint missing port: {}", peer.endpoint))
})?;
let region = resolve_region()
let region = current_region()
.map(|region| region.to_string())
.filter(|region| !region.is_empty())
.unwrap_or_else(|| "us-east-1".to_string());
@@ -4282,7 +4282,7 @@ async fn start_site_bucket_resync(bucket: &str, peer: &PeerInfo, resync_id: &str
}
BucketTargetSys::get().update_all_targets(bucket, Some(&targets)).await;
let Some(pool) = resolve_replication_pool_handle() else {
let Some(pool) = current_replication_pool_handle() else {
bucket_status.status = "failed".to_string();
bucket_status.err_detail = "replication pool is not initialized".to_string();
return bucket_status;
@@ -4350,7 +4350,7 @@ async fn cancel_site_bucket_resync(bucket: &str, peer: &PeerInfo, resync_id: &st
}
BucketTargetSys::get().update_all_targets(bucket, Some(&targets)).await;
let Some(pool) = resolve_replication_pool_handle() else {
let Some(pool) = current_replication_pool_handle() else {
bucket_status.status = "failed".to_string();
bucket_status.err_detail = "replication pool is not initialized".to_string();
return bucket_status;
@@ -4569,7 +4569,7 @@ fn group_info_requires_upsert(update: &rustfs_madmin::GroupAddRemove) -> bool {
}
async fn apply_iam_item(item: SRIAMItem) -> S3Result<()> {
let Some(iam_sys) = resolve_iam_handle() else {
let Some(iam_sys) = current_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
let incoming_updated_at = item.updated_at;
@@ -4623,7 +4623,7 @@ async fn apply_iam_item(item: SRIAMItem) -> S3Result<()> {
let Some(sts_credential) = item.sts_credential else {
return Err(s3_error!(InvalidRequest, "stsCredential is required"));
};
let Some(secret) = resolve_token_signing_key() else {
let Some(secret) = current_token_signing_key() else {
return Err(s3_error!(InvalidRequest, "token signing key not initialized"));
};
let claims = get_claims_from_token_with_secret(&sts_credential.session_token, &secret)
@@ -5109,7 +5109,7 @@ impl Operation for SRPeerJoinHandler {
}
if !join_req.svc_acct_access_key.is_empty() && !join_req.svc_acct_secret_key.is_empty() {
let Some(iam_sys) = resolve_iam_handle() else {
let Some(iam_sys) = current_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -5353,7 +5353,7 @@ impl Operation for SiteReplicationEditHandler {
};
for target in current_state.peers.values() {
let local_target = resolve_deployment_id()
let local_target = current_deployment_id()
.as_ref()
.is_some_and(|deployment_id| deployment_id == &target.deployment_id);
if local_target {
@@ -5726,7 +5726,7 @@ impl Operation for SRRotateServiceAccountHandler {
#[cfg(test)]
mod tests {
use super::*;
use crate::admin::runtime_sources::{resolve_outbound_tls_generation, set_test_outbound_tls_generation};
use crate::admin::runtime_sources::{current_outbound_tls_generation, set_test_outbound_tls_generation};
use crate::admin::storage_api::runtime::Endpoint;
use crate::admin::storage_api::runtime::{EndpointServerPools, Endpoints, PoolEndpoints};
use http::{HeaderMap, HeaderValue, Uri};
@@ -7566,7 +7566,7 @@ mod tests {
#[tokio::test]
#[serial]
async fn test_site_replication_peer_client_rebuilds_when_generation_changes() {
let previous_generation = resolve_outbound_tls_generation().0;
let previous_generation = current_outbound_tls_generation().0;
let previous_cache = {
let mut cache = SITE_REPLICATION_PEER_CLIENT.lock().await;
let snapshot = cache.clone();
rustfs/src/admin/handlers/sts.rs
+8 -8
View File
@@ -15,7 +15,7 @@
use super::is_admin::IsAdminHandler;
use crate::admin::storage_api::bucket::utils::serialize;
use crate::{
admin::runtime_sources::{resolve_action_credentials, resolve_oidc_handle, resolve_token_signing_key},
admin::runtime_sources::{current_action_credentials, current_oidc_handle, current_token_signing_key},
admin::{
handlers::site_replication::site_replication_iam_change_hook,
router::{AdminOperation, Operation, S3Router},
@@ -59,7 +59,7 @@ fn has_identity_authorization_context(policies: &[String], groups: &[String]) ->
}
fn configured_roles_claim_key(provider_id: &str) -> Option<String> {
resolve_oidc_handle()
current_oidc_handle()
.as_ref()
.and_then(|oidc_sys| oidc_sys.get_provider_config(provider_id))
.map(|cfg| cfg.roles_claim.trim().to_string())
@@ -187,7 +187,7 @@ async fn handle_assume_role(
return Err(s3_error!(InvalidRequest, "AccessDenied"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
let conditions = crate::auth::get_condition_values(&headers, &cred, None, None, remote_addr);
@@ -239,7 +239,7 @@ async fn handle_assume_role(
return Err(s3_error!(InvalidArgument, "invalid policy arg"));
}
let Some(secret) = resolve_token_signing_key() else {
let Some(secret) = current_token_signing_key() else {
return Err(s3_error!(InvalidArgument, "global active sk not init"));
};
@@ -262,7 +262,7 @@ async fn handle_assume_role(
.await
.map_err(|_| s3_error!(InternalError, "set_temp_user failed"))?;
let root_access_key = resolve_action_credentials().map(|cred| cred.access_key);
let root_access_key = current_action_credentials().map(|cred| cred.access_key);
if root_access_key.as_deref() != Some(new_cred.parent_user.as_str())
&& let Err(err) = site_replication_iam_change_hook(SRIAMItem {
r#type: "sts-credential".to_string(),
@@ -316,7 +316,7 @@ async fn handle_assume_role_with_web_identity(body: AssumeRoleRequest) -> S3Resu
}
// Verify the JWT and extract claims
let oidc_sys = resolve_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let oidc_sys = current_oidc_handle().ok_or_else(|| s3_error!(InternalError, "OIDC not initialized"))?;
let (claims, provider_id) = oidc_sys
.verify_web_identity_token(&body.web_identity_token)
@@ -429,7 +429,7 @@ pub async fn create_oidc_sts_credentials(
}
// Generate STS temp credentials
let secret = resolve_token_signing_key().ok_or_else(|| s3_error!(InternalError, "token signing key not initialized"))?;
let secret = current_token_signing_key().ok_or_else(|| s3_error!(InternalError, "token signing key not initialized"))?;
let mut new_cred = get_new_credentials_with_metadata(&token_claims, &secret)
.map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, format!("credential generation failed: {e}")))?;
@@ -439,7 +439,7 @@ pub async fn create_oidc_sts_credentials(
// Store temp user in IAM
let iam_store =
crate::admin::runtime_sources::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "IAM not initialized"))?;
crate::admin::runtime_sources::current_ready_iam_handle().map_err(|_| s3_error!(InternalError, "IAM not initialized"))?;
let updated_at = iam_store
.set_temp_user(&new_cred.access_key, &new_cred, None)
rustfs/src/admin/handlers/system.rs
+2 -2
View File
@@ -16,7 +16,7 @@ use super::{cluster_snapshot, metrics};
use crate::admin::auth::validate_admin_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::{
DefaultAdminUsecase, QueryServerInfoRequest, default_admin_usecase, resolve_endpoints_handle,
DefaultAdminUsecase, QueryServerInfoRequest, current_endpoints_handle, default_admin_usecase,
};
use crate::admin::storage_api::cluster::{
CapabilityState, CapabilityStatus, ObservabilitySnapshotProvider, TopologySnapshot, TopologySnapshotProvider,
@@ -314,7 +314,7 @@ pub(crate) async fn build_runtime_capabilities_response()
let workload_admission = workload_admission_registry_snapshot();
let cluster_snapshot_discovery = cluster_snapshot::build_cluster_snapshot_discovery_response().await;
let (topology, topology_status) = if let Some(endpoint_pools) = resolve_endpoints_handle() {
let (topology, topology_status) = if let Some(endpoint_pools) = current_endpoints_handle() {
let topology_provider = EndpointTopologySnapshotProvider::new(endpoint_pools);
let topology = topology_provider.topology_snapshot().await?;
(Some(topology), CapabilityStatus::supported())
rustfs/src/admin/handlers/table_catalog.rs
+3 -3
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::runtime_sources::default_admin_usecase;
use crate::admin::runtime_sources::{current_object_store_handle, resolve_token_signing_key};
use crate::admin::runtime_sources::{current_object_store_handle, current_token_signing_key};
use crate::admin::storage_api::bucket::{metadata::table_catalog_path_hash, metadata_sys};
use crate::admin::storage_api::runtime::ECStore;
use crate::admin::{
@@ -709,13 +709,13 @@ impl TableCredentialIssuer for IamTableCredentialIssuer {
serde_json::Value::String(request.scope_prefix.clone()),
);
let secret = resolve_token_signing_key().ok_or_else(|| s3_error!(InternalError, "token signing key not initialized"))?;
let secret = current_token_signing_key().ok_or_else(|| s3_error!(InternalError, "token signing key not initialized"))?;
let mut credential = get_new_credentials_with_metadata(&claims, &secret)
.map_err(|err| s3_error!(InternalError, "failed to generate table credentials: {}", err))?;
bind_table_credential_parent(&mut credential, principal);
let iam_store =
crate::admin::runtime_sources::resolve_ready_iam_handle().map_err(|_| s3_error!(InternalError, "iam not init"))?;
crate::admin::runtime_sources::current_ready_iam_handle().map_err(|_| s3_error!(InternalError, "iam not init"))?;
iam_store
.set_temp_user(&credential.access_key, &credential, None)
.await
rustfs/src/admin/handlers/tier.rs
+8 -8
View File
@@ -20,7 +20,7 @@ use crate::admin::storage_api::tier::{
};
use crate::{
admin::runtime_sources::{
current_notification_system, current_object_store_handle, resolve_daily_tier_stats, resolve_tier_config_handle,
current_daily_tier_stats, current_notification_system, current_object_store_handle, current_tier_config_handle,
},
admin::{
auth::validate_admin_request,
@@ -297,7 +297,7 @@ impl Operation for AddTier {
};
{
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let mut tier_config_mgr = tier_config_mgr_handle.write().await;
if let Err(err) = tier_config_mgr.reload(store).await {
warn!(
@@ -444,7 +444,7 @@ impl Operation for EditTier {
};
{
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let mut tier_config_mgr = tier_config_mgr_handle.write().await;
if let Err(err) = tier_config_mgr.reload(store).await {
warn!(
@@ -545,7 +545,7 @@ impl Operation for ListTiers {
)
.await?;
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let tier_config_mgr = tier_config_mgr_handle.read().await;
let tiers = tier_config_mgr.list_tiers();
@@ -614,7 +614,7 @@ impl Operation for RemoveTier {
};
{
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let mut tier_config_mgr = tier_config_mgr_handle.write().await;
if let Err(err) = tier_config_mgr.reload(store).await {
warn!(
@@ -702,7 +702,7 @@ impl Operation for VerifyTier {
.await?;
let tier = resolve_tier_name(&req.uri, &params)?;
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let mut tier_config_mgr = tier_config_mgr_handle.write().await;
tier_config_mgr.verify(&tier).await.map_err(map_tier_verify_error)?;
@@ -749,7 +749,7 @@ impl Operation for GetTierInfo {
} else {
None
};
let info = filter_tier_stats(resolve_daily_tier_stats(), tier_name);
let info = filter_tier_stats(current_daily_tier_stats(), tier_name);
let data = serde_json::to_vec(&info)
.map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, format!("marshal tier err {e}")))?;
@@ -891,7 +891,7 @@ impl Operation for ClearTier {
return Err(s3_error!(InvalidRequest, "invalid clear-tier confirmation token"));
};
let tier_config_mgr_handle = resolve_tier_config_handle();
let tier_config_mgr_handle = current_tier_config_handle();
let mut tier_config_mgr = tier_config_mgr_handle.write().await;
//tier_config_mgr.reload(api);
if let Err(err) = tier_config_mgr.clear_tier(force).await {
rustfs/src/admin/handlers/tls_debug.rs
+2 -2
View File
@@ -14,7 +14,7 @@
use super::profile::authorize_profile_request;
use crate::admin::router::{AdminOperation, Operation, S3Router};
use crate::admin::runtime_sources::resolve_outbound_tls_state;
use crate::admin::runtime_sources::current_outbound_tls_state;
use crate::server::ADMIN_PREFIX;
use http::StatusCode;
use http::{HeaderMap, HeaderValue};
@@ -45,7 +45,7 @@ impl Operation for TlsStatusHandler {
authorize_profile_request(&req).await?;
let tls_path = rustfs_utils::get_env_opt_str(rustfs_config::ENV_RUSTFS_TLS_PATH).unwrap_or_default();
let outbound = resolve_outbound_tls_state().await;
let outbound = current_outbound_tls_state().await;
let generation = outbound.generation.0;
let has_root_ca = outbound.root_ca_pem.as_ref().is_some_and(|pem| !pem.is_empty());
let has_mtls_identity = outbound.mtls_identity.is_some();
rustfs/src/admin/handlers/trace.rs
+2 -2
View File
@@ -13,7 +13,7 @@
// limitations under the License.
use crate::admin::router::Operation;
use crate::admin::runtime_sources::resolve_endpoints_handle;
use crate::admin::runtime_sources::current_endpoints_handle;
use crate::admin::storage_api::runtime::PeerRestClient;
use http::StatusCode;
use hyper::Uri;
@@ -40,7 +40,7 @@ impl Operation for Trace {
let _trace_opts = extract_trace_options(&req.uri)?;
// let (tx, rx) = mpsc::channel(10000);
let _peers = match resolve_endpoints_handle() {
let _peers = match current_endpoints_handle() {
Some(ep) => PeerRestClient::new_clients(ep.clone()).await,
None => (Vec::new(), Vec::new()),
};
rustfs/src/admin/handlers/user.rs
+11 -11
View File
@@ -15,7 +15,7 @@
use super::iam_error::iam_error_to_s3_error;
use super::{account_info, group, service_account, user_iam, user_lifecycle, user_policy_binding};
use crate::{
admin::runtime_sources::resolve_action_credentials,
admin::runtime_sources::current_action_credentials,
admin::{
auth::validate_admin_request,
handlers::site_replication::site_replication_iam_change_hook,
@@ -221,13 +221,13 @@ impl Operation for AddUser {
return Err(s3_error!(InvalidArgument, "secret key is required"));
}
if let Some(sys_cred) = resolve_action_credentials()
if let Some(sys_cred) = current_action_credentials()
&& constant_time_eq(&sys_cred.access_key, ak)
{
return Err(s3_error!(InvalidArgument, "cannot create a user with the system access key"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -356,7 +356,7 @@ impl Operation for SetUserStatus {
let status = AccountStatus::try_from(query.status.as_deref().unwrap_or_default())
.map_err(|e| S3Error::with_message(S3ErrorCode::InvalidArgument, e))?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -408,7 +408,7 @@ impl Operation for ListUsers {
}
};
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -474,14 +474,14 @@ impl Operation for RemoveUser {
return Err(s3_error!(InvalidArgument, "access key is empty"));
}
let sys_cred = resolve_action_credentials()
let sys_cred = current_action_credentials()
.ok_or_else(|| S3Error::with_message(S3ErrorCode::InternalError, "failed to load global credentials"))?;
if ak == sys_cred.access_key || ak == cred.access_key || cred.parent_user == ak {
return Err(s3_error!(InvalidArgument, "cannot remove the current user"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -558,7 +558,7 @@ impl Operation for GetUserInfo {
return Err(s3_error!(InvalidArgument, "access key is empty"));
}
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InternalError, "iam is not initialized"));
};
@@ -654,7 +654,7 @@ impl Operation for ExportIam {
)
.await?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -888,7 +888,7 @@ impl Operation for ImportIam {
let mut zip_reader =
ZipArchive::new(Cursor::new(body)).map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, e.to_string()))?;
let Ok(iam_store) = crate::admin::runtime_sources::resolve_ready_iam_handle() else {
let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
return Err(s3_error!(InvalidRequest, "iam not init"));
};
@@ -933,7 +933,7 @@ impl Operation for ImportIam {
}
}
let Some(sys_cred) = resolve_action_credentials() else {
let Some(sys_cred) = current_action_credentials() else {
return Err(s3_error!(InvalidRequest, "get sys cred failed"));
};
rustfs/src/admin/router.rs
+13 -13
View File
@@ -28,9 +28,9 @@ use super::storage_api::runtime::PeerRestClient;
use crate::admin::console::{is_console_path, make_console_server};
use crate::admin::handlers::oidc::is_oidc_path;
use crate::admin::runtime_sources::{
current_notification_system, current_object_store_handle, current_server_config, default_object_usecase, resolve_boot_time,
resolve_bucket_monitor_handle, resolve_deployment_id, resolve_region, resolve_replication_pool_handle,
resolve_replication_stats_handle,
current_boot_time, current_bucket_monitor_handle, current_deployment_id, current_notification_system,
current_object_store_handle, current_region, current_replication_pool_handle, current_replication_stats_handle,
current_server_config, default_object_usecase,
};
use crate::admin::storage_api::access::{ReqInfo, authorize_request, spawn_traced};
use crate::admin::storage_api::contract::bucket::{BucketOperations, BucketOptions};
@@ -750,7 +750,7 @@ fn build_object_lambda_source_url(req: &S3Request<Body>) -> S3Result<String> {
let region = req
.region
.clone()
.or_else(resolve_region)
.or_else(current_region)
.map(|value| value.as_str().to_string())
.unwrap_or_else(|| "us-east-1".to_string());
let session_token = get_session_token(&req.uri, &req.headers).unwrap_or_default().to_string();
@@ -1422,7 +1422,7 @@ async fn ensure_replication_config_exists(bucket: &str) -> S3Result<()> {
}
async fn build_replication_metrics_response(bucket: &str, route: ReplicationExtRoute) -> S3Result<S3Response<Body>> {
let bucket_stats = match resolve_replication_stats_handle() {
let bucket_stats = match current_replication_stats_handle() {
Some(stats) => stats.get_latest_replication_stats(bucket).await,
None => BucketStats::default(),
};
@@ -1438,14 +1438,14 @@ async fn build_replication_metrics_response(bucket: &str, route: ReplicationExtR
}
fn replication_metrics_uptime_seconds() -> i64 {
resolve_boot_time()
current_boot_time()
.and_then(|boot_time| SystemTime::now().duration_since(boot_time).ok())
.map(|uptime| uptime.as_secs() as i64)
.unwrap_or_default()
}
fn collect_replication_metrics_bandwidth(bucket: &str) -> HashMap<String, BandwidthDetails> {
resolve_bucket_monitor_handle()
current_bucket_monitor_handle()
.map(|monitor| {
monitor
.get_report(|name| name == bucket)
@@ -1513,7 +1513,7 @@ async fn authorize_replication_extension_request(req: &mut S3Request<Body>, ext_
bucket: Some(ext_req.bucket.clone()),
object: None,
version_id: None,
region: resolve_region(),
region: current_region(),
..Default::default()
});
@@ -1828,7 +1828,7 @@ async fn check_replication_target(bucket: &str, target: &BucketTarget) -> Replic
if target.target_bucket == bucket
&& !target.deployment_id.is_empty()
&& resolve_deployment_id().as_deref() == Some(target.deployment_id.as_str())
&& current_deployment_id().as_deref() == Some(target.deployment_id.as_str())
{
result.status = "FAILED".to_string();
result.error = Some("target bucket must not match source bucket on the same deployment".to_string());
@@ -2149,7 +2149,7 @@ async fn start_replication_resync(bucket: &str, reset: &ReplicationResetStartReq
.map_err(ApiError::from)?;
BucketTargetSys::get().update_all_targets(bucket, Some(&targets)).await;
let Some(pool) = resolve_replication_pool_handle() else {
let Some(pool) = current_replication_pool_handle() else {
return Err(s3_error!(InternalError, "replication pool is not initialized"));
};
@@ -2169,7 +2169,7 @@ async fn start_replication_resync(bucket: &str, reset: &ReplicationResetStartReq
}
async fn load_replication_resync_status(bucket: &str) -> S3Result<BucketReplicationResyncStatus> {
let Some(pool) = resolve_replication_pool_handle() else {
let Some(pool) = current_replication_pool_handle() else {
return Err(s3_error!(InternalError, "replication pool is not initialized"));
};
@@ -2242,7 +2242,7 @@ async fn authorize_misc_extension_request(req: &mut S3Request<Body>, route: &Mis
bucket,
object,
version_id: None,
region: resolve_region(),
region: current_region(),
..Default::default()
});
@@ -3661,7 +3661,7 @@ mod tests {
access_key: "rustfsadmin".to_string(),
secret_key: s3s::auth::SecretKey::from("rustfssecret"),
}),
region: resolve_region(),
region: current_region(),
service: None,
trailing_headers: None,
};
rustfs/src/admin/runtime_sources.rs
+13 -7
View File
@@ -18,13 +18,19 @@ pub(crate) use crate::app::admin_usecase::{
};
use crate::app::object_usecase::DefaultObjectUsecase;
pub(crate) use crate::runtime_sources::{
AppContext, publish_server_config, publish_storage_class_config, resolve_action_credentials, resolve_boot_time,
resolve_bucket_metadata_handle, resolve_bucket_monitor_handle, resolve_daily_tier_stats, resolve_deployment_id,
resolve_endpoints_handle, resolve_iam_handle, resolve_kms_runtime_service_manager, resolve_notification_system_for_context,
resolve_object_store_handle_for_context, resolve_oidc_handle, resolve_or_init_kms_runtime_service_manager,
resolve_outbound_tls_generation, resolve_outbound_tls_state, resolve_ready_iam_handle, resolve_region,
resolve_replication_pool_handle, resolve_replication_stats_handle, resolve_runtime_port, resolve_scanner_metrics_report,
resolve_server_config_for_context, resolve_tier_config_handle, resolve_token_signing_key,
AppContext, publish_server_config, publish_storage_class_config, resolve_action_credentials as current_action_credentials,
resolve_boot_time as current_boot_time, resolve_bucket_metadata_handle as current_bucket_metadata_handle,
resolve_bucket_monitor_handle as current_bucket_monitor_handle, resolve_daily_tier_stats as current_daily_tier_stats,
resolve_deployment_id as current_deployment_id, resolve_endpoints_handle as current_endpoints_handle,
resolve_iam_handle as current_iam_handle, resolve_kms_runtime_service_manager as current_kms_runtime_service_manager,
resolve_notification_system_for_context, resolve_object_store_handle_for_context, resolve_oidc_handle as current_oidc_handle,
resolve_or_init_kms_runtime_service_manager as current_or_init_kms_runtime_service_manager,
resolve_outbound_tls_generation as current_outbound_tls_generation, resolve_outbound_tls_state as current_outbound_tls_state,
resolve_ready_iam_handle as current_ready_iam_handle, resolve_region as current_region,
resolve_replication_pool_handle as current_replication_pool_handle,
resolve_replication_stats_handle as current_replication_stats_handle, resolve_runtime_port as current_runtime_port,
resolve_scanner_metrics_report as current_scanner_metrics_report, resolve_server_config_for_context,
resolve_tier_config_handle as current_tier_config_handle, resolve_token_signing_key as current_token_signing_key,
};
use rustfs_config::server_config::Config;
use std::sync::Arc;