gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 16:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

AssumeRoleHandle done

Browse Source
This commit is contained in:
weisd
2024-12-10 16:59:27 +08:00
parent 637d614618
commit 8172c4f06a
21 changed files with 339 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+3
View File
@@ -1287,6 +1287,7 @@ dependencies = [
"futures",
"ipnetwork",
"itertools",
"jsonwebtoken",
"log",
"rand",
"serde",
@@ -1296,6 +1297,7 @@ dependencies = [
"thiserror 2.0.3",
"time",
"tokio",
"tracing",
]
[[package]]
@@ -2521,6 +2523,7 @@ dependencies = [
"hyper",
"hyper-util",
"iam",
"jsonwebtoken",
"lazy_static",
"lock",
"log",
ecstore/src/disk/error.rs
+2
View File
@@ -1,5 +1,7 @@
use std::io::{self, ErrorKind};
use tracing::error;
use crate::{
error::{Error, Result},
quorum::CheckErrorFn,
ecstore/src/error.rs
+1
View File
@@ -1,5 +1,6 @@
use std::io;
use tracing::warn;
use tracing_error::{SpanTrace, SpanTraceStatus};
use crate::disk::error::{clone_disk_err, DiskError};
ecstore/src/store.rs
+1 -1
View File
@@ -54,10 +54,10 @@ use std::slice::Iter;
use std::time::SystemTime;
use std::{collections::HashMap, sync::Arc, time::Duration};
use time::OffsetDateTime;
use tokio::select;
use tokio::sync::mpsc::Sender;
use tokio::sync::{broadcast, mpsc, RwLock};
use tokio::time::{interval, sleep};
use tokio::{fs, select};
use tracing::{debug, info};
use uuid::Uuid;
ecstore/src/store_api.rs
-1
View File
@@ -9,7 +9,6 @@ use crate::{
use futures::StreamExt;
use http::HeaderMap;
use madmin::heal_commands::HealResultItem;
use madmin::info_commands::DiskMetrics;
use rmp_serde::Serializer;
use s3s::{dto::StreamingBlob, Body};
use serde::{Deserialize, Serialize};
ecstore/src/utils/path.rs
+2 -2
View File
@@ -222,9 +222,9 @@ pub fn split(path: &str) -> (&str, &str) {
(path, "")
}
pub fn dir(path: &str) -> &str {
pub fn dir(path: &str) -> String {
let (a, _) = split(path);
a
clean(a)
}
#[cfg(test)]
mod tests {
iam/Cargo.toml
+2
View File
@@ -26,6 +26,8 @@ itertools = "0.13.0"
futures.workspace = true
rand.workspace = true
base64-simd = "0.8.0"
jsonwebtoken = "9.3.0"
tracing.workspace = true
[dev-dependencies]
test-case.workspace = true
iam/src/auth/credentials.rs
+50 -4
View File
@@ -1,13 +1,21 @@
use crate::policy::{Policy, Validator};
use crate::service_type::ServiceType;
use crate::{utils, Error};
use jsonwebtoken::{encode, Algorithm, Header};
use serde::{Deserialize, Serialize};
use serde_json::{json, Value};
use std::cell::LazyCell;
use std::collections::HashMap;
use time::format_description::BorrowedFormatItem;
use time::{Date, OffsetDateTime};
use time::{Date, Duration, OffsetDateTime};
use crate::policy::{Policy, Validator};
use crate::service_type::ServiceType;
use crate::{utils, Error};
const ACCESS_KEY_MIN_LEN: usize = 3;
const ACCESS_KEY_MAX_LEN: usize = 20;
const SECRET_KEY_MIN_LEN: usize = 8;
const SECRET_KEY_MAX_LEN: usize = 40;
const ACCOUNT_ON: &str = "on";
const ACCOUNT_OFF: &str = "off";
#[cfg_attr(test, derive(PartialEq, Eq, Debug))]
struct CredentialHeader {
@@ -102,6 +110,44 @@ impl Credentials {
Self::check_key_value(header)
}
pub fn get_new_credentials_with_metadata<T: Serialize>(
claims: &T,
token_secret: &str,
exp: Option<usize>,
) -> crate::Result<Self> {
let ak = utils::gen_access_key(20).unwrap_or_default();
let sk = utils::gen_secret_key(32).unwrap_or_default();
Self::create_new_credentials_with_metadata(&ak, &sk, claims, token_secret, exp)
}
pub fn create_new_credentials_with_metadata<T: Serialize>(
ak: &str,
sk: &str,
claims: &T,
token_secret: &str,
exp: Option<usize>,
) -> crate::Result<Self> {
if ak.len() < ACCESS_KEY_MIN_LEN || ak.len() > ACCESS_KEY_MAX_LEN {
return Err(Error::InvalidAccessKeyLength);
}
if sk.len() < SECRET_KEY_MIN_LEN || sk.len() > SECRET_KEY_MAX_LEN {
return Err(Error::InvalidAccessKeyLength);
}
let token = utils::generate_jwt(claims, token_secret).map_err(Error::JWTError)?;
Ok(Self {
access_key: ak.to_owned(),
secret_key: sk.to_owned(),
session_token: token,
status: ACCOUNT_ON.to_owned(),
expiration: exp.map(|v| OffsetDateTime::now_utc().saturating_add(Duration::seconds(v as i64))),
..Default::default()
})
}
pub fn check_key_value(_header: CredentialHeader) -> crate::Result<Self> {
todo!()
}
iam/src/cache.rs
+1 -1
View File
@@ -89,7 +89,7 @@ impl Cache {
impl CacheInner {
#[inline]
fn get_user<'a>(&self, user_name: &'a str) -> Option<&UserIdentity> {
pub fn get_user<'a>(&self, user_name: &'a str) -> Option<&UserIdentity> {
self.users.get(user_name).or_else(|| self.sts_accounts.get(user_name))
}
iam/src/error.rs
+9
View File
@@ -28,6 +28,15 @@ pub enum Error {
#[error("malformed credential")]
ErrCredMalformed,
#[error("CredNotInitialized")]
CredNotInitialized,
#[error("invalid key length")]
InvalidAccessKeyLength,
#[error("jwt err {0}")]
JWTError(jsonwebtoken::errors::Error),
}
pub type Result<T> = std::result::Result<T, Error>;
iam/src/lib.rs
+34 -2
View File
@@ -7,7 +7,7 @@ use std::sync::{Arc, OnceLock};
use store::object::ObjectStore;
use time::OffsetDateTime;
mod cache;
pub mod cache;
mod format;
mod handler;
@@ -24,6 +24,38 @@ pub use error::{Error, Result};
static IAM_SYS: OnceLock<Arc<IamCache<ObjectStore>>> = OnceLock::new();
static GLOBAL_ACTIVE_CRED: OnceLock<Credentials> = OnceLock::new();
pub fn init_global_action_cred(ak: Option<String>, sk: Option<String>) -> Result<()> {
let ak = {
if let Some(k) = ak {
k
} else {
utils::gen_access_key(20).unwrap_or_default()
}
};
let sk = {
if let Some(k) = sk {
k
} else {
utils::gen_secret_key(32).unwrap_or_default()
}
};
GLOBAL_ACTIVE_CRED
.set(Credentials {
access_key: ak,
secret_key: sk,
..Default::default()
})
.map_err(|_e| Error::CredNotInitialized)
}
pub fn get_global_action_cred() -> Option<Credentials> {
GLOBAL_ACTIVE_CRED.get().cloned()
}
pub async fn init_iam_sys(ecstore: Arc<ECStore>) -> crate::Result<()> {
debug!("init iam system");
let s = IamCache::new(ObjectStore::new(ecstore)).await;
@@ -33,7 +65,7 @@ pub async fn init_iam_sys(ecstore: Arc<ECStore>) -> crate::Result<()> {
#[inline]
pub fn get() -> crate::Result<Arc<IamCache<ObjectStore>>> {
IAM_SYS.get().map(|x| Arc::clone(x)).ok_or(Error::IamSysNotInitialized)
IAM_SYS.get().map(Arc::clone).ok_or(Error::IamSysNotInitialized)
}
pub async fn is_allowed<'a>(args: Args<'a>) -> crate::Result<bool> {
iam/src/manager.rs
+50 -8
View File
@@ -109,11 +109,12 @@ where
}
// todo, 判断是否存在，是否可以重试
#[tracing::instrument(level = "debug", skip(self))]
async fn save_iam_formatter(self: Arc<Self>) -> crate::Result<()> {
match self.api.load_iam_config::<Format>(Format::PATH).await {
Ok((format, _)) if format.version >= 1 => return Ok(()),
Err(Error::EcstoreError(e)) if !ecstore::disk::error::is_err_file_not_found(&e) => {
return Err(Error::EcstoreError(e))
return Err(Error::EcstoreError(e));
}
_ => {}
}
@@ -127,13 +128,14 @@ where
Ok(users
.values()
.filter_map(|x| {
if !access_key.is_empty() && x.credentials.parent_user.as_str() == access_key {
if x.credentials.is_service_account() {
let mut c = x.credentials.clone();
c.secret_key = String::new();
c.session_token = String::new();
return Some(c);
}
if !access_key.is_empty()
&& x.credentials.parent_user.as_str() == access_key
&& x.credentials.is_service_account()
{
let mut c = x.credentials.clone();
c.secret_key = String::new();
c.session_token = String::new();
return Some(c);
}
None
@@ -220,4 +222,44 @@ where
_ => Ok(None),
}
}
pub async fn policy_db_get(&self, name: &str, _groups: Option<Vec<String>>) -> crate::Result<Vec<String>> {
// let user = self.cache.users.load();
// let Some(u) = user.get(name) else {
// return Err(Error::StringError("no service account".into()));
// };
let policies = self.cache.user_policies.load();
let user_policies = {
if let Some(p) = policies.get(name) {
p.to_slice()
} else {
Vec::new()
}
};
// TODO: groups
Ok(user_policies)
}
pub async fn set_temp_user(&self, _access_key: &str, cred: &Credentials, _policy_name: &str) -> crate::Result<()> {
let user_entiry = UserIdentity::from(cred.clone());
let path = format!(
"config/iam/{}{}/identity.json",
UserType::Sts.prefix(),
user_entiry.credentials.access_key
);
debug!("save object: {path:?}");
self.api.save_iam_config(&user_entiry, path).await?;
Cache::add_or_update(
&self.cache.users,
&user_entiry.credentials.access_key,
&user_entiry,
OffsetDateTime::now_utc(),
);
Ok(())
}
}
iam/src/policy.rs
+9 -1
View File
@@ -17,7 +17,7 @@ pub use id::ID;
pub use policy::{default::DEFAULT_POLICIES, Policy};
pub use resource::ResourceSet;
use serde::{Deserialize, Serialize};
use serde_json::Value;
use serde_json::{to_string, Value};
pub use statement::Statement;
use std::collections::HashMap;
use time::OffsetDateTime;
@@ -37,6 +37,14 @@ impl MappedPolicy {
update_at: OffsetDateTime::now_utc(),
}
}
pub fn to_slice(&self) -> Vec<String> {
self.policies
.split(",")
.filter(|v| !v.trim().is_empty())
.map(|v| v.to_string())
.collect()
}
}
pub struct GroupInfo {
iam/src/store.rs
+2 -1
View File
@@ -8,7 +8,7 @@ use serde::{de::DeserializeOwned, Serialize};
use crate::{
auth::UserIdentity,
cache::Cache,
policy::{PolicyDoc, UserType, DEFAULT_POLICIES},
policy::{MappedPolicy, PolicyDoc, UserType, DEFAULT_POLICIES},
};
#[async_trait::async_trait]
@@ -40,4 +40,5 @@ pub trait Store: Clone + Send + Sync + 'static {
async fn load_users(&self, user_type: UserType) -> crate::Result<HashMap<String, UserIdentity>>;
async fn load_policy_docs(&self) -> crate::Result<HashMap<String, PolicyDoc>>;
async fn load_mapped_policy(&self, user_type: UserType, name: &str, is_group: bool) -> crate::Result<MappedPolicy>;
}
iam/src/store/object.rs
+39 -23
View File
@@ -8,8 +8,9 @@ use ecstore::{
utils::path::dir,
};
use futures::future::try_join_all;
use log::debug;
use log::{debug, warn};
use serde::{de::DeserializeOwned, Serialize};
use tracing::error;
use super::Store;
use crate::{
@@ -99,14 +100,6 @@ impl ObjectStore {
Ok(Some(user))
}
async fn load_mapped_policy(&self, user_type: UserType, name: &str, _is_group: bool) -> crate::Result<MappedPolicy> {
let (p, _) = self
.load_iam_config::<MappedPolicy>(&format!("{base}{name}.json", base = user_type.prefix(), name = name))
.await?;
Ok(p)
}
}
#[async_trait::async_trait]
@@ -137,6 +130,7 @@ impl Store for ObjectStore {
))
}
#[tracing::instrument(level = "debug", skip(self, item, path))]
async fn save_iam_config<Item: Serialize + Send>(&self, item: Item, path: impl AsRef<str> + Send) -> crate::Result<()> {
let data = serde_json::to_vec(&item).map_err(|e| crate::Error::StringError(e.to_string()))?;
// let data = crypto::encrypt_data(&[], &data)?;
@@ -169,8 +163,8 @@ impl Store for ObjectStore {
.await?;
if policy_doc.version == 0 {
policy_doc.create_date = object_info.mod_time.clone();
policy_doc.update_date = object_info.mod_time.clone();
policy_doc.create_date = object_info.mod_time;
policy_doc.update_date = object_info.mod_time;
}
result.insert(name.to_str().unwrap().to_owned(), policy_doc);
@@ -219,7 +213,7 @@ impl Store for ObjectStore {
"policydb/groups/",
"service-accounts/",
"policydb/sts-users/",
"sts",
"sts/",
],
)
.await?;
@@ -234,12 +228,13 @@ impl Store for ObjectStore {
);
// 一次读取32个元素
let mut iter = items
let iter = items
.iter()
.map(|item| item.trim_start_matches("config/iam/"))
.map(|item| split_path(item, item.starts_with("policydb/")))
.filter_map(|(list_key, trimmed_item)| {
debug!("list_key: {list_key}, trimmed_item: {trimmed_item}");
if list_key == "format.json" {
return None;
}
@@ -255,13 +250,14 @@ impl Store for ObjectStore {
Some(async move {
match list_key {
"policies/" => {
let name = dir(trimmed_item).trim_end_matches('/');
let trimmed_item = dir(trimmed_item);
let name = trimmed_item.trim_end_matches('/');
let policy_doc = self.load_policy(name).await?;
policy_docs.lock().await.insert(name.to_owned(), policy_doc);
}
"users/" => {
let name = dir(trimmed_item);
if let Some(user) = self.load_user_identity(UserType::Reg, name).await? {
if let Some(user) = self.load_user_identity(UserType::Reg, &name).await? {
users.lock().await.insert(name.to_owned(), user);
};
}
@@ -276,7 +272,8 @@ impl Store for ObjectStore {
}
}
"service-accounts/" => {
let name = dir(trimmed_item).trim_end_matches('/');
let trimmed_item = dir(trimmed_item);
let name = trimmed_item.trim_end_matches('/');
let Some(user) = self.load_user_identity(UserType::Svc, name).await? else {
return Ok(());
};
@@ -299,7 +296,8 @@ impl Store for ObjectStore {
}
"sts/" => {
let name = dir(trimmed_item);
if let Some(user) = self.load_user_identity(UserType::Sts, name).await? {
if let Some(user) = self.load_user_identity(UserType::Sts, &name).await? {
warn!("sts_accounts insert {}, user {:?}", name, &user.credentials.access_key);
sts_accounts.lock().await.insert(name.to_owned(), user);
};
}
@@ -319,7 +317,7 @@ impl Store for ObjectStore {
let mut all_futures = Vec::with_capacity(32);
while let Some(f) = iter.next() {
for f in iter {
all_futures.push(f);
if all_futures.len() == 32 {
@@ -332,12 +330,30 @@ impl Store for ObjectStore {
try_join_all(all_futures).await?;
}
Arc::into_inner(users).map(|x| cache.users.store(Arc::new(x.into_inner().update_load_time())));
Arc::into_inner(policy_docs).map(|x| cache.policy_docs.store(Arc::new(x.into_inner().update_load_time())));
Arc::into_inner(user_policies).map(|x| cache.user_policies.store(Arc::new(x.into_inner().update_load_time())));
Arc::into_inner(sts_policies).map(|x| cache.sts_policies.store(Arc::new(x.into_inner().update_load_time())));
Arc::into_inner(sts_accounts).map(|x| cache.sts_accounts.store(Arc::new(x.into_inner().update_load_time())));
if let Some(x) = Arc::into_inner(users) {
cache.users.store(Arc::new(x.into_inner().update_load_time()))
}
if let Some(x) = Arc::into_inner(policy_docs) {
cache.policy_docs.store(Arc::new(x.into_inner().update_load_time()))
}
if let Some(x) = Arc::into_inner(user_policies) {
cache.user_policies.store(Arc::new(x.into_inner().update_load_time()))
}
if let Some(x) = Arc::into_inner(sts_policies) {
cache.sts_policies.store(Arc::new(x.into_inner().update_load_time()))
}
if let Some(x) = Arc::into_inner(sts_accounts) {
cache.sts_accounts.store(Arc::new(x.into_inner().update_load_time()))
}
Ok(())
}
async fn load_mapped_policy(&self, user_type: UserType, name: &str, _is_group: bool) -> crate::Result<MappedPolicy> {
let (p, _) = self
.load_iam_config::<MappedPolicy>(&format!("{base}{name}.json", base = user_type.prefix(), name = name))
.await?;
Ok(p)
}
}
iam/src/utils.rs
+8 -2
View File
@@ -1,6 +1,7 @@
use rand::{Rng, RngCore};
use crate::Error;
use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
use rand::{Rng, RngCore};
use serde::Serialize;
pub fn gen_access_key(length: usize) -> crate::Result<String> {
const ALPHA_NUMERIC_TABLE: [char; 36] = [
@@ -39,6 +40,11 @@ pub fn gen_secret_key(length: usize) -> crate::Result<String> {
Ok(key_str)
}
pub fn generate_jwt<T: Serialize>(claims: &T, secret: &str) -> Result<String, jsonwebtoken::errors::Error> {
let header = Header::new(Algorithm::HS512);
encode(&header, &claims, &EncodingKey::from_secret(secret.as_bytes()))
}
#[cfg(test)]
mod tests {
use super::{gen_access_key, gen_secret_key};
rustfs/Cargo.toml
+1
View File
@@ -67,6 +67,7 @@ atoi = "2.0.0"
serde_urlencoded = "0.7.1"
crypto = { path = "../crypto" }
iam = { path = "../iam" }
jsonwebtoken = "9.3.0"
[build-dependencies]
prost-build.workspace = true
rustfs/src/admin/handlers.rs
+78 -9
View File
@@ -20,6 +20,7 @@ use ecstore::GLOBAL_Endpoints;
use futures::{Stream, StreamExt};
use http::Uri;
use hyper::StatusCode;
use iam::get_global_action_cred;
use madmin::metrics::RealtimeMetrics;
use madmin::utils::parse_duration;
use matchit::Params;
@@ -47,6 +48,9 @@ use tracing::{error, info, warn};
pub mod service_account;
pub mod trace;
const ASSUME_ROLE_ACTION: &str = "AssumeRole";
const ASSUME_ROLE_VERSION: &str = "2011-06-15";
#[derive(Deserialize, Debug, Default)]
#[serde(rename_all = "PascalCase", default)]
pub struct AssumeRoleRequest {
@@ -85,13 +89,30 @@ pub struct AssumeRoleRequest {
// pub parent_user: String,
// }
#[derive(Debug, Serialize, Default)]
pub struct STSClaims {
parent: String,
exp: usize,
access_key: String,
}
fn get_token_signing_key() -> Option<String> {
if let Some(s) = get_global_action_cred() {
Some(s.secret_key.clone())
} else {
None
}
}
pub struct AssumeRoleHandle {}
#[async_trait::async_trait]
impl Operation for AssumeRoleHandle {
async fn call(&self, req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
warn!("handle AssumeRoleHandle");
let Some(cred) = req.credentials else { return Err(s3_error!(InvalidRequest, "get cred failed")) };
let Some(user) = req.credentials else { return Err(s3_error!(InvalidRequest, "get cred failed")) };
// TODO: 判断权限, 不允许sts访问
let mut input = req.input;
@@ -100,17 +121,67 @@ impl Operation for AssumeRoleHandle {
};
let body: AssumeRoleRequest = from_bytes(&bytes).map_err(|_e| s3_error!(InvalidRequest, "get body failed"))?;
warn!("AssumeRole get body {:?}", body);
if body.action.as_str() != ASSUME_ROLE_ACTION {
return Err(s3_error!(InvalidArgument, "not suport action"));
}
let exp = OffsetDateTime::now_utc().saturating_add(Duration::days(1));
if body.version.as_str() != ASSUME_ROLE_VERSION {
return Err(s3_error!(InvalidArgument, "not suport version"));
}
warn!("AssumeRole get cred {:?}", &user);
warn!("AssumeRole get body {:?}", &body);
let Ok(iam_store) = iam::get() else { return Err(s3_error!(InvalidRequest, "iam not init")) };
if let Err(_err) = iam_store.policy_db_get(&user.access_key, None).await {
return Err(s3_error!(InvalidArgument, "invalid policy arg"));
}
let Some(secret) = get_token_signing_key() else {
return Err(s3_error!(InvalidArgument, "sk not init"));
};
let exp = {
if body.duration_seconds > 0 {
body.duration_seconds
} else {
3600
}
};
let mut claims = STSClaims {
parent: user.access_key.clone(),
exp,
..Default::default()
};
let ak = iam::utils::gen_access_key(20).unwrap_or_default();
let sk = iam::utils::gen_secret_key(32).unwrap_or_default();
claims.access_key = ak.clone();
let mut cred = match iam::auth::Credentials::create_new_credentials_with_metadata(&ak, &sk, &claims, &secret, Some(exp)) {
Ok(res) => res,
Err(_er) => return Err(s3_error!(InvalidRequest, "")),
};
cred.parent_user = user.access_key.clone();
if let Err(err) = iam_store.set_temp_user(&cred.access_key, &cred, "").await {
error!("set_temp_user err {:?}", err);
return Err(s3_error!(InternalError, "set_temp_user failed"));
}
// TODO: create tmp access_key
let resp = AssumeRoleOutput {
credentials: Some(Credentials {
access_key_id: cred.access_key,
expiration: Timestamp::from(exp),
secret_access_key: cred.secret_key.expose().to_string(),
session_token: "sdfsdf".to_owned(),
expiration: Timestamp::from(
cred.expiration
.unwrap_or(OffsetDateTime::now_utc().saturating_add(Duration::seconds(3600))),
),
secret_access_key: cred.secret_key,
session_token: cred.session_token,
}),
..Default::default()
};
@@ -119,8 +190,6 @@ impl Operation for AssumeRoleHandle {
let output = xml::serialize::<AssumeRoleOutput>(&resp).unwrap();
Ok(S3Response::new((StatusCode::OK, Body::from(output))))
// return Err(s3_error!(NotImplemented));
}
}
rustfs/src/auth.rs
+39
View File
@@ -0,0 +1,39 @@
use iam::cache::CacheInner;
use s3s::auth::S3Auth;
use s3s::auth::SecretKey;
use s3s::auth::SimpleAuth;
use s3s::s3_error;
use s3s::S3Result;
pub struct IAMAuth {
simple_auth: SimpleAuth,
}
impl IAMAuth {
pub fn new(ak: impl Into<String>, sk: impl Into<SecretKey>) -> Self {
let simple_auth = SimpleAuth::from_single(ak, sk);
Self { simple_auth }
}
}
#[async_trait::async_trait]
impl S3Auth for IAMAuth {
async fn get_secret_key(&self, access_key: &str) -> S3Result<SecretKey> {
if access_key.is_empty() {
return Err(s3_error!(NotSignedUp, "Your account is not signed up"));
}
if let Ok(key) = self.simple_auth.get_secret_key(access_key).await {
return Ok(key);
}
if let Ok(iam_store) = iam::get() {
let c = CacheInner::from(&iam_store.cache);
if let Some(id) = c.get_user(access_key) {
return Ok(SecretKey::from(id.credentials.secret_key.clone()));
}
}
Err(s3_error!(NotSignedUp, "Your account is not signed up2"))
}
}
rustfs/src/main.rs
+7 -3
View File
@@ -1,8 +1,10 @@
mod admin;
mod auth;
mod config;
mod grpc;
mod service;
mod storage;
use crate::auth::IAMAuth;
use clap::Parser;
use common::{
error::{Error, Result},
@@ -26,7 +28,7 @@ use hyper_util::{
};
use iam::init_iam_sys;
use protos::proto_gen::node_service::node_service_server::NodeServiceServer;
use s3s::{auth::SimpleAuth, service::S3ServiceBuilder};
use s3s::service::S3ServiceBuilder;
use service::hybrid;
use std::{io::IsTerminal, net::SocketAddr, str::FromStr};
use tokio::net::TcpListener;
@@ -87,6 +89,7 @@ async fn run(opt: config::Opt) -> Result<()> {
debug!("server_address {}", &server_address);
iam::init_global_action_cred(None, None).unwrap();
set_global_rustfs_port(server_port);
//监听地址,端口从参数中获取
@@ -133,7 +136,7 @@ async fn run(opt: config::Opt) -> Result<()> {
}
//显示info信息
info!("authentication is enabled {}, {}", &access_key, &secret_key);
b.set_auth(SimpleAuth::from_single(access_key, secret_key));
b.set_auth(IAMAuth::new(access_key, secret_key));
b.set_access(store.clone());
@@ -212,6 +215,8 @@ async fn run(opt: config::Opt) -> Result<()> {
})?;
warn!(" init store success!");
init_iam_sys(store.clone()).await.unwrap();
new_global_notification_sys(endpoint_pools.clone()).await.map_err(|err| {
error!("new_global_notification_sys faild {:?}", &err);
Error::from_string(err.to_string())
@@ -221,7 +226,6 @@ async fn run(opt: config::Opt) -> Result<()> {
init_data_scanner().await;
// init auto heal
init_auto_heal().await;
init_iam_sys(store.clone()).await.unwrap();
info!("server was started");
scripts/run.sh
+1 -1
View File
@@ -11,7 +11,7 @@ mkdir -p ./target/volume/test{0..4}
if [ -z "$RUST_LOG" ]; then
export RUST_LOG="rustfs=debug,ecstore=debug,s3s=debug,reader=debug,router=debug"
export RUST_LOG="rustfs=debug,ecstore=debug,s3s=debug,iam=debug"
fi
# export RUSTFS_ERASURE_SET_DRIVE_COUNT=5