gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-08 14:23:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: same-origin console CORS, fail-closed helm creds, deny.toml, sample-config hardening (#2769)

Browse Source 
Signed-off-by: Michael Graff <explorer@flame.org>
Signed-off-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: loverustfs <hello@rustfs.com>
This commit is contained in:
Michael Graff
2026-05-06 02:34:44 -05:00
committed by GitHub
parent 718bec7722
commit 3898d524fe
9 changed files with 373 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/rustfs/templates/secret.yaml
+21 -2
View File
@@ -1,4 +1,23 @@
{{- if not .Values.secret.existingSecret }}
{{- $accessKey := .Values.secret.rustfs.access_key | default "" }}
{{- $secretKey := .Values.secret.rustfs.secret_key | default "" }}
{{- $allowInsecure := .Values.secret.allowInsecureDefaults | default false }}
{{/* Either key set to the well-known default counts as insecure. */}}
{{- $hasDefaultKey := or (eq $accessKey "rustfsadmin") (eq $secretKey "rustfsadmin") }}
{{- $bothEmpty := and (eq $accessKey "") (eq $secretKey "") }}
{{- $oneEmpty := and (not $bothEmpty) (or (eq $accessKey "") (eq $secretKey "")) }}
{{/* Always fail when only one of the two keys is supplied — never silently
auto-fill a single missing key with the well-known default. */}}
{{- if $oneEmpty }}
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must both be set, or both be left empty. Setting only one of the two is ambiguous and is rejected to avoid silently using the well-known default for the missing key.") }}
{{- end }}
{{- if and (not $allowInsecure) (or $bothEmpty $hasDefaultKey) }}
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must be set to non-default, non-empty values, or set secret.existingSecret to a Secret you control. To opt into the well-known default credentials for local development only, set secret.allowInsecureDefaults=true.") }}
{{- end }}
{{- if and $allowInsecure $bothEmpty }}
{{- $accessKey = "rustfsadmin" }}
{{- $secretKey = "rustfsadmin" }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
@@ -8,8 +27,8 @@ metadata:
{{- toYaml .Values.commonLabels | nindent 4 }}
type: Opaque
data:
RUSTFS_ACCESS_KEY: {{ .Values.secret.rustfs.access_key | b64enc | quote }}
RUSTFS_SECRET_KEY: {{ .Values.secret.rustfs.secret_key | b64enc | quote }}
RUSTFS_ACCESS_KEY: {{ $accessKey | b64enc | quote }}
RUSTFS_SECRET_KEY: {{ $secretKey | b64enc | quote }}
{{- end }}
---
helm/rustfs/values.yaml
+10 -2
View File
@@ -48,9 +48,17 @@ mode:
secret:
existingSecret: ""
# SECURITY: rendering fails by default unless one of the following is true:
# 1. `secret.existingSecret` names a Kubernetes Secret you control, or
# 2. `secret.rustfs.access_key` and `secret.rustfs.secret_key` are both
# set to non-empty, non-default values, or
# 3. `secret.allowInsecureDefaults: true` is set (only for local dev).
# This prevents accidental deployment with the well-known default
# `rustfsadmin/rustfsadmin` credentials.
allowInsecureDefaults: false
rustfs:
access_key: rustfsadmin
secret_key: rustfsadmin
access_key: ""
secret_key: ""
config:
rustfs: