chore(deps): update flake.lock (#2165)

Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: 马登山 <Cxymds@qq.com>

.config/make/tests.mak

@@ -1,5 +1,7 @@
 ## —— Tests and e2e test ---------------------------------------------------------------------------
 
+TEST_THREADS ?= 1
+
 .PHONY: test
 test: core-deps test-deps ## Run all tests
 	@echo "🧪 Running tests..."
@@ -7,7 +9,7 @@ test: core-deps test-deps ## Run all tests
 		cargo nextest run --all --exclude e2e_test; \
 	else \
 		echo "ℹ️ cargo-nextest not found; falling back to 'cargo test'"; \
-		cargo test --workspace --exclude e2e_test -- --nocapture; \
+		cargo test --workspace --exclude e2e_test -- --nocapture --test-threads="$(TEST_THREADS)"; \
 	fi
 	cargo test --all --doc
 
@@ -17,4 +19,4 @@ e2e-server: ## Run e2e-server tests
 
 .PHONY: probe-e2e
 probe-e2e: ## Probe e2e tests
-	sh $(shell pwd)/scripts/probe.sh
+	sh $(shell pwd)/scripts/probe.sh

.docker/README.md

@@ -1,261 +1,131 @@
-# RustFS Docker Images
+# RustFS Docker Infrastructure
 
-This directory contains Docker configuration files and supporting infrastructure for building and running RustFS container images.
+This directory contains the complete Docker infrastructure for building, deploying, and monitoring RustFS. It provides ready-to-use configurations for development, testing, and production-grade observability.
 
-## 📁 Directory Structure
+## 📂 Directory Structure
 
-```
-rustfs/
-├── Dockerfile           # Production image (Alpine + pre-built binaries)
-├── Dockerfile.source    # Development image (Debian + source build)
-├── docker-buildx.sh     # Multi-architecture build script
-├── Makefile             # Build automation with simplified commands
-└── .docker/             # Supporting infrastructure
-    ├── observability/   # Monitoring and observability configs
-    ├── compose/         # Docker Compose configurations
-    ├── mqtt/            # MQTT broker configs
-    └── openobserve-otel/ # OpenObserve + OpenTelemetry configs
-```
+| Directory | Description | Status |
+| :--- | :--- | :--- |
+| **[`observability/`](observability/README.md)** | **[RECOMMENDED]** Full-stack observability (Prometheus, Grafana, Tempo, Loki). | ✅ Production-Ready |
+| **[`compose/`](compose/README.md)** | Specialized setups (e.g., 4-node distributed cluster testing). | ⚠️ Testing Only |
+| **[`mqtt/`](mqtt/README.md)** | EMQX Broker configuration for MQTT integration testing. | 🧪 Development |
+| **[`openobserve-otel/`](openobserve-otel/README.md)** | Alternative lightweight observability stack using OpenObserve. | 🔄 Alternative |
 
-## 🎯 Image Variants
+---
 
-### Core Images
+## 📄 Root Directory Files
 
-| Image | Base OS | Build Method | Size | Use Case |
-|-------|---------|--------------|------|----------|
-| `production` (default) | Alpine 3.18 | GitHub Releases | Smallest | Production deployment |
-| `source` | Debian Bookworm | Source build | Medium | Custom builds with cross-compilation |
-| `dev` | Debian Bookworm | Development tools | Large | Interactive development |
+The following files in the project root are essential for Docker operations:
 
-## 🚀 Usage Examples
+### Build Scripts & Dockerfiles
 
-### Quick Start (Production)
+| File | Description | Usage |
+| :--- | :--- | :--- |
+| **`docker-buildx.sh`** | **Multi-Arch Build Script**<br>Automates building and pushing Docker images for `amd64` and `arm64`. Supports release and dev channels. | `./docker-buildx.sh --push` |
+| **`Dockerfile`** | **Production Image (Alpine)**<br>Lightweight image using musl libc. Downloads pre-built binaries from GitHub Releases. | `docker build -t rustfs:latest .` |
+| **`Dockerfile.glibc`** | **Production Image (Ubuntu)**<br>Standard image using glibc. Useful if you need specific dynamic libraries. | `docker build -f Dockerfile.glibc .` |
+| **`Dockerfile.source`** | **Development Image**<br>Builds RustFS from source code. Includes build tools. Ideal for local development and CI. | `docker build -f Dockerfile.source .` |
 
+### Docker Compose Configurations
+
+| File | Description | Usage |
+| :--- | :--- | :--- |
+| **`docker-compose.yml`** | **Main Development Setup**<br>Comprehensive setup with profiles for development, observability, and proxying. | `docker compose up -d`<br>`docker compose --profile observability up -d` |
+| **`docker-compose-simple.yml`** | **Quick Start Setup**<br>Minimal configuration running a single RustFS instance with 4 volumes. Perfect for first-time users. | `docker compose -f docker-compose-simple.yml up -d` |
+
+---
+
+## 🌟 Observability Stack (Recommended)
+
+Located in: [`.docker/observability/`](observability/README.md)
+
+We provide a comprehensive, industry-standard observability stack designed for deep insights into RustFS performance. This is the recommended setup for both development and production monitoring.
+
+### Components
+- **Metrics**: Prometheus (Collection) + Grafana (Visualization)
+- **Traces**: Tempo (Storage) + Jaeger (UI)
+- **Logs**: Loki
+- **Ingestion**: OpenTelemetry Collector
+
+### Key Features
+- **Full Persistence**: All metrics, logs, and traces are saved to Docker volumes, ensuring no data loss on restarts.
+- **Correlation**: Seamlessly jump between Logs, Traces, and Metrics in Grafana.
+- **High Performance**: Optimized configurations for batching, compression, and memory management.
+
+### Quick Start
 ```bash
-# Default production image (Alpine + GitHub Releases)
-docker run -p 9000:9000 rustfs/rustfs:latest
-
-# Specific version
-docker run -p 9000:9000 rustfs/rustfs:1.2.3
+cd .docker/observability
+docker compose up -d
 ```
 
-### Complete Tag Strategy Examples
+---
 
+## 🧪 Specialized Environments
+
+Located in: [`.docker/compose/`](compose/README.md)
+
+These configurations are tailored for specific testing scenarios that require complex topologies.
+
+### Distributed Cluster (4-Nodes)
+Simulates a real-world distributed environment with 4 RustFS nodes running locally.
 ```bash
-# Stable Releases
-docker run rustfs/rustfs:1.2.3           # Main version (production)
-docker run rustfs/rustfs:1.2.3-production # Explicit production variant
-docker run rustfs/rustfs:1.2.3-source   # Source build variant
-docker run rustfs/rustfs:latest          # Latest stable
-
-# Prerelease Versions
-docker run rustfs/rustfs:1.3.0-alpha.2  # Specific alpha version
-docker run rustfs/rustfs:alpha           # Latest alpha
-docker run rustfs/rustfs:beta            # Latest beta
-docker run rustfs/rustfs:rc              # Latest release candidate
-
-# Development Versions
-docker run rustfs/rustfs:dev             # Latest main branch development
-docker run rustfs/rustfs:dev-13e4a0b     # Specific commit
-docker run rustfs/rustfs:dev-latest      # Latest development
-docker run rustfs/rustfs:main-latest     # Main branch latest
+docker compose -f .docker/compose/docker-compose.cluster.yaml up -d
 ```
 
-### Development Environment
-
+### Integrated Observability Test
+A self-contained environment running 4 RustFS nodes alongside the full observability stack. Useful for end-to-end testing of telemetry.
 ```bash
-# Quick setup using Makefile (recommended)
-make docker-dev-local     # Build development image locally
-make dev-env-start        # Start development container
-
-# Manual Docker commands
-docker run -it -v $(pwd):/workspace -p 9000:9000 rustfs/rustfs:latest-dev
-
-# Build from source locally
-docker build -f Dockerfile.source -t rustfs:custom .
-
-# Development with hot reload
-docker-compose up rustfs-dev
+docker compose -f .docker/compose/docker-compose.observability.yaml up -d
 ```
 
-## 🏗️ Build Arguments and Scripts
+---
 
-### Using Makefile Commands (Recommended)
+## 📡 MQTT Integration
 
-The easiest way to build images using simplified commands:
+Located in: [`.docker/mqtt/`](mqtt/README.md)
 
+Provides an EMQX broker for testing RustFS MQTT features.
+
+### Quick Start
 ```bash
-# Development images (build from source)
-make docker-dev-local             # Build for local use (single arch)
-make docker-dev                   # Build multi-arch (for CI/CD)
-make docker-dev-push REGISTRY=xxx # Build and push to registry
-
-# Production images (using pre-built binaries)
-make docker-buildx                # Build multi-arch production images
-make docker-buildx-push           # Build and push production images
-make docker-buildx-version VERSION=v1.0.0  # Build specific version
-
-# Development environment
-make dev-env-start                # Start development container
-make dev-env-stop                 # Stop development container
-make dev-env-restart              # Restart development container
-
-# Help
-make help-docker                  # Show all Docker-related commands
+cd .docker/mqtt
+docker compose up -d
 ```
+- **Dashboard**: [http://localhost:18083](http://localhost:18083) (Default: `admin` / `public`)
+- **MQTT Port**: `1883`
 
-### Using docker-buildx.sh (Advanced)
+---
 
-For direct script usage and advanced scenarios:
+## 👁️ Alternative: OpenObserve
 
+Located in: [`.docker/openobserve-otel/`](openobserve-otel/README.md)
+
+For users preferring a lightweight, all-in-one solution, we support OpenObserve. It combines logs, metrics, and traces into a single binary and UI.
+
+### Quick Start
 ```bash
-# Build latest version for all architectures
-./docker-buildx.sh
-
-# Build and push to registry
-./docker-buildx.sh --push
-
-# Build specific version
-./docker-buildx.sh --release v1.2.3
-
-# Build and push specific version
-./docker-buildx.sh --release v1.2.3 --push
+cd .docker/openobserve-otel
+docker compose up -d
 ```
 
-### Manual Docker Builds
+---
 
-All images support dynamic version selection:
+## 🔧 Common Operations
 
+### Cleaning Up
+To stop all containers and remove volumes (**WARNING**: deletes all persisted data):
 ```bash
-# Build production image with latest release
-docker build --build-arg RELEASE="latest" -t rustfs:latest .
-
-# Build from source with specific target
-docker build -f Dockerfile.source \
-  --build-arg TARGETPLATFORM="linux/amd64" \
-  -t rustfs:source .
-
-# Development build
-docker build -f Dockerfile.source -t rustfs:dev .
+docker compose down -v
 ```
 
-## 🔧 Binary Download Sources
-
-### Unified GitHub Releases
-
-The production image downloads from GitHub Releases for reliability and transparency:
-
-- ✅ **production** → GitHub Releases API with automatic latest detection
-- ✅ **Checksum verification** → SHA256SUMS validation when available
-- ✅ **Multi-architecture** → Supports amd64 and arm64
-
-### Source Build
-
-The source variant compiles from source code with advanced features:
-
-- 🔧 **Cross-compilation** → Supports multiple target platforms via `TARGETPLATFORM`
-- ⚡ **Build caching** → sccache for faster compilation
-- 🎯 **Optimized builds** → Release optimizations with LTO and symbol stripping
-
-## 📋 Architecture Support
-
-All variants support multi-architecture builds:
-
-- **linux/amd64** (x86_64)
-- **linux/arm64** (aarch64)
-
-Architecture is automatically detected during build using Docker's `TARGETARCH` build argument.
-
-## 🔐 Security Features
-
-- **Checksum Verification**: Production image verifies SHA256SUMS when available
-- **Non-root User**: All images run as user `rustfs` (UID 1000)
-- **Minimal Runtime**: Production image only includes necessary dependencies
-- **Secure Defaults**: No hardcoded credentials or keys
-
-## 🛠️ Development Workflow
-
-### Quick Start with Makefile (Recommended)
-
+### Viewing Logs
+To follow logs for a specific service:
 ```bash
-# 1. Start development environment
-make dev-env-start
-
-# 2. Your development container is now running with:
-#    - Port 9000 exposed for RustFS
-#    - Port 9010 exposed for admin console
-#    - Current directory mounted as /workspace
-
-# 3. Stop when done
-make dev-env-stop
+docker compose logs -f [service_name]
 ```
 
-### Manual Development Setup
-
+### Checking Status
+To see the status of all running containers:
 ```bash
-# Build development image from source
-make docker-dev-local
-
-# Or use traditional Docker commands
-docker build -f Dockerfile.source -t rustfs:dev .
-
-# Run with development tools
-docker run -it -v $(pwd):/workspace -p 9000:9000 rustfs:dev bash
-
-# Or use docker-compose for complex setups
-docker-compose up rustfs-dev
+docker compose ps
 ```
-
-### Common Development Tasks
-
-```bash
-# Build and test locally
-make build                        # Build binary natively
-make docker-dev-local            # Build development Docker image
-make test                        # Run tests
-make fmt                         # Format code
-make clippy                      # Run linter
-
-# Get help
-make help                        # General help
-make help-docker                 # Docker-specific help
-make help-build                  # Build-specific help
-```
-
-## 🚀 CI/CD Integration
-
-The project uses GitHub Actions for automated multi-architecture Docker builds:
-
-### Automated Builds
-
-- **Tags**: Automatic builds triggered on version tags (e.g., `v1.2.3`)
-- **Main Branch**: Development builds with `dev-latest` and `main-latest` tags
-- **Pull Requests**: Test builds without registry push
-
-### Build Variants
-
-Each build creates three image variants:
-
-- `rustfs/rustfs:v1.2.3` (production - Alpine-based)
-- `rustfs/rustfs:v1.2.3-source` (source build - Debian-based)
-- `rustfs/rustfs:v1.2.3-dev` (development - Debian-based with tools)
-
-### Manual Builds
-
-Trigger custom builds via GitHub Actions:
-
-```bash
-# Use workflow_dispatch to build specific versions
-# Available options: latest, main-latest, dev-latest, v1.2.3, dev-abc123
-```
-
-## 📦 Supporting Infrastructure
-
-The `.docker/` directory contains supporting configuration files:
-
-- **observability/** - Prometheus, Grafana, OpenTelemetry configs
-- **compose/** - Multi-service Docker Compose setups
-- **mqtt/** - MQTT broker configurations
-- **openobserve-otel/** - Log aggregation and tracing setup
-
-See individual README files in each subdirectory for specific usage instructions.

.docker/compose/README.md

@@ -1,80 +1,44 @@
-# Docker Compose Configurations
+# Specialized Docker Compose Configurations
 
-This directory contains specialized Docker Compose configurations for different use cases.
+This directory contains specialized Docker Compose configurations for specific testing scenarios.
+
+## ⚠️ Important Note
+
+**For Observability:**
+We **strongly recommend** using the new, fully integrated observability stack located in `../observability/`. It provides a production-ready setup with Prometheus, Grafana, Tempo, Loki, and OpenTelemetry Collector, all with persistent storage and optimized configurations.
+
+The `docker-compose.observability.yaml` in this directory is kept for legacy reference or specific minimal testing needs but is **not** the primary recommended setup.
 
 ## 📁 Configuration Files
 
-This directory contains specialized Docker Compose configurations and their associated Dockerfiles, keeping related files organized together.
+### Cluster Testing
 
-### Main Configuration (Root Directory)
+- **`docker-compose.cluster.yaml`**
+  - **Purpose**: Simulates a 4-node RustFS distributed cluster.
+  - **Use Case**: Testing distributed storage logic, consensus, and failover.
+  - **Nodes**: 4 RustFS instances.
+  - **Storage**: Uses local HTTP endpoints.
 
-- **`../../docker-compose.yml`** - **Default Production Setup**
-  - Complete production-ready configuration
-  - Includes RustFS server + full observability stack
-  - Supports multiple profiles: `dev`, `observability`, `cache`, `proxy`
-  - Recommended for most users
+### Legacy / Minimal Observability
 
-### Specialized Configurations
-
-- **`docker-compose.cluster.yaml`** - **Distributed Testing**
-  - 4-node cluster setup for testing distributed storage
-  - Uses local compiled binaries
-  - Simulates multi-node environment
-  - Ideal for development and cluster testing
-
-- **`docker-compose.observability.yaml`** - **Observability Focus**
-  - Specialized setup for testing observability features
-  - Includes OpenTelemetry, Jaeger, Prometheus, Loki, Grafana
-  - Uses `../../Dockerfile.source` for builds
-  - Perfect for observability development
+- **`docker-compose.observability.yaml`**
+  - **Purpose**: A minimal observability setup.
+  - **Status**: **Deprecated**. Please use `../observability/docker-compose.yml` instead.
 
 ## 🚀 Usage Examples
 
-### Production Setup
-
-```bash
-# Start main service
-docker-compose up -d
-
-# Start with development profile
-docker-compose --profile dev up -d
-
-# Start with full observability
-docker-compose --profile observability up -d
-```
-
 ### Cluster Testing
 
-```bash
-# Build and start 4-node cluster (run from project root)
-cd .docker/compose
-docker-compose -f docker-compose.cluster.yaml up -d
-
-# Or run directly from project root
-docker-compose -f .docker/compose/docker-compose.cluster.yaml up -d
-```
-
-### Observability Testing
+To start a 4-node cluster for distributed testing:
 
 ```bash
-# Start observability-focused environment (run from project root)
-cd .docker/compose
-docker-compose -f docker-compose.observability.yaml up -d
-
-# Or run directly from project root
-docker-compose -f .docker/compose/docker-compose.observability.yaml up -d
+# From project root
+docker compose -f .docker/compose/docker-compose.cluster.yaml up -d
 ```
 
-## 🔧 Configuration Overview
+### (Deprecated) Minimal Observability
 
-| Configuration | Nodes | Storage | Observability | Use Case |
-|---------------|-------|---------|---------------|----------|
-| **Main** | 1 | Volume mounts | Full stack | Production |
-| **Cluster** | 4 | HTTP endpoints | Basic | Testing |
-| **Observability** | 4 | Local data | Advanced | Development |
-
-## 📝 Notes
-
-- Always ensure you have built the required binaries before starting cluster tests
-- The main configuration is sufficient for most use cases
-- Specialized configurations are for specific testing scenarios
+```bash
+# From project root
+docker compose -f .docker/compose/docker-compose.observability.yaml up -d
+```

.docker/compose/docker-compose.observability.yaml

@@ -13,62 +13,126 @@
 # limitations under the License.
 
 services:
+  # --- Observability Stack ---
+
+  tempo-init:
+    image: busybox:latest
+    command: [ "sh", "-c", "chown -R 10001:10001 /var/tempo" ]
+    volumes:
+      - tempo-data:/var/tempo
+    user: root
+    networks:
+      - rustfs-network
+    restart: "no"
+
+  tempo:
+    image: grafana/tempo:latest
+    user: "10001"
+    command: [ "-config.file=/etc/tempo.yaml" ]
+    volumes:
+      - ../../.docker/observability/tempo.yaml:/etc/tempo.yaml:ro
+      - tempo-data:/var/tempo
+    ports:
+      - "3200:3200" # tempo
+      - "4317"      # otlp grpc
+      - "4318"      # otlp http
+    restart: unless-stopped
+    networks:
+      - rustfs-network
+
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.129.1
+    image: otel/opentelemetry-collector-contrib:latest
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ../../.docker/observability/otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml
+      - ../../.docker/observability/otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
     ports:
-      - 1888:1888
-      - 8888:8888
-      - 8889:8889
-      - 13133:13133
-      - 4317:4317
-      - 4318:4318
-      - 55679:55679
+      - "1888:1888"   # pprof
+      - "8888:8888"   # Prometheus metrics for Collector
+      - "8889:8889"   # Prometheus metrics for application indicators
+      - "13133:13133" # health check
+      - "4317:4317"   # OTLP gRPC
+      - "4318:4318"   # OTLP HTTP
+      - "55679:55679" # zpages
     networks:
       - rustfs-network
+    depends_on:
+      - tempo
+      - jaeger
+      - prometheus
+      - loki
+
   jaeger:
-    image: jaegertracing/jaeger:2.8.0
+    image: jaegertracing/jaeger:latest
     environment:
       - TZ=Asia/Shanghai
+      - SPAN_STORAGE_TYPE=badger
+      - BADGER_EPHEMERAL=false
+      - BADGER_DIRECTORY_VALUE=/badger/data
+      - BADGER_DIRECTORY_KEY=/badger/key
+      - COLLECTOR_OTLP_ENABLED=true
+    volumes:
+      - jaeger-data:/badger
     ports:
-      - "16686:16686"
-      - "14317:4317"
-      - "14318:4318"
+      - "16686:16686" # Web UI
+      - "14269:14269" # Admin/Metrics
     networks:
       - rustfs-network
+
   prometheus:
-    image: prom/prometheus:v3.4.2
+    image: prom/prometheus:latest
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ../../.docker/observability/prometheus.yml:/etc/prometheus/prometheus.yml
+      - ../../.docker/observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
     ports:
       - "9090:9090"
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--web.enable-otlp-receiver'
+      - '--web.enable-remote-write-receiver'
+      - '--enable-feature=promql-experimental-functions'
+      - '--storage.tsdb.path=/prometheus'
+      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
+      - '--web.console.templates=/usr/share/prometheus/consoles'
     networks:
       - rustfs-network
+
   loki:
-    image: grafana/loki:3.5.1
+    image: grafana/loki:latest
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ../../.docker/observability/loki-config.yaml:/etc/loki/local-config.yaml
+      - ../../.docker/observability/loki.yaml:/etc/loki/local-config.yaml:ro
+      - loki-data:/loki
     ports:
       - "3100:3100"
     command: -config.file=/etc/loki/local-config.yaml
     networks:
       - rustfs-network
+
   grafana:
-    image: grafana/grafana:12.0.2
+    image: grafana/grafana:latest
     ports:
       - "3000:3000" # Web UI
     environment:
       - GF_SECURITY_ADMIN_PASSWORD=admin
+      - GF_SECURITY_ADMIN_USER=admin
       - TZ=Asia/Shanghai
+      - GF_INSTALL_PLUGINS=grafana-pyroscope-datasource
+      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/var/lib/grafana/dashboards/home.json
     networks:
       - rustfs-network
+    volumes:
+      - ../../.docker/observability/grafana/provisioning:/etc/grafana/provisioning:ro
+      - ../../.docker/observability/grafana/dashboards:/var/lib/grafana/dashboards:ro
+    depends_on:
+      - prometheus
+      - tempo
+      - loki
+
+  # --- RustFS Cluster ---
 
   node1:
     build:
@@ -79,13 +143,15 @@ services:
       - RUSTFS_VOLUMES=http://node{1...4}:9000/root/data/target/volume/test{1...4}
       - RUSTFS_ADDRESS=:9000
       - RUSTFS_CONSOLE_ENABLE=true
-      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4317
+      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
       - RUSTFS_OBS_LOGGER_LEVEL=debug
     platform: linux/amd64
     ports:
-      - "9001:9000" # Map port 9001 of the host to port 9000 of the container
+      - "9001:9000"
     networks:
       - rustfs-network
+    depends_on:
+      - otel-collector
 
   node2:
     build:
@@ -96,13 +162,15 @@ services:
       - RUSTFS_VOLUMES=http://node{1...4}:9000/root/data/target/volume/test{1...4}
       - RUSTFS_ADDRESS=:9000
       - RUSTFS_CONSOLE_ENABLE=true
-      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4317
+      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
       - RUSTFS_OBS_LOGGER_LEVEL=debug
     platform: linux/amd64
     ports:
-      - "9002:9000" # Map port 9002 of the host to port 9000 of the container
+      - "9002:9000"
     networks:
       - rustfs-network
+    depends_on:
+      - otel-collector
 
   node3:
     build:
@@ -113,13 +181,15 @@ services:
       - RUSTFS_VOLUMES=http://node{1...4}:9000/root/data/target/volume/test{1...4}
       - RUSTFS_ADDRESS=:9000
       - RUSTFS_CONSOLE_ENABLE=true
-      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4317
+      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
       - RUSTFS_OBS_LOGGER_LEVEL=debug
     platform: linux/amd64
     ports:
-      - "9003:9000" # Map port 9003 of the host to port 9000 of the container
+      - "9003:9000"
     networks:
       - rustfs-network
+    depends_on:
+      - otel-collector
 
   node4:
     build:
@@ -130,13 +200,21 @@ services:
       - RUSTFS_VOLUMES=http://node{1...4}:9000/root/data/target/volume/test{1...4}
       - RUSTFS_ADDRESS=:9000
       - RUSTFS_CONSOLE_ENABLE=true
-      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4317
+      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
       - RUSTFS_OBS_LOGGER_LEVEL=debug
     platform: linux/amd64
     ports:
-      - "9004:9000" # Map port 9004 of the host to port 9000 of the container
+      - "9004:9000"
     networks:
       - rustfs-network
+    depends_on:
+      - otel-collector
+
+volumes:
+  prometheus-data:
+  tempo-data:
+  loki-data:
+  jaeger-data:
 
 networks:
   rustfs-network:

.docker/mqtt/README.md

@@ -0,0 +1,30 @@
+# MQTT Broker (EMQX)
+
+This directory contains the configuration for running an EMQX MQTT broker, which can be used for testing RustFS's MQTT integration.
+
+## 🚀 Quick Start
+
+To start the EMQX broker:
+
+```bash
+docker compose up -d
+```
+
+## 📊 Access
+
+- **Dashboard**: [http://localhost:18083](http://localhost:18083)
+- **Default Credentials**: `admin` / `public`
+- **MQTT Port**: `1883`
+- **WebSocket Port**: `8083`
+
+## 🛠️ Configuration
+
+The `docker-compose.yml` file sets up a single-node EMQX instance.
+
+- **Persistence**: Data is not persisted by default (for testing).
+- **Network**: Uses the default bridge network.
+
+## 📝 Notes
+
+- This setup is intended for development and testing purposes.
+- For production deployments, please refer to the official [EMQX Documentation](https://www.emqx.io/docs/en/latest/).

.docker/nginx/nginx.conf

@@ -0,0 +1,82 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+worker_processes auto;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+    error_log /var/log/nginx/error.log warn;
+
+    sendfile on;
+    keepalive_timeout 65;
+
+    # RustFS Server Block
+    server {
+        listen 80;
+        server_name localhost;
+
+        # Redirect HTTP to HTTPS (optional, uncomment if SSL is configured)
+        # return 301 https://$host$request_uri;
+
+        location / {
+            proxy_pass http://rustfs:9000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # S3 specific headers
+            proxy_set_header X-Amz-Date $http_x_amz_date;
+            proxy_set_header Authorization $http_authorization;
+
+            # Disable buffering for large uploads
+            proxy_request_buffering off;
+            client_max_body_size 0;
+        }
+
+        location /rustfs/console {
+            proxy_pass http://rustfs:9001;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # SSL Configuration (Example)
+    # server {
+    #     listen 443 ssl;
+    #     server_name localhost;
+    #
+    #     ssl_certificate /etc/nginx/ssl/server.crt;
+    #     ssl_certificate_key /etc/nginx/ssl/server.key;
+    #
+    #     location / {
+    #         proxy_pass http://rustfs:9000;
+    #         ...
+    #     }
+    # }
+}

.docker/observability/.gitignore

@@ -0,0 +1,5 @@
+jaeger-data/*
+loki-data/*
+prometheus-data/*
+tempo-data/*
+grafana-data/*

.docker/observability/README.md

@@ -1,109 +1,85 @@
-# Observability
+# RustFS Observability Stack
 
-This directory contains the observability stack for the application. The stack is composed of the following components:
+This directory contains the comprehensive observability stack for RustFS, designed to provide deep insights into application performance, logs, and traces.
 
-- Prometheus v3.2.1
-- Grafana 11.6.0
-- Loki 3.4.2
-- Jaeger 2.4.0
-- Otel Collector 0.120.0 # 0.121.0 remove loki
+## Components
 
-## Prometheus
+The stack is composed of the following best-in-class open-source components:
 
-Prometheus is a monitoring and alerting toolkit. It scrapes metrics from instrumented jobs, either directly or via an
-intermediary push gateway for short-lived jobs. It stores all scraped samples locally and runs rules over this data to
-either aggregate and record new time series from existing data or generate alerts. Grafana or other API consumers can be
-used to visualize the collected data.
+- **Prometheus** (v2.53.1): The industry standard for metric collection and alerting.
+- **Grafana** (v11.1.0): The leading platform for observability visualization.
+- **Loki** (v3.1.0): A horizontally-scalable, highly-available, multi-tenant log aggregation system.
+- **Tempo** (v2.5.0): A high-volume, minimal dependency distributed tracing backend.
+- **Jaeger** (v1.59.0): Distributed tracing system (configured as a secondary UI/storage).
+- **OpenTelemetry Collector** (v0.104.0): A vendor-agnostic implementation for receiving, processing, and exporting telemetry data.
 
-## Grafana
+## Architecture
 
-Grafana is a multi-platform open-source analytics and interactive visualization web application. It provides charts,
-graphs, and alerts for the web when connected to supported data sources.
+1. **Telemetry Collection**: Applications send OTLP (OpenTelemetry Protocol) data (Metrics, Logs, Traces) to the **OpenTelemetry Collector**.
+2. **Processing & Exporting**: The Collector processes the data (batching, memory limiting) and exports it to the respective backends:
+    - **Traces** -> **Tempo** (Primary) & **Jaeger** (Secondary/Optional)
+    - **Metrics** -> **Prometheus** (via scraping the Collector's exporter)
+    - **Logs** -> **Loki**
+3. **Visualization**: **Grafana** connects to all backends (Prometheus, Tempo, Loki, Jaeger) to provide a unified dashboard experience.
 
-## Loki
+## Features
 
-Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is
-designed to be very cost-effective and easy to operate. It does not index the contents of the logs, but rather a set of
-labels for each log stream.
+- **Full Persistence**: All data (Metrics, Logs, Traces) is persisted to Docker volumes, ensuring no data loss on restart.
+- **Correlation**: Seamless navigation between Metrics, Logs, and Traces in Grafana.
+  - Jump from a Metric spike to relevant Traces.
+  - Jump from a Trace to relevant Logs.
+- **High Performance**: Optimized configurations for batching, compression, and memory management.
+- **Standardized Protocols**: Built entirely on OpenTelemetry standards.
 
-## Jaeger
+## Quick Start
 
-Jaeger is a distributed tracing system released as open source by Uber Technologies. It is used for monitoring and
-troubleshooting microservices-based distributed systems, including:
+### Prerequisites
 
-- Distributed context propagation
-- Distributed transaction monitoring
-- Root cause analysis
-- Service dependency analysis
-- Performance / latency optimization
+- Docker
+- Docker Compose
 
-## Otel Collector
+### Deploy
 
-The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process, and export telemetry
-data. It removes the need to run, operate, and maintain multiple agents/collectors in order to support open-source
-observability data formats (e.g. Jaeger, Prometheus, etc.) sending to one or more open-source or commercial back-ends.
-
-## How to use
-
-To deploy the observability stack, run the following command:
-
-- docker latest version
+Run the following command to start the entire stack:
 
 ```bash
-docker compose -f docker-compose.yml -f docker-compose.override.yml up -d
+docker compose up -d
 ```
 
-- docker compose v2.0.0 or before
+### Access Dashboards
+
+| Service        | URL                                              | Credentials       | Description                    |
+| :------------- | :----------------------------------------------- | :---------------- | :----------------------------- |
+| **Grafana**    | [http://localhost:3000](http://localhost:3000)   | `admin` / `admin` | Main visualization hub.        |
+| **Prometheus** | [http://localhost:9090](http://localhost:9090)   | -                 | Metric queries and status.     |
+| **Jaeger UI**  | [http://localhost:16686](http://localhost:16686) | -                 | Secondary trace visualization. |
+| **Tempo**      | [http://localhost:3200](http://localhost:3200)   | -                 | Tempo status/metrics.          |
+
+## Configuration
+
+### Data Persistence
+
+Data is stored in the following Docker volumes:
+
+- `prometheus-data`: Prometheus metrics
+- `tempo-data`: Tempo traces (WAL and Blocks)
+- `loki-data`: Loki logs (Chunks and Rules)
+- `jaeger-data`: Jaeger traces (Badger DB)
+
+To clear all data:
 
 ```bash
-docke-compose -f docker-compose.yml -f docker-compose.override.yml up -d
+docker compose down -v
 ```
 
-To access the Grafana dashboard, navigate to `http://localhost:3000` in your browser. The default username and password
-are `admin` and `admin`, respectively.
-
-To access the Jaeger dashboard, navigate to `http://localhost:16686` in your browser.
-
-To access the Prometheus dashboard, navigate to `http://localhost:9090` in your browser.
-
-## How to stop
-
-To stop the observability stack, run the following command:
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.override.yml down
-```
-
-## How to remove data
-
-To remove the data generated by the observability stack, run the following command:
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.override.yml down -v
-```
-
-## How to configure
-
-To configure the observability stack, modify the `docker-compose.override.yml` file. The file contains the following
-
-```yaml
-services:
-  prometheus:
-    environment:
-      - PROMETHEUS_CONFIG_FILE=/etc/prometheus/prometheus.yml
-    volumes:
-      - ./prometheus.yml:/etc/prometheus/prometheus.yml
-
-  grafana:
-    environment:
-      - GF_SECURITY_ADMIN_PASSWORD=admin
-    volumes:
-      - ./grafana/provisioning:/etc/grafana/provisioning
-```
-
-The `prometheus` service mounts the `prometheus.yml` file to `/etc/prometheus/prometheus.yml`. The `grafana` service
-mounts the `grafana/provisioning` directory to `/etc/grafana/provisioning`. You can modify these files to configure the
-observability stack.
+### Customization
 
+- **Prometheus**: Edit `prometheus.yml` to add scrape targets or alerting rules.
+- **Grafana**: Dashboards and datasources are provisioned from the `grafana/` directory.
+- **Collector**: Edit `otel-collector-config.yaml` to modify pipelines, processors, or exporters.
 
+## Troubleshooting
 
+- **Service Health**: Check the health of services using `docker compose ps`.
+- **Logs**: View logs for a specific service using `docker compose logs -f <service_name>`.
+- **Otel Collector**: Check `http://localhost:13133` for health status and `http://localhost:1888/debug/pprof/` for profiling.

.docker/observability/README_ZH.md

@@ -1,27 +1,85 @@
-## 部署可观测性系统
+# RustFS 可观测性技术栈
 
-OpenTelemetry Collector 提供了一个厂商中立的遥测数据处理方案，用于接收、处理和导出遥测数据。它消除了为支持多种开源可观测性数据格式（如
-Jaeger、Prometheus 等）而需要运行和维护多个代理/收集器的必要性。
+本目录包含 RustFS 的全面可观测性技术栈，旨在提供对应用程序性能、日志和追踪的深入洞察。
 
-### 快速部署
+## 组件
 
-1. 进入 `.docker/observability` 目录
-2. 执行以下命令启动服务：
+该技术栈由以下一流的开源组件组成：
+
+- **Prometheus** (v2.53.1): 行业标准的指标收集和告警工具。
+- **Grafana** (v11.1.0): 领先的可观测性可视化平台。
+- **Loki** (v3.1.0): 水平可扩展、高可用、多租户的日志聚合系统。
+- **Tempo** (v2.5.0): 高吞吐量、最小依赖的分布式追踪后端。
+- **Jaeger** (v1.59.0): 分布式追踪系统（配置为辅助 UI/存储）。
+- **OpenTelemetry Collector** (v0.104.0): 接收、处理和导出遥测数据的供应商无关实现。
+
+## 架构
+
+1.  **遥测收集**: 应用程序将 OTLP (OpenTelemetry Protocol) 数据（指标、日志、追踪）发送到 **OpenTelemetry Collector**。
+2.  **处理与导出**: Collector 处理数据（批处理、内存限制）并将其导出到相应的后端：
+    -   **追踪** -> **Tempo** (主要) & **Jaeger** (辅助/可选)
+    -   **指标** -> **Prometheus** (通过抓取 Collector 的导出器)
+    -   **日志** -> **Loki**
+3.  **可视化**: **Grafana** 连接到所有后端（Prometheus, Tempo, Loki, Jaeger），提供统一的仪表盘体验。
+
+## 特性
+
+-   **完全持久化**: 所有数据（指标、日志、追踪）都持久化到 Docker 卷，确保重启后无数据丢失。
+-   **关联性**: 在 Grafana 中实现指标、日志和追踪之间的无缝导航。
+    -   从指标峰值跳转到相关追踪。
+    -   从追踪跳转到相关日志。
+-   **高性能**: 针对批处理、压缩和内存管理进行了优化配置。
+-   **标准化协议**: 完全基于 OpenTelemetry 标准构建。
+
+## 快速开始
+
+### 前置条件
+
+-   Docker
+-   Docker Compose
+
+### 部署
+
+运行以下命令启动整个技术栈：
 
 ```bash
-docker compose -f docker-compose.yml  up -d
+docker compose up -d
 ```
 
-### 访问监控面板
+### 访问仪表盘
 
-服务启动后，可通过以下地址访问各个监控面板：
+| 服务 | URL | 凭据 | 描述 |
+| :--- | :--- | :--- | :--- |
+| **Grafana** | [http://localhost:3000](http://localhost:3000) | `admin` / `admin` | 主要可视化中心。 |
+| **Prometheus** | [http://localhost:9090](http://localhost:9090) | - | 指标查询和状态。 |
+| **Jaeger UI** | [http://localhost:16686](http://localhost:16686) | - | 辅助追踪可视化。 |
+| **Tempo** | [http://localhost:3200](http://localhost:3200) | - | Tempo 状态/指标。 |
 
-- Grafana: `http://localhost:3000` (默认账号/密码：`admin`/`admin`)
-- Jaeger: `http://localhost:16686`
-- Prometheus: `http://localhost:9090`
+## 配置
 
-## 配置可观测性
+### 数据持久化
 
-```shell
-export RUSTFS_OBS_ENDPOINT="http://localhost:4317" # OpenTelemetry Collector 地址
+数据存储在以下 Docker 卷中：
+
+-   `prometheus-data`: Prometheus 指标
+-   `tempo-data`: Tempo 追踪 (WAL 和 Blocks)
+-   `loki-data`: Loki 日志 (Chunks 和 Rules)
+-   `jaeger-data`: Jaeger 追踪 (Badger DB)
+
+要清除所有数据：
+
+```bash
+docker compose down -v
 ```
+
+### 自定义
+
+-   **Prometheus**: 编辑 `prometheus.yml` 以添加抓取目标或告警规则。
+-   **Grafana**: 仪表盘和数据源从 `grafana/` 目录预置。
+-   **Collector**: 编辑 `otel-collector-config.yaml` 以修改管道、处理器或导出器。
+
+## 故障排除
+
+-   **服务健康**: 使用 `docker compose ps` 检查服务健康状况。
+-   **日志**: 使用 `docker compose logs -f <service_name>` 查看特定服务的日志。
+-   **Otel Collector**: 检查 `http://localhost:13133` 获取健康状态，检查 `http://localhost:1888/debug/pprof/` 进行性能分析。

.docker/observability/docker-compose-example-for-rustfs.yml

@@ -0,0 +1,270 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+  rustfs:
+    security_opt:
+      - "no-new-privileges:true"
+    image: rustfs/rustfs:latest
+    container_name: rustfs-server
+    ports:
+      - "9000:9000" # S3 API port
+      - "9001:9001" # Console port
+    environment:
+      - RUSTFS_VOLUMES=/data/rustfs
+      - RUSTFS_ADDRESS=0.0.0.0:9000
+      - RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001
+      - RUSTFS_CONSOLE_ENABLE=true
+      - RUSTFS_CORS_ALLOWED_ORIGINS=*
+      - RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS=*
+      - RUSTFS_ACCESS_KEY=rustfsadmin
+      - RUSTFS_SECRET_KEY=rustfsadmin
+      - RUSTFS_OBS_LOGGER_LEVEL=info
+      - RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
+      - RUSTFS_OBS_PROFILING_ENDPOINT=http://pyroscope:4040
+    volumes:
+      - rustfs-data:/data/rustfs
+    networks:
+      - otel-network
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "sh",
+          "-c",
+          "curl -f http://127.0.0.1:9000/health && curl -f http://127.0.0.1:9001/rustfs/console/health",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    depends_on:
+      otel-collector:
+        condition: service_started
+
+  rustfs-init:
+    image: alpine
+    container_name: rustfs-init
+    volumes:
+      - rustfs-data:/data
+    networks:
+      - otel-network
+    command: >
+      sh -c "
+        chown -R 10001:10001 /data &&
+        echo 'Volume Permissions fixed' &&
+        exit 0
+      "
+    restart: no
+
+  # --- Tracing ---
+
+  tempo:
+    image: grafana/tempo:latest
+    container_name: tempo
+    command: [ "-config.file=/etc/tempo.yaml" ]
+    volumes:
+      - ./tempo.yaml:/etc/tempo.yaml:ro
+      - tempo-data:/var/tempo
+    ports:
+      - "3200:3200" # tempo
+      - "4317" # otlp grpc
+      - "4318" # otlp http
+    networks:
+      - otel-network
+    restart: unless-stopped
+    depends_on:
+      - redpanda
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3200/ready" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
+  redpanda:
+    image: redpandadata/redpanda:latest # for tempo ingest
+    container_name: redpanda
+    ports:
+      - "9092:9092"
+    networks:
+      - otel-network
+    restart: unless-stopped
+    command: >
+      redpanda start --overprovisioned
+      --mode=dev-container
+      --kafka-addr=PLAINTEXT://0.0.0.0:9092
+      --advertise-kafka-addr=PLAINTEXT://redpanda:9092
+
+  jaeger:
+    image: jaegertracing/jaeger:latest
+    container_name: jaeger
+    environment:
+      - SPAN_STORAGE_TYPE=badger
+      - BADGER_EPHEMERAL=false
+      - BADGER_DIRECTORY_VALUE=/badger/data
+      - BADGER_DIRECTORY_KEY=/badger/key
+      - COLLECTOR_OTLP_ENABLED=true
+    volumes:
+      - ./jaeger.yaml:/etc/jaeger/config.yml
+      - jaeger-data:/badger
+    ports:
+      - "16686:16686" # Web UI
+      - "14269:14269" # Admin/Metrics
+      - "4317" # otlp grpc
+      - "4318" # otlp http
+    command: [ "--config", "/etc/jaeger/config.yml" ]
+    networks:
+      - otel-network
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:14269" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
+  # --- Metrics ---
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    ports:
+      - "9090:9090"
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yml"
+      - "--web.enable-otlp-receiver" # Enable OTLP
+      - "--web.enable-remote-write-receiver" # Enable remote write
+      - "--enable-feature=promql-experimental-functions" # Enable info()
+      - "--storage.tsdb.retention.time=30d"
+    restart: unless-stopped
+    networks:
+      - otel-network
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  # --- Logging ---
+
+  loki:
+    image: grafana/loki:latest
+    container_name: loki
+    volumes:
+      - ./loki.yaml:/etc/loki/loki.yaml:ro
+      - loki-data:/loki
+    ports:
+      - "3100:3100"
+    command: -config.file=/etc/loki/loki.yaml
+    networks:
+      - otel-network
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3100/ready" ]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+  # --- Collection ---
+
+  otel-collector:
+    image: otel/opentelemetry-collector-contrib:latest
+    volumes:
+      - ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
+    ports:
+      - "1888:1888" # pprof
+      - "8888:8888" # Prometheus metrics for Collector
+      - "8889:8889" # Prometheus metrics for application indicators
+      - "13133:13133" # health check
+      - "4317:4317" # OTLP gRPC
+      - "4318:4318" # OTLP HTTP
+      - "55679:55679" # zpages
+    networks:
+      - otel-network
+    restart: unless-stopped
+    depends_on:
+      - tempo
+      - jaeger
+      - prometheus
+      - loki
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:13133" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  # --- Profiles ---
+
+  pyroscope:
+    image: grafana/pyroscope:latest
+    container_name: pyroscope
+    ports:
+      - "4040:4040"
+    command:
+      - -self-profiling.disable-push=true
+    networks:
+      - otel-network
+    restart: unless-stopped
+
+  # --- Visualization ---
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    ports:
+      - "3000:3000"
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=admin
+      - GF_SECURITY_ADMIN_USER=admin
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./grafana/dashboards:/etc/grafana/dashboards:ro
+      - grafana-data:/var/lib/grafana
+    networks:
+      - otel-network
+    restart: unless-stopped
+    depends_on:
+      - prometheus
+      - tempo
+      - loki
+    healthcheck:
+      test:
+        [ "CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  rustfs-data:
+  tempo-data:
+  jaeger-data:
+  prometheus-data:
+  loki-data:
+  grafana-data:
+
+networks:
+  otel-network:
+    driver: bridge
+    name: "network_otel"
+    ipam:
+      config:
+        - subnet: 172.28.0.0/16
+    driver_opts:
+      com.docker.network.enable_ipv6: "true"

.docker/observability/docker-compose-tempo-ha-override.yml

@@ -0,0 +1,62 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Docker Compose override file for High Availability Tempo setup
+#
+# Usage:
+# docker-compose -f docker-compose-example-for-rustfs.yml \
+#                -f docker-compose-tempo-ha-override.yml up
+
+services:
+  # Override Tempo to use high-availability configuration
+  tempo:
+    volumes:
+      - ./tempo-ha.yaml:/etc/tempo.yaml:ro
+      - tempo-data:/var/tempo
+    ports:
+      - "3200:3200"   # Tempo HTTP
+      - "4317:4317"   # OTLP gRPC
+      - "4318:4318"   # OTLP HTTP
+      - "7946:7946"   # Memberlist
+      - "14250:14250" # Jaeger gRPC
+      - "14268:14268" # Jaeger Thrift HTTP
+      - "9411:9411"   # Zipkin
+    environment:
+      - TEMPO_MEMBERLIST_BIND_PORT=7946
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3200/ready" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    depends_on:
+      - redpanda
+
+volumes:
+  tempo-data:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: "size=4g"  # Allocate 4GB tmpfs for Tempo data (adjust based on your needs)
+
+# Network configuration remains the same
+# networks:
+#   otel-network:
+#     driver: bridge
+#     name: "network_otel"
+#     ipam:
+#       config:
+#         - subnet: 172.28.0.0/16
+

.docker/observability/docker-compose.yml

@@ -14,41 +14,108 @@
 
 services:
 
-  tempo-init:
-    image: busybox:latest
-    command: [ "sh", "-c", "chown -R 10001:10001 /var/tempo" ]
-    volumes:
-      - ./tempo-data:/var/tempo
-    user: root
-    networks:
-      - otel-network
-    restart: "no"
+  # --- Tracing ---
 
   tempo:
     image: grafana/tempo:latest
-    user: "10001" # The container must be started with root to execute chown in the script
-    command: [ "-config.file=/etc/tempo.yaml" ] # This is passed as a parameter to the entry point script
+    container_name: tempo
+    command: [ "-config.file=/etc/tempo.yaml" ]
     volumes:
       - ./tempo.yaml:/etc/tempo.yaml:ro
-      - ./tempo-data:/var/tempo
+      - tempo-data:/var/tempo
     ports:
       - "3200:3200" # tempo
-      - "24317:4317" # otlp grpc
-      - "24318:4318" # otlp http
-    restart: unless-stopped
+      - "4317" # otlp grpc
+      - "4318" # otlp http
+      - "7946" # memberlist
     networks:
       - otel-network
+    restart: unless-stopped
     healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3200/metrics" ]
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3200/ready" ]
       interval: 10s
       timeout: 5s
       retries: 3
       start_period: 15s
 
+  jaeger:
+    image: jaegertracing/jaeger:latest
+    container_name: jaeger
+    environment:
+      - SPAN_STORAGE_TYPE=badger
+      - BADGER_EPHEMERAL=false
+      - BADGER_DIRECTORY_VALUE=/badger/data
+      - BADGER_DIRECTORY_KEY=/badger/key
+      - COLLECTOR_OTLP_ENABLED=true
+    volumes:
+      - ./jaeger.yaml:/etc/jaeger/config.yml
+      - jaeger-data:/badger
+    ports:
+      - "16686:16686" # Web UI
+      - "14269:14269" # Admin/Metrics
+      - "4317" # otlp grpc
+      - "4318" # otlp http
+    command: [ "--config", "/etc/jaeger/config.yml" ]
+    networks:
+      - otel-network
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:14269" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
+  # --- Metrics ---
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    ports:
+      - "9090:9090"
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yml"
+      - "--web.enable-otlp-receiver" # Enable OTLP
+      - "--web.enable-remote-write-receiver" # Enable remote write
+      - "--enable-feature=promql-experimental-functions" # Enable info()
+      - "--storage.tsdb.retention.time=30d"
+    restart: unless-stopped
+    networks:
+      - otel-network
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  # --- Logging ---
+
+  loki:
+    image: grafana/loki:latest
+    container_name: loki
+    volumes:
+      - ./loki.yaml:/etc/loki/loki.yaml:ro
+      - loki-data:/loki
+    ports:
+      - "3100:3100"
+    command: -config.file=/etc/loki/loki.yaml
+    networks:
+      - otel-network
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3100/ready" ]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+  # --- Collection ---
+
   otel-collector:
     image: otel/opentelemetry-collector-contrib:latest
-    environment:
-      - TZ=Asia/Shanghai
     volumes:
       - ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
     ports:
@@ -61,116 +128,70 @@ services:
       - "55679:55679" # zpages
     networks:
       - otel-network
+    restart: unless-stopped
     depends_on:
-      jaeger:
-        condition: service_started
-      tempo:
-        condition: service_started
-      prometheus:
-        condition: service_started
-      loki:
-        condition: service_started
+      - tempo
+      - jaeger
+      - prometheus
+      - loki
     healthcheck:
       test: [ "CMD", "wget", "--spider", "-q", "http://localhost:13133" ]
       interval: 10s
       timeout: 5s
       retries: 3
 
-  jaeger:
-    image: jaegertracing/jaeger:latest
-    environment:
-      - TZ=Asia/Shanghai
-      - SPAN_STORAGE_TYPE=memory
-      - COLLECTOR_OTLP_ENABLED=true
+  # --- Profiles ---
+
+  pyroscope:
+    image: grafana/pyroscope:latest
+    container_name: pyroscope
     ports:
-      - "16686:16686" # Web UI
-      - "14317:4317" # OTLP gRPC
-      - "14318:4318" # OTLP HTTP
-      - "18888:8888" # collector
-    networks:
-      - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:16686" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-  prometheus:
-    image: prom/prometheus:latest
-    environment:
-      - TZ=Asia/Shanghai
-    volumes:
-      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
-      - ./prometheus-data:/prometheus
-    ports:
-      - "9090:9090"
+      - "4040:4040"
     command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
-      - '--web.enable-otlp-receiver' # Enable OTLP
-      - '--web.enable-remote-write-receiver' # Enable remote write
-      - '--enable-feature=promql-experimental-functions' # Enable info()
-      - '--storage.tsdb.min-block-duration=15m' # Minimum block duration
-      - '--storage.tsdb.max-block-duration=1h'  # Maximum block duration
-      - '--log.level=info'
-      - '--storage.tsdb.retention.time=30d'
-      - '--storage.tsdb.path=/prometheus'
-      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
-      - '--web.console.templates=/usr/share/prometheus/consoles'
+      - -self-profiling.disable-push=true
+    networks:
+      - otel-network
     restart: unless-stopped
-    networks:
-      - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-  loki:
-    image: grafana/loki:latest
-    environment:
-      - TZ=Asia/Shanghai
-    volumes:
-      - ./loki-config.yaml:/etc/loki/local-config.yaml:ro
-    ports:
-      - "3100:3100"
-    command: -config.file=/etc/loki/local-config.yaml
-    networks:
-      - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3100/ready" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
+
+  # --- Visualization ---
+
   grafana:
     image: grafana/grafana:latest
+    container_name: grafana
     ports:
-      - "3000:3000"  # Web UI
-    volumes:
-      - ./grafana-datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml
+      - "3000:3000"
     environment:
       - GF_SECURITY_ADMIN_PASSWORD=admin
       - GF_SECURITY_ADMIN_USER=admin
-      - TZ=Asia/Shanghai
-      - GF_INSTALL_PLUGINS=grafana-pyroscope-datasource
-    restart: unless-stopped
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./grafana/dashboards:/etc/grafana/dashboards:ro
+      - grafana-data:/var/lib/grafana
     networks:
       - otel-network
+    restart: unless-stopped
     depends_on:
       - prometheus
       - tempo
       - loki
     healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health" ]
+      test:
+        [ "CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health" ]
       interval: 10s
       timeout: 5s
       retries: 3
 
 volumes:
-  prometheus-data:
   tempo-data:
+  jaeger-data:
+  prometheus-data:
+  loki-data:
+  grafana-data:
 
 networks:
   otel-network:
     driver: bridge
-    name: "network_otel_config"
+    name: "network_otel"
     ipam:
       config:
         - subnet: 172.28.0.0/16

.docker/observability/grafana-datasources.yaml

@@ -1,108 +0,0 @@
-apiVersion: 1
-
-datasources:
-  - name: Prometheus
-    type: prometheus
-    uid: prometheus
-    access: proxy
-    orgId: 1
-    url: http://prometheus:9090
-    basicAuth: false
-    isDefault: false
-    version: 1
-    editable: false
-    jsonData:
-      httpMethod: GET
-  - name: Tempo
-    type: tempo
-    access: proxy
-    orgId: 1
-    url: http://tempo:3200
-    basicAuth: false
-    isDefault: true
-    version: 1
-    editable: false
-    apiVersion: 1
-    uid: tempo
-    jsonData:
-      httpMethod: GET
-      serviceMap:
-        datasourceUid: prometheus
-      streamingEnabled:
-        search: true
-      tracesToLogsV2:
-        # Field with an internal link pointing to a logs data source in Grafana.
-        # datasourceUid value must match the uid value of the logs data source.
-        datasourceUid: 'loki'
-        spanStartTimeShift: '-1h'
-        spanEndTimeShift: '1h'
-        tags: [ 'job', 'instance', 'pod', 'namespace' ]
-        filterByTraceID: false
-        filterBySpanID: false
-        customQuery: true
-        query: 'method="$${__span.tags.method}"'
-        tracesToMetrics:
-          datasourceUid: 'prometheus'
-          spanStartTimeShift: '-1h'
-          spanEndTimeShift: '1h'
-          tags: [ { key: 'service.name', value: 'service' }, { key: 'job' } ]
-          queries:
-            - name: 'Sample query'
-              query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m]))'
-        tracesToProfiles:
-          datasourceUid: 'grafana-pyroscope-datasource'
-          tags: [ 'job', 'instance', 'pod', 'namespace' ]
-          profileTypeId: 'process_cpu:cpu:nanoseconds:cpu:nanoseconds'
-          customQuery: true
-          query: 'method="$${__span.tags.method}"'
-        serviceMap:
-          datasourceUid: 'prometheus'
-        nodeGraph:
-          enabled: true
-        search:
-          hide: false
-        traceQuery:
-          timeShiftEnabled: true
-          spanStartTimeShift: '-1h'
-          spanEndTimeShift: '1h'
-        spanBar:
-          type: 'Tag'
-          tag: 'http.path'
-        streamingEnabled:
-          search: true
-  - name: Jaeger
-    type: jaeger
-    uid: Jaeger
-    url: http://jaeger:16686
-    basicAuth: false
-    access: proxy
-    readOnly: false
-    isDefault: false
-    jsonData:
-      tracesToLogsV2:
-        # Field with an internal link pointing to a logs data source in Grafana.
-        # datasourceUid value must match the uid value of the logs data source.
-        datasourceUid: 'loki'
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-        tags: [ 'job', 'instance', 'pod', 'namespace' ]
-        filterByTraceID: false
-        filterBySpanID: false
-        customQuery: true
-        query: 'method="$${__span.tags.method}"'
-      tracesToMetrics:
-        datasourceUid: 'Prometheus'
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-        tags: [ { key: 'service.name', value: 'service' }, { key: 'job' } ]
-        queries:
-          - name: 'Sample query'
-            query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m]))'
-      nodeGraph:
-        enabled: true
-      traceQuery:
-        timeShiftEnabled: true
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-      spanBar:
-        type: 'None'

.docker/observability/grafana/provisioning/dashboards/dashboard.yml

@@ -0,0 +1,25 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: 1
+
+providers:
+  - name: "default"
+    orgId: 1
+    folder: ""
+    type: file
+    disableDeletion: false
+    updateIntervalSeconds: 10
+    options:
+      path: /etc/grafana/dashboards

.docker/observability/grafana/provisioning/datasources.yaml

@@ -0,0 +1,97 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    uid: prometheus
+    access: proxy
+    orgId: 1
+    url: http://prometheus:9090
+    isDefault: true
+    version: 1
+    editable: false
+    jsonData:
+      httpMethod: GET
+      exemplarTraceIdDestinations:
+        - name: trace_id
+          datasourceUid: tempo
+
+  - name: Tempo
+    type: tempo
+    uid: tempo
+    access: proxy
+    orgId: 1
+    url: http://tempo:3200
+    isDefault: false
+    version: 1
+    editable: false
+    jsonData:
+      httpMethod: GET
+      serviceMap:
+        datasourceUid: prometheus
+      tracesToLogs:
+        datasourceUid: loki
+        tags: [ 'job', 'instance', 'pod', 'namespace', 'service.name' ]
+        mappedTags: [ { key: 'service.name', value: 'app' } ]
+        spanStartTimeShift: '1s'
+        spanEndTimeShift: '-1s'
+        filterByTraceID: true
+        filterBySpanID: false
+      tracesToMetrics:
+        datasourceUid: prometheus
+        tags: [ { key: 'service.name' }, { key: 'job' } ]
+        queries:
+          - name: 'Service-Level Latency'
+            query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m])) by (le)'
+          - name: 'Service-Level Calls'
+            query: 'sum(rate(traces_spanmetrics_calls_total{$$__tags}[5m]))'
+          - name: 'Service-Level Errors'
+            query: 'sum(rate(traces_spanmetrics_calls_total{status_code="ERROR", $$__tags}[5m]))'
+      nodeGraph:
+        enabled: true
+
+  - name: Loki
+    type: loki
+    uid: loki
+    orgId: 1
+    url: http://loki:3100
+    isDefault: false
+    version: 1
+    editable: false
+    jsonData:
+      derivedFields:
+        - datasourceUid: tempo
+          matcherRegex: 'trace_id=(\w+)'
+          name: 'TraceID'
+          url: '$${__value.raw}'
+
+  - name: Jaeger
+    type: jaeger
+    uid: jaeger
+    url: http://jaeger:16686
+    access: proxy
+    isDefault: false
+    editable: false
+    jsonData:
+      tracesToLogs:
+        datasourceUid: loki
+        tags: [ 'job', 'instance', 'pod', 'namespace', 'service.name' ]
+        mappedTags: [ { key: 'service.name', value: 'app' } ]
+        spanStartTimeShift: '1s'
+        spanEndTimeShift: '-1s'
+        filterByTraceID: true
+        filterBySpanID: false

.docker/observability/grafana/provisioning/datasources/datasources.yaml

@@ -0,0 +1,98 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    uid: prometheus
+    url: http://prometheus:9090
+    access: proxy
+    isDefault: true
+    editable: false
+    jsonData:
+      httpMethod: GET
+      exemplarTraceIdDestinations:
+        - name: trace_id
+          datasourceUid: tempo
+
+  - name: Tempo
+    type: tempo
+    uid: tempo
+    access: proxy
+    url: http://tempo:3200
+    isDefault: false
+    editable: false
+    jsonData:
+      httpMethod: GET
+      serviceMap:
+        datasourceUid: prometheus
+      tracesToLogs:
+        datasourceUid: loki
+        tags: [ 'job', 'instance', 'pod', 'namespace', 'service.name' ]
+        mappedTags: [ { key: 'service.name', value: 'app' } ]
+        spanStartTimeShift: '-1h'
+        spanEndTimeShift: '1h'
+        filterByTraceID: true
+        filterBySpanID: false
+      tracesToMetrics:
+        datasourceUid: prometheus
+        tags: [ { key: 'service.name' }, { key: 'job' } ]
+        queries:
+          - name: 'Service-Level Latency'
+            query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m])) by (le)'
+          - name: 'Service-Level Calls'
+            query: 'sum(rate(traces_spanmetrics_calls_total{$$__tags}[5m]))'
+          - name: 'Service-Level Errors'
+            query: 'sum(rate(traces_spanmetrics_calls_total{status_code="ERROR", $$__tags}[5m]))'
+      nodeGraph:
+        enabled: true
+
+  - name: Loki
+    type: loki
+    uid: loki
+    url: http://loki:3100
+    basicAuth: false
+    isDefault: false
+    editable: false
+    jsonData:
+      derivedFields:
+        - datasourceUid: tempo
+          matcherRegex: 'trace_id=(\w+)'
+          name: 'TraceID'
+          url: '$${__value.raw}'
+
+  - name: Jaeger
+    type: jaeger
+    uid: jaeger
+    url: http://jaeger:16686
+    access: proxy
+    isDefault: false
+    editable: false
+    jsonData:
+      tracesToLogs:
+        datasourceUid: loki
+        tags: [ 'job', 'instance', 'pod', 'namespace', 'service.name' ]
+        mappedTags: [ { key: 'service.name', value: 'app' } ]
+        spanStartTimeShift: '1s'
+        spanEndTimeShift: '-1s'
+        filterByTraceID: true
+        filterBySpanID: false
+
+  - name: Pyroscope
+    type: grafana-pyroscope-datasource
+    url: http://pyroscope:4040
+    jsonData:
+      minStep: '15s'

.docker/observability/jaeger-config.yaml

@@ -1,114 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-service:
-  extensions: [ jaeger_storage, jaeger_query, remote_sampling, healthcheckv2 ]
-  pipelines:
-    traces:
-      receivers: [ otlp, jaeger, zipkin ]
-      processors: [ batch, adaptive_sampling ]
-      exporters: [ jaeger_storage_exporter ]
-  telemetry:
-    resource:
-      service.name: jaeger
-    metrics:
-      level: detailed
-      readers:
-        - pull:
-            exporter:
-              prometheus:
-                host: 0.0.0.0
-                port: 8888
-    logs:
-      level: debug
-    # TODO Initialize telemetry tracer once OTEL released new feature.
-    # https://github.com/open-telemetry/opentelemetry-collector/issues/10663
-
-extensions:
-  healthcheckv2:
-    use_v2: true
-    http:
-
-  # pprof:
-  #   endpoint: 0.0.0.0:1777
-  # zpages:
-  #   endpoint: 0.0.0.0:55679
-
-  jaeger_query:
-    storage:
-      traces: some_store
-      traces_archive: another_store
-    ui:
-      config_file: ./cmd/jaeger/config-ui.json
-      log_access: true
-    # The maximum duration that is considered for clock skew adjustments.
-    # Defaults to 0 seconds, which means it's disabled.
-    max_clock_skew_adjust: 0s
-    grpc:
-      endpoint: 0.0.0.0:16685
-    http:
-      endpoint: 0.0.0.0:16686
-
-  jaeger_storage:
-    backends:
-      some_store:
-        memory:
-          max_traces: 1000000
-          max_events: 100000
-      another_store:
-        memory:
-          max_traces: 1000000
-    metric_backends:
-      some_metrics_storage:
-        prometheus:
-          endpoint: http://prometheus:9090
-          normalize_calls: true
-          normalize_duration: true
-
-  remote_sampling:
-    # You can either use file or adaptive sampling strategy in remote_sampling
-    # file:
-    #   path: ./cmd/jaeger/sampling-strategies.json
-    adaptive:
-      sampling_store: some_store
-      initial_sampling_probability: 0.1
-    http:
-    grpc:
-
-receivers:
-  otlp:
-    protocols:
-      grpc:
-      http:
-
-  jaeger:
-    protocols:
-      grpc:
-      thrift_binary:
-      thrift_compact:
-      thrift_http:
-
-  zipkin:
-
-processors:
-  batch:
-  metadata_keys: [ "span.kind", "http.method", "http.status_code", "db.system", "db.statement", "messaging.system", "messaging.destination", "messaging.operation","span.events","span.links" ]
-  # Adaptive Sampling Processor is required to support adaptive sampling.
-  # It expects remote_sampling extension with `adaptive:` config to be enabled.
-  adaptive_sampling:
-
-exporters:
-  jaeger_storage_exporter:
-    trace_storage: some_store
-

.docker/observability/jaeger.yaml

@@ -0,0 +1,74 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+service:
+  extensions: [jaeger_storage, jaeger_query]
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [jaeger_storage_exporter, spanmetrics]
+    metrics/spanmetrics:
+      receivers: [spanmetrics]
+      exporters: [prometheus]
+  telemetry:
+    resource:
+      service.name: jaeger
+    metrics:
+      level: detailed
+      readers:
+        - pull:
+            exporter:
+              prometheus:
+                host: 0.0.0.0
+                port: 8888
+    logs:
+      level: DEBUG
+
+extensions:
+  jaeger_query:
+    storage:
+      traces: some_storage
+      metrics: some_metrics_storage
+  jaeger_storage:
+    backends:
+      some_storage:
+        memory:
+          max_traces: 100000
+    metric_backends:
+      some_metrics_storage:
+        prometheus:
+          endpoint: http://prometheus:9090
+          normalize_calls: true
+          normalize_duration: true
+
+connectors:
+  spanmetrics:
+
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: "0.0.0.0:4317"
+      http:
+        endpoint: "0.0.0.0:4318"
+
+processors:
+  batch:
+
+exporters:
+  jaeger_storage_exporter:
+    trace_storage: some_storage
+  prometheus:
+    endpoint: "0.0.0.0:8889"

.docker/observability/loki.yaml

@@ -11,22 +11,21 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 auth_enabled: false
 
 server:
   http_listen_port: 3100
-  grpc_listen_port: 9096
-  log_level: debug
+  grpc_listen_port: 9095
+  log_level: info
   grpc_server_max_concurrent_streams: 1000
 
 common:
   instance_addr: 127.0.0.1
-  path_prefix: /tmp/loki
+  path_prefix: /loki
   storage:
     filesystem:
-      chunks_directory: /tmp/loki/chunks
-      rules_directory: /tmp/loki/rules
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
   replication_factor: 1
   ring:
     kvstore:
@@ -39,12 +38,6 @@ query_range:
         enabled: true
         max_size_mb: 100
 
-limits_config:
-  metric_aggregation_enabled: true
-  max_line_size: 256KB
-  max_line_size_truncate: false
-  allow_structured_metadata: true
-
 schema_config:
   configs:
     - from: 2020-10-24
@@ -54,29 +47,17 @@ schema_config:
       index:
         prefix: index_
         period: 24h
-      row_shards: 16
+
+limits_config:
+  reject_old_samples: true
+  reject_old_samples_max_age: 168h
+  allow_structured_metadata: true
+  max_line_size: 256KB
 
 pattern_ingester:
   enabled: true
   metric_aggregation:
     loki_address: localhost:3100
 
-ruler:
-  alertmanager_url: http://localhost:9093
-
 frontend:
   encoding: protobuf
-
-
-# By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
-# analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
-#
-# Statistics help us better understand how Loki is used, and they show us performance
-# levels for most users. This helps us prioritize features and documentation.
-# For more information on what's sent, look at
-# https://github.com/grafana/loki/blob/main/pkg/analytics/stats.go
-# Refer to the buildReport method to see what goes into a report.
-#
-# If you would like to disable reporting, uncomment the following lines:
-#analytics:
-#  reporting_enabled: false

.docker/observability/otel-collector-config.yaml

@@ -15,70 +15,70 @@
 receivers:
   otlp:
     protocols:
-      grpc: # OTLP gRPC receiver
+      grpc:
         endpoint: 0.0.0.0:4317
-      http: # OTLP HTTP receiver
+      http:
         endpoint: 0.0.0.0:4318
 
 processors:
-  batch: # Batch processor to improve throughput
-    timeout: 5s
-    send_batch_size: 1000
-    metadata_keys: [ ]
-    metadata_cardinality_limit: 1000
+  batch:
+    timeout: 1s
+    send_batch_size: 1024
   memory_limiter:
     check_interval: 1s
-    limit_mib: 512
+    limit_mib: 1024
+    spike_limit_mib: 256
   transform/logs:
     log_statements:
       - context: log
         statements:
-          # Extract Body as attribute "message"
           - set(attributes["message"], body.string)
-          # Retain the original Body
           - set(attributes["log.body"], body.string)
 
 exporters:
-  otlp/traces: # OTLP exporter for trace data
-    endpoint: "http://jaeger:4317"  # OTLP gRPC endpoint for Jaeger
+  otlp/tempo:
+    endpoint: "tempo:4317"
     tls:
-      insecure: true  # TLS is disabled in the development environment and a certificate needs to be configured in the production environment.
-    compression: gzip  # Enable compression to reduce network bandwidth
+      insecure: true
+    compression: gzip
     retry_on_failure:
-      enabled: true  # Enable retry on failure
-      initial_interval: 1s  # Initial interval for retry
-      max_interval: 30s  # Maximum interval for retry
-      max_elapsed_time: 300s  # Maximum elapsed time for retry
+      enabled: true
+      initial_interval: 1s
+      max_interval: 30s
+      max_elapsed_time: 300s
     sending_queue:
-      enabled: true  # Enable sending queue
-      num_consumers: 10  # Number of consumers
-      queue_size: 5000  # Queue size
-  otlp/tempo: # OTLP exporter for trace data
-    endpoint: "http://tempo:4317"  # OTLP gRPC endpoint for tempo
+      enabled: true
+      num_consumers: 10
+      queue_size: 5000
+
+  otlp/jaeger:
+    endpoint: "jaeger:4317"
     tls:
-      insecure: true  # TLS is disabled in the development environment and a certificate needs to be configured in the production environment.
-    compression: gzip  # Enable compression to reduce network bandwidth
+      insecure: true
+    compression: gzip
     retry_on_failure:
-      enabled: true  # Enable retry on failure
-      initial_interval: 1s  # Initial interval for retry
-      max_interval: 30s  # Maximum interval for retry
-      max_elapsed_time: 300s  # Maximum elapsed time for retry
+      enabled: true
+      initial_interval: 1s
+      max_interval: 30s
+      max_elapsed_time: 300s
     sending_queue:
-      enabled: true  # Enable sending queue
-      num_consumers: 10  # Number of consumers
-      queue_size: 5000  # Queue size
-  prometheus: # Prometheus exporter for metrics data
-    endpoint: "0.0.0.0:8889"  # Prometheus scraping endpoint
-    namespace: "metrics"  # indicator prefix
-    send_timestamps: true  # Send timestamp
-    metric_expiration: 5m  # Metric expiration time
+      enabled: true
+      num_consumers: 10
+      queue_size: 5000
+
+  prometheus:
+    endpoint: "0.0.0.0:8889"
+    send_timestamps: true
+    metric_expiration: 5m
     resource_to_telemetry_conversion:
-      enabled: true  # Enable resource to telemetry conversion
-  otlphttp/loki: # Loki exporter for log data
+      enabled: true
+
+  otlphttp/loki:
     endpoint: "http://loki:3100/otlp"
     tls:
       insecure: true
-    compression: gzip  # Enable compression to reduce network bandwidth
+    compression: gzip
+
 extensions:
   health_check:
     endpoint: 0.0.0.0:13133
@@ -86,13 +86,14 @@ extensions:
     endpoint: 0.0.0.0:1888
   zpages:
     endpoint: 0.0.0.0:55679
+
 service:
-  extensions: [ health_check, pprof, zpages ]  # Enable extension
+  extensions: [ health_check, pprof, zpages ]
   pipelines:
     traces:
       receivers: [ otlp ]
       processors: [ memory_limiter, batch ]
-      exporters: [ otlp/traces, otlp/tempo ]
+      exporters: [ otlp/tempo, otlp/jaeger ]
     metrics:
       receivers: [ otlp ]
       processors: [ batch ]
@@ -103,20 +104,13 @@ service:
       exporters: [ otlphttp/loki ]
   telemetry:
     logs:
-      level: "debug"  # Collector log level
-      encoding: "json"  # Log encoding: console or json
+      level: "info"
+      encoding: "json"
     metrics:
-      level: "detailed" # Can be basic, normal, detailed
+      level: "normal"
       readers:
-        - periodic:
-            exporter:
-              otlp:
-                protocol: http/protobuf
-                endpoint: http://otel-collector:4318
         - pull:
             exporter:
               prometheus:
                 host: '0.0.0.0'
                 port: 8888
-
-

.docker/observability/prometheus-data/.gitignore

@@ -1 +0,0 @@
-*

.docker/observability/prometheus.yml

@@ -17,27 +17,40 @@ global:
   evaluation_interval: 15s
   external_labels:
     cluster: 'rustfs-dev'  # Label to identify the cluster
-    relica: '1'  # Replica identifier
+    replica: '1'  # Replica identifier
 
 scrape_configs:
-  - job_name: 'otel-collector-internal'
+  - job_name: 'otel-collector'
     static_configs:
       - targets: [ 'otel-collector:8888' ]  # Scrape metrics from Collector
     scrape_interval: 10s
+
   - job_name: 'rustfs-app-metrics'
     static_configs:
       - targets: [ 'otel-collector:8889' ]  # Application indicators
     scrape_interval: 15s
     metric_relabel_configs:
+      - source_labels: [ __name__ ]
+        regex: 'go_.*'
+        action: drop  # Drop Go runtime metrics if not needed
+
   - job_name: 'tempo'
     static_configs:
       - targets: [ 'tempo:3200' ]  # Scrape metrics from Tempo
+
   - job_name: 'jaeger'
     static_configs:
-      - targets: [ 'jaeger:8888' ]  # Jaeger admin port
+      - targets: [ 'jaeger:14269' ]  # Jaeger admin port (14269 is standard for admin/metrics)
+
+  - job_name: 'loki'
+    static_configs:
+      - targets: [ 'loki:3100' ]
+
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: [ 'localhost:9090' ]
 
 otlp:
-  # Recommended attributes to be promoted to labels.
   promote_resource_attributes:
     - service.instance.id
     - service.name
@@ -56,10 +69,8 @@ otlp:
     - k8s.pod.name
     - k8s.replicaset.name
     - k8s.statefulset.name
-  # Ingest OTLP data keeping all characters in metric/label names.
   translation_strategy: NoUTF8EscapingWithSuffixes
 
 storage:
-  # OTLP is a push-based protocol, Out of order samples is a common scenario.
   tsdb:
-    out_of_order_time_window: 30m
+    out_of_order_time_window: 30m

.docker/observability/tempo-data/.gitignore

@@ -1 +0,0 @@
-*

.docker/observability/tempo-ha.yaml

@@ -0,0 +1,286 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# High Availability Tempo Configuration for docker-compose-example-for-rustfs.yml
+# Features:
+# - Distributed architecture with multiple components
+# - Kafka-based ingestion for fault tolerance
+# - Replication factor of 3 for data resilience
+# - Query frontend for load balancing
+# - Metrics generation from traces
+# - WAL for durability
+
+partition_ring_live_store: true
+stream_over_http_enabled: true
+
+server:
+  http_listen_port: 3200
+  http_server_read_timeout: 30s
+  http_server_write_timeout: 30s
+  grpc_server_max_recv_msg_size: 4194304  # 4MB
+  grpc_server_max_send_msg_size: 4194304
+  log_level: info
+  log_format: json
+
+# Memberlist configuration for distributed mode
+memberlist:
+  node_name: tempo
+  bind_port: 7946
+  join_members:
+    - tempo:7946
+  retransmit_factor: 4
+  node_timeout: 15s
+  retransmit_interval: 300ms
+  dead_node_reclaim_time: 30s
+
+# Distributor configuration - receives traces and routes to ingesters
+distributor:
+  ingester_write_path_enabled: true
+  kafka_write_path_enabled: true
+  rate_limit_bytes: 10MB
+  rate_limit_enabled: true
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: "0.0.0.0:4317"
+          max_concurrent_streams: 0
+          max_receive_message_size: 4194304
+        http:
+          endpoint: "0.0.0.0:4318"
+          cors:
+            allowed_origins:
+              - "*"
+            max_age: 86400
+    jaeger:
+      protocols:
+        grpc:
+          endpoint: "0.0.0.0:14250"
+        thrift_http:
+          endpoint: "0.0.0.0:14268"
+    zipkin:
+      endpoint: "0.0.0.0:9411"
+  ring:
+    kvstore:
+      store: memberlist
+    heartbeat_timeout: 5s
+    replication_factor: 3
+    heartbeat_interval: 5s
+
+# Ingester configuration - stores traces and querying
+ingester:
+  lifecycler:
+    address: tempo
+    ring:
+      kvstore:
+        store: memberlist
+      replication_factor: 3
+      max_cache_freshness_per_sec: 10s
+      heartbeat_interval: 5s
+      heartbeat_timeout: 5s
+    num_tokens: 128
+    tokens_file_path: /var/tempo/tokens.json
+    claim_on_rollout: true
+  trace_idle_period: 20s
+  max_block_bytes: 10_000_000
+  max_block_duration: 10m
+  chunk_size_bytes: 1_000_000
+  chunk_encoding: snappy
+  wal:
+    checkpoint_duration: 5s
+    max_wal_blocks: 4
+  metrics:
+    enabled: true
+    level: block
+    target_info_duration: 15m
+
+# WAL configuration for data durability
+wal:
+  checkpoint_duration: 5s
+  flush_on_shutdown: true
+  path: /var/tempo/wal
+
+# Kafka ingestion configuration - for high throughput scenarios
+ingest:
+  enabled: true
+  kafka:
+    brokers: [ redpanda:9092 ]
+    topic: tempo-ingest
+    encoding: protobuf
+    consumer_group: tempo-ingest-consumer
+    session_timeout: 10s
+    rebalance_timeout: 1m
+    partition: auto
+    verbosity: 2
+
+# Query frontend configuration - distributed querying
+query_frontend:
+  compression: gzip
+  downstream_url: http://localhost:3200
+  log_queries_longer_than: 5s
+  cache_uncompressed_bytes: 100MB
+  max_outstanding_requests_per_tenant: 100
+  max_query_length: 48h
+  max_query_lookback: 30d
+  default_result_cache_ttl: 1m
+  result_cache:
+    cache:
+      enable_fifocache: true
+      default_validity: 1m
+  rf1_after: "1999-01-01T00:00:00Z"
+  mcp_server:
+    enabled: true
+
+# Querier configuration - queries traces
+querier:
+  frontend_worker:
+    frontend_address: localhost:3200
+    grpc_client_config:
+      max_recv_msg_size: 104857600
+  max_concurrent_queries: 20
+  max_metric_bytes_per_trace: 1MB
+
+# Query scheduler configuration - for distributed querying
+query_scheduler:
+  use_scheduler_ring: false
+
+# Metrics generator configuration - generates metrics from traces
+metrics_generator:
+  enabled: true
+  registry:
+    enabled: true
+    external_labels:
+      source: tempo
+      cluster: rustfs-docker-ha
+      environment: production
+  storage:
+    path: /var/tempo/generator/wal
+    remote_write:
+      - url: http://prometheus:9090/api/v1/write
+        send_exemplars: true
+        resource_to_telemetry_conversion:
+          enabled: true
+  processor:
+    batch:
+      timeout: 10s
+      send_batch_size: 1024
+    memory_limiter:
+      check_interval: 5s
+      limit_mib: 512
+      spike_limit_mib: 128
+  processors:
+    - span-metrics
+    - local-blocks
+    - service-graphs
+  generate_native_histograms: both
+
+# Backend worker configuration
+backend_worker:
+  backend_scheduler_addr: localhost:3200
+  compaction:
+    block_retention: 24h
+    compacted_block_retention: 1h
+  ring:
+    kvstore:
+      store: memberlist
+
+# Backend scheduler configuration
+backend_scheduler:
+  enabled: true
+  provider:
+    compaction:
+      compaction:
+        block_retention: 24h
+        compacted_block_retention: 1h
+        concurrency: 25
+        v2_out_path: /var/tempo/blocks/compaction
+
+# Storage configuration - local backend with proper retention
+storage:
+  trace:
+    backend: local
+    wal:
+      path: /var/tempo/wal
+      checkpoint_duration: 5s
+      flush_on_shutdown: true
+    local:
+      path: /var/tempo/blocks
+      bloom_filter_false_positive: 0.05
+      bloom_shift: 4
+      index:
+        downsample_bytes: 1000000
+        page_size_bytes: 0
+        cache_size_bytes: 0
+    pool:
+      max_workers: 400
+      queue_depth: 10000
+
+# Compactor configuration - manages block compaction
+compactor:
+  compaction:
+    block_retention: 168h  # 7 days
+    compacted_block_retention: 1h
+    concurrency: 25
+    v2_out_path: /var/tempo/blocks/compaction
+    shard_count: 32
+    max_block_bytes: 107374182400  # 100GB
+    max_compaction_objects: 6000000
+    max_time_per_tenant: 5m
+    block_size_bytes: 107374182400
+  ring:
+    kvstore:
+      store: memberlist
+    heartbeat_interval: 5s
+    heartbeat_timeout: 5s
+
+# Limits configuration - rate limiting and quotas
+limits:
+  max_traces_per_user: 10000
+  max_bytes_per_trace: 10485760  # 10MB
+  max_search_bytes_per_trace: 0
+  forgiving_oversize_traces: true
+  rate_limit_bytes: 10MB
+  rate_limit_enabled: true
+  ingestion_burst_size_bytes: 20MB
+  ingestion_rate_limit_bytes: 10MB
+  max_bytes_per_second: 10485760
+  metrics_generator_max_active_series: 10000
+  metrics_generator_max_churned_series: 10000
+  metrics_generator_forta_out_of_order_ttl: 5m
+
+# Override configuration
+overrides:
+  defaults:
+    metrics_generator:
+      processors:
+        - span-metrics
+        - local-blocks
+        - service-graphs
+      generate_native_histograms: both
+      max_active_series: 10000
+      max_churned_series: 10000
+
+# Usage reporting configuration
+usage_report:
+  reporting_enabled: false
+
+# Tracing configuration for debugging
+tracing:
+  enabled: true
+  jaeger:
+    sampler:
+      name: probabilistic
+      param: 0.1
+    reporter_log_spans: false
+

.docker/observability/tempo.yaml

@@ -1,33 +1,74 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+partition_ring_live_store: true
 stream_over_http_enabled: true
+
 server:
   http_listen_port: 3200
   log_level: info
 
-query_frontend:
-  search:
-    duration_slo: 5s
-    throughput_bytes_slo: 1.073741824e+09
-    metadata_slo:
-      duration_slo: 5s
-      throughput_bytes_slo: 1.073741824e+09
-  trace_by_id:
-    duration_slo: 5s
+memberlist:
+  node_name: tempo
+  bind_port: 7946
+  join_members:
+    - tempo:7946
 
+# Distributor configuration - receives traces and writes directly to ingesters
 distributor:
+  ingester_write_path_enabled: true
+  kafka_write_path_enabled: false
   receivers:
     otlp:
       protocols:
         grpc:
-          endpoint: "0.0.0.0:4317"
+          endpoint: "tempo:4317"
         http:
-          endpoint: "0.0.0.0:4318"
+          endpoint: "tempo:4318"
+  ring:
+    kvstore:
+      store: memberlist
 
+# Ingester configuration - consumes from Kafka and stores traces
 ingester:
-  max_block_duration: 5m # cut the headblock when this much time passes. this is being set for demo purposes and should probably be left alone normally
+  lifecycler:
+    ring:
+      kvstore:
+        store: memberlist
+      replication_factor: 1
+    tokens_file_path: /var/tempo/tokens.json
+  trace_idle_period: 10s
+  max_block_bytes: 1_000_000
+  max_block_duration: 5m
 
-compactor:
+backend_scheduler:
+  provider:
+    compaction:
+      compaction:
+        block_retention: 1h
+
+backend_worker:
+  backend_scheduler_addr: localhost:3200
   compaction:
-    block_retention: 1h # overall Tempo trace retention. set for demo purposes
+    block_retention: 1h
+  ring:
+    kvstore:
+      store: memberlist
+
+querier:
+  frontend_worker:
+    frontend_address: tempo:3200
 
 metrics_generator:
   registry:
@@ -39,19 +80,45 @@ metrics_generator:
     remote_write:
       - url: http://prometheus:9090/api/v1/write
         send_exemplars: true
-  traces_storage:
-    path: /var/tempo/generator/traces
+
+query_frontend:
+  rf1_after: "1999-01-01T00:00:00Z"
+  mcp_server:
+    enabled: true
 
 storage:
   trace:
-    backend: local # backend configuration to use
+    backend: local
     wal:
-      path: /var/tempo/wal # where to store the wal locally
+      path: /var/tempo/wal
     local:
       path: /var/tempo/blocks
 
 overrides:
   defaults:
     metrics_generator:
-      processors: [ service-graphs, span-metrics, local-blocks ] # enables metrics generator
-      generate_native_histograms: both
+      processors: [ "span-metrics", "service-graphs", "local-blocks" ]
+      generate_native_histograms: both
+
+ingest:
+  enabled: false
+  # Disabled because using direct ingester write path
+  # If you want Kafka path, enable this and set:
+  # kafka:
+  #   brokers: [redpanda:9092]
+  #   topic: tempo-ingest
+  #   encoding: protobuf
+  #   consumer_group: tempo-ingest-consumer
+
+block_builder:
+  consume_cycle_duration: 30s
+
+compactor:
+  compaction:
+    block_retention: 168h  # 7 days
+  ring:
+    kvstore:
+      store: memberlist
+
+usage_report:
+  reporting_enabled: false

.docker/openobserve-otel/README.md

@@ -5,71 +5,57 @@
 
 English | [中文](README_ZH.md)
 
-This directory contains the configuration files for setting up an observability stack with OpenObserve and OpenTelemetry
-Collector.
+This directory contains the configuration for an **alternative** observability stack using OpenObserve.
 
-### Overview
+## ⚠️ Note
 
-This setup provides a complete observability solution for your applications:
+For the **recommended** observability stack (Prometheus, Grafana, Tempo, Loki), please see `../observability/`.
 
-- **OpenObserve**: A modern, open-source observability platform for logs, metrics, and traces.
-- **OpenTelemetry Collector**: Collects and processes telemetry data before sending it to OpenObserve.
+## 🌟 Overview
 
-### Setup Instructions
+OpenObserve is a lightweight, all-in-one observability platform that handles logs, metrics, and traces in a single binary. This setup is ideal for:
+- Resource-constrained environments.
+- Quick setup and testing.
+- Users who prefer a unified UI.
 
-1. **Prerequisites**:
-    - Docker and Docker Compose installed
-    - Sufficient memory resources (minimum 2GB recommended)
+## 🚀 Quick Start
 
-2. **Starting the Services**:
-   ```bash
-   cd .docker/openobserve-otel
-   docker compose -f docker-compose.yml  up -d
-   ```
-
-3. **Accessing the Dashboard**:
-    - OpenObserve UI: http://localhost:5080
-    - Default credentials:
-        - Username: root@rustfs.com
-        - Password: rustfs123
-
-### Configuration
-
-#### OpenObserve Configuration
-
-The OpenObserve service is configured with:
-
-- Root user credentials
-- Data persistence through a volume mount
-- Memory cache enabled
-- Health checks
-- Exposed ports:
-    - 5080: HTTP API and UI
-    - 5081: OTLP gRPC
-
-#### OpenTelemetry Collector Configuration
-
-The collector is configured to:
-
-- Receive telemetry data via OTLP (HTTP and gRPC)
-- Collect logs from files
-- Process data in batches
-- Export data to OpenObserve
-- Manage memory usage
-
-### Integration with Your Application
-
-To send telemetry data from your application, configure your OpenTelemetry SDK to send data to:
-
-- OTLP gRPC: `localhost:4317`
-- OTLP HTTP: `localhost:4318`
-
-For example, in a Rust application using the `rustfs-obs` library:
+### 1. Start Services
 
 ```bash
-export RUSTFS_OBS_ENDPOINT=http://localhost:4317
-export RUSTFS_OBS_SERVICE_NAME=yourservice
-export RUSTFS_OBS_SERVICE_VERSION=1.0.0
-export RUSTFS_OBS_ENVIRONMENT=development
+cd .docker/openobserve-otel
+docker compose up -d
 ```
 
+### 2. Access Dashboard
+
+- **URL**: [http://localhost:5080](http://localhost:5080)
+- **Username**: `root@rustfs.com`
+- **Password**: `rustfs123`
+
+## 🛠️ Configuration
+
+### OpenObserve
+
+- **Persistence**: Data is persisted to a Docker volume.
+- **Ports**:
+    - `5080`: HTTP API and UI
+    - `5081`: OTLP gRPC
+
+### OpenTelemetry Collector
+
+- **Receivers**: OTLP (gRPC `4317`, HTTP `4318`)
+- **Exporters**: Sends data to OpenObserve.
+
+## 🔗 Integration
+
+Configure your application to send OTLP data to the collector:
+
+- **Endpoint**: `http://localhost:4318` (HTTP) or `localhost:4317` (gRPC)
+
+Example for RustFS:
+
+```bash
+export RUSTFS_OBS_ENDPOINT=http://localhost:4318
+export RUSTFS_OBS_SERVICE_NAME=rustfs-node-1
+```

.docker/openobserve-otel/README_ZH.md

@@ -5,71 +5,57 @@
 
 [English](README.md) | 中文
 
-## 中文
+本目录包含使用 OpenObserve 的**替代**可观测性技术栈配置。
 
-本目录包含搭建 OpenObserve 和 OpenTelemetry Collector 可观测性栈的配置文件。
+## ⚠️ 注意
 
-### 概述
+对于**推荐**的可观测性技术栈（Prometheus, Grafana, Tempo, Loki），请参阅 `../observability/`。
 
-此设置为应用程序提供了完整的可观测性解决方案：
+## 🌟 概览
 
-- **OpenObserve**：现代化、开源的可观测性平台，用于日志、指标和追踪。
-- **OpenTelemetry Collector**：收集和处理遥测数据，然后将其发送到 OpenObserve。
+OpenObserve 是一个轻量级、一体化的可观测性平台，在一个二进制文件中处理日志、指标和追踪。此设置非常适合：
+- 资源受限的环境。
+- 快速设置和测试。
+- 喜欢统一 UI 的用户。
 
-### 设置说明
+## 🚀 快速开始
 
-1. **前提条件**：
-    - 已安装 Docker 和 Docker Compose
-    - 足够的内存资源（建议至少 2GB）
-
-2. **启动服务**：
-   ```bash
-   cd .docker/openobserve-otel
-   docker compose -f docker-compose.yml  up -d
-   ```
-
-3. **访问仪表板**：
-    - OpenObserve UI：http://localhost:5080
-    - 默认凭据：
-        - 用户名：root@rustfs.com
-        - 密码：rustfs123
-
-### 配置
-
-#### OpenObserve 配置
-
-OpenObserve 服务配置：
-
-- 根用户凭据
-- 通过卷挂载实现数据持久化
-- 启用内存缓存
-- 健康检查
-- 暴露端口：
-    - 5080：HTTP API 和 UI
-    - 5081：OTLP gRPC
-
-#### OpenTelemetry Collector 配置
-
-收集器配置为：
-
-- 通过 OTLP（HTTP 和 gRPC）接收遥测数据
-- 从文件中收集日志
-- 批处理数据
-- 将数据导出到 OpenObserve
-- 管理内存使用
-
-### 与应用程序集成
-
-要从应用程序发送遥测数据，将 OpenTelemetry SDK 配置为发送数据到：
-
-- OTLP gRPC:`localhost:4317`
-- OTLP HTTP:`localhost:4318`
-
-例如，在使用 `rustfs-obs` 库的 Rust 应用程序中：
+### 1. 启动服务
 
 ```bash
-export RUSTFS_OBS_ENDPOINT=http://localhost:4317
-export RUSTFS_OBS_SERVICE_NAME=yourservice
-export RUSTFS_OBS_SERVICE_VERSION=1.0.0
-export RUSTFS_OBS_ENVIRONMENT=development
-```
+cd .docker/openobserve-otel
+docker compose up -d
+```
+
+### 2. 访问仪表盘
+
+- **URL**: [http://localhost:5080](http://localhost:5080)
+- **用户名**: `root@rustfs.com`
+- **密码**: `rustfs123`
+
+## 🛠️ 配置
+
+### OpenObserve
+
+- **持久化**: 数据持久化到 Docker 卷。
+- **端口**:
+    - `5080`: HTTP API 和 UI
+    - `5081`: OTLP gRPC
+
+### OpenTelemetry Collector
+
+- **接收器**: OTLP (gRPC `4317`, HTTP `4318`)
+- **导出器**: 将数据发送到 OpenObserve。
+
+## 🔗 集成
+
+配置您的应用程序将 OTLP 数据发送到收集器：
+
+- **端点**: `http://localhost:4318` (HTTP) 或 `localhost:4317` (gRPC)
+
+RustFS 示例：
+
+```bash
+export RUSTFS_OBS_ENDPOINT=http://localhost:4318
+export RUSTFS_OBS_SERVICE_NAME=rustfs-node-1
+```

.github/AGENTS.md

@@ -0,0 +1,30 @@
+# GitHub Workflow Instructions
+
+Applies to `.github/` and repository pull-request operations.
+
+## Pull Requests
+
+- PR titles and descriptions must be in English.
+- Use `.github/pull_request_template.md` for every PR body.
+- Keep all template section headings.
+- Use `N/A` for non-applicable sections.
+- Include verification commands in the PR details.
+- For `gh pr create` and `gh pr edit`, always write markdown body to a file and pass `--body-file`.
+- Do not use multiline inline `--body`; backticks and shell expansion can corrupt content or trigger unintended commands.
+- Recommended pattern:
+  - `cat > /tmp/pr_body.md <<'EOF'`
+  - `...markdown...`
+  - `EOF`
+  - `gh pr create ... --body-file /tmp/pr_body.md`
+
+## CI Alignment
+
+When changing CI-sensitive behavior, keep local validation aligned with `.github/workflows/ci.yml`.
+
+Current `test-and-lint` gate includes:
+
+- `cargo nextest run --all --exclude e2e_test`
+- `cargo test --all --doc`
+- `cargo fmt --all --check`
+- `cargo clippy --all-targets --all-features -- -D warnings`
+- `./scripts/check_layer_dependencies.sh`

.github/copilot-instructions.md

@@ -0,0 +1 @@
+../AGENTS.md

.github/dependabot.yml

@@ -26,6 +26,11 @@ updates:
       day: "monday"
       timezone: "Asia/Shanghai"
       time: "08:00"
+    ignore:
+      - dependency-name: "object_store"
+        versions: [ "0.13.x" ]
+      - dependency-name: "libunftp"
+        versions: [ "0.23.x" ]
     groups:
       s3s:
         update-types:
@@ -36,4 +41,4 @@ updates:
           - "s3s-*"
       dependencies:
         patterns:
-          - "*"
+          - "*"

.github/s3tests/s3tests.conf

@@ -120,7 +120,11 @@ secret_key = ${S3_ALT_SECRET_KEY}
 display_name = RustFS Tenant Tester
 
 # tenant user_id
-user_id = rustfstenant
+# Note: Using same user_id as main to avoid teardown failures.
+# RustFS does not currently support multi-tenancy, so the tenant client
+# effectively operates as the main user. This ensures nuke_prefixed_buckets()
+# in s3-tests teardown can successfully clean up resources.
+user_id = rustfsadmin
 
 # tenant AWS access key
 access_key = ${S3_ACCESS_KEY}
@@ -132,7 +136,11 @@ secret_key = ${S3_SECRET_KEY}
 email = tenant@rustfs.local
 
 # tenant name
-tenant = testx
+# Note: Empty tenant name to avoid multi-tenant path issues during teardown.
+# When s3-tests calls get_tenant_client(), it uses this tenant value in requests.
+# An empty value makes the tenant client behave like the main client, preventing
+# "bucket not found" errors when teardown tries to clean up test buckets.
+tenant =
 
 #following section needs to be added for all sts-tests
 [iam]

.github/workflows/build.yml

@@ -44,22 +44,6 @@ on:
       - "**/*.svg"
       - ".gitignore"
       - ".dockerignore"
-  pull_request:
-    branches: [ main ]
-    paths-ignore:
-      - "**.md"
-      - "**.txt"
-      - ".github/**"
-      - "docs/**"
-      - "deploy/**"
-      - "scripts/dev_*.sh"
-      - "LICENSE*"
-      - "README*"
-      - "**/*.png"
-      - "**/*.jpg"
-      - "**/*.svg"
-      - ".gitignore"
-      - ".dockerignore"
   schedule:
     - cron: "0 0 * * 0" # Weekly on Sunday at midnight UTC
   workflow_dispatch:
@@ -161,42 +145,52 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
-      RUSTFLAGS: ${{ matrix.cross == 'false' && '-C target-cpu=native' || '' }}
+      RUSTFLAGS: ${{ matrix.rustflags }}
     strategy:
       fail-fast: false
       matrix:
         include:
           # Linux builds
+          # Use x86-64-v2 (SSE4.2 baseline) instead of native to ensure distributed
+          # binaries run on older x86_64 CPUs (e.g. Intel Celeron/Atom, Synology NAS).
+          # See: https://github.com/rustfs/rustfs/issues/1838
           - os: ubicloud-standard-2
             target: x86_64-unknown-linux-musl
             cross: false
             platform: linux
+            rustflags: ''
           - os: ubicloud-standard-2
             target: aarch64-unknown-linux-musl
             cross: true
             platform: linux
+            rustflags: ''
           - os: ubicloud-standard-2
             target: x86_64-unknown-linux-gnu
             cross: false
             platform: linux
+            rustflags: ''
           - os: ubicloud-standard-2
             target: aarch64-unknown-linux-gnu
             cross: true
             platform: linux
+            rustflags: ''
           # macOS builds
           - os: macos-latest
             target: aarch64-apple-darwin
             cross: false
             platform: macos
+            rustflags: ''
           - os: macos-latest
             target: x86_64-apple-darwin
             cross: false
             platform: macos
+            rustflags: ''
           # Windows builds (temporarily disabled)
           - os: windows-latest
             target: x86_64-pc-windows-msvc
             cross: false
             platform: windows
+            rustflags: ''
           #- os: windows-latest
           #  target: aarch64-pc-windows-msvc
           #  cross: true

.github/workflows/ci.yml

@@ -19,7 +19,6 @@ on:
     branches: [ main ]
     paths-ignore:
       - "**.md"
-      - "**.txt"
       - "docs/**"
       - "deploy/**"
       - "scripts/dev_*.sh"
@@ -39,7 +38,6 @@ on:
     branches: [ main ]
     paths-ignore:
       - "**.md"
-      - "**.txt"
       - "docs/**"
       - "deploy/**"
       - "scripts/dev_*.sh"
@@ -93,6 +91,8 @@ jobs:
 
   typos:
     name: Typos
+    needs: skip-check
+    if: needs.skip-check.outputs.should_skip != 'true'
     runs-on: ubicloud-standard-2
     steps:
       - uses: actions/checkout@v6
@@ -118,9 +118,6 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - name: Install cargo-nextest
-        uses: taiki-e/install-action@nextest
-
       - name: Run tests
         run: |
           cargo nextest run --all --exclude e2e_test
@@ -132,9 +129,43 @@ jobs:
       - name: Run clippy lints
         run: cargo clippy --all-targets --all-features -- -D warnings
 
+      - name: Check layered dependencies
+        run: ./scripts/check_layer_dependencies.sh
+
+  build-rustfs-debug-binary:
+    name: Build RustFS Debug Binary
+    needs: skip-check
+    if: needs.skip-check.outputs.should_skip != 'true'
+    runs-on: ubicloud-standard-4
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-rustfs-debug-binary-${{ hashFiles('**/Cargo.lock') }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build debug binary
+        run: |
+          touch rustfs/build.rs
+          cargo build -p rustfs --bins --jobs 2
+
+      - name: Upload debug binary
+        uses: actions/upload-artifact@v6
+        with:
+          name: rustfs-debug-binary
+          path: target/debug/rustfs
+          if-no-files-found: error
+          retention-days: 1
+
   e2e-tests:
     name: End-to-End Tests
-    needs: skip-check
+    needs: [ skip-check, build-rustfs-debug-binary ]
     if: needs.skip-check.outputs.should_skip != 'true'
     runs-on: ubicloud-standard-2
     timeout-minutes: 30
@@ -147,26 +178,24 @@ jobs:
           rm -rf /tmp/rustfs
           rm -f /tmp/rustfs.log
 
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
+      - name: Download debug binary
+        uses: actions/download-artifact@v7
         with:
-          rust-version: stable
-          cache-shared-key: ci-e2e-${{ hashFiles('**/Cargo.lock') }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: rustfs-debug-binary
+          path: target/debug
+
+      - name: Make binary executable
+        run: chmod +x ./target/debug/rustfs
+
+      - name: Setup Rust toolchain for s3s-e2e installation
+        uses: dtolnay/rust-toolchain@stable
 
       - name: Install s3s-e2e test tool
         uses: taiki-e/cache-cargo-install-action@v2
         with:
           tool: s3s-e2e
-          git: https://github.com/Nugine/s3s.git
-          rev: 9e41304ed549b89cfb03ede98e9c0d2ac7522051
-
-      - name: Build debug binary
-        run: |
-          touch rustfs/build.rs
-          # Limit concurrency to prevent OOM
-          cargo build -p rustfs --bins --jobs 2
+          git: https://github.com/s3s-project/s3s.git
+          rev: 4a04a670cf41274d9be9ab65dc36f4aa3f92fbad
 
       - name: Run end-to-end tests
         run: |
@@ -180,3 +209,39 @@ jobs:
           name: e2e-test-logs-${{ github.run_number }}
           path: /tmp/rustfs.log
           retention-days: 3
+
+  s3-implemented-tests:
+    name: S3 Implemented Tests
+    needs: [ skip-check, build-rustfs-debug-binary ]
+    if: needs.skip-check.outputs.should_skip != 'true'
+    runs-on: ubicloud-standard-4
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Download debug binary
+        uses: actions/download-artifact@v7
+        with:
+          name: rustfs-debug-binary
+          path: target/debug
+
+      - name: Make binary executable
+        run: chmod +x ./target/debug/rustfs
+
+      - name: Run implemented s3-tests
+        run: |
+          DEPLOY_MODE=binary \
+          RUSTFS_BINARY=./target/debug/rustfs \
+          TEST_MODE=single \
+          MAXFAIL=1 \
+          ./scripts/s3-tests/run.sh
+
+      - name: Upload s3 test artifacts
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: s3tests-implemented-${{ github.run_number }}
+          path: artifacts/s3tests-single/**
+          if-no-files-found: ignore
+          retention-days: 3

.github/workflows/docker.yml

@@ -66,6 +66,7 @@ env:
   CARGO_TERM_COLOR: always
   REGISTRY_DOCKERHUB: rustfs/rustfs
   REGISTRY_GHCR: ghcr.io/${{ github.repository }}
+  REGISTRY_QUAY: quay.io/${{ secrets.QUAY_USERNAME }}/rustfs
   DOCKER_PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
@@ -162,14 +163,7 @@ jobs:
                 if [[ "$version" == *"alpha"* ]] || [[ "$version" == *"beta"* ]] || [[ "$version" == *"rc"* ]]; then
                   build_type="prerelease"
                   is_prerelease=true
-                  # TODO: Temporary change - currently allows alpha versions to also create latest tags
-                  # After the version is stable, you need to remove the following line and restore the original logic (latest is created only for stable versions)
-                  if [[ "$version" == *"alpha"* ]]; then
-                    create_latest=true
-                     echo "🧪 Building Docker image for prerelease: $version (temporarily allowing creation of latest tag)"
-                  else
-                    echo "🧪 Building Docker image for prerelease: $version"
-                  fi
+                  echo "🧪 Building Docker image for prerelease: $version"
                 else
                   build_type="release"
                   create_latest=true
@@ -215,14 +209,7 @@ jobs:
               v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
                 build_type="prerelease"
                 is_prerelease=true
-                # TODO: Temporary change - currently allows alpha versions to also create latest tags
-                # After the version is stable, you need to remove the if block below and restore the original logic.
-                if [[ "$input_version" == *"alpha"* ]]; then
-                  create_latest=true
-                   echo "🧪 Building with prerelease version: $input_version (temporarily allowing creation of latest tag)"
-                else
-                  echo "🧪 Building with prerelease version: $input_version"
-                fi
+                echo "🧪 Building with prerelease version: $input_version"
                 ;;
               # Release versions (match after prereleases, more general)
               v[0-9]*|[0-9]*.*.*)
@@ -266,6 +253,17 @@ jobs:
     if: needs.build-check.outputs.should_build == 'true'
     runs-on: ubicloud-standard-2
     timeout-minutes: 60
+    strategy:
+          fail-fast: false
+          matrix:
+            include:
+              - variant: musl
+                file: Dockerfile
+                suffix: ""
+              - variant: glibc
+                file: Dockerfile.glibc
+                suffix: "-glibc"
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -276,12 +274,19 @@ jobs:
           username: ${{ env.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # - name: Login to GitHub Container Registry
-      #   uses: docker/login-action@v3
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.actor }}
-      #     password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_PASSWORD }}
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSWORD }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -296,6 +301,7 @@ jobs:
           VERSION="${{ needs.build-check.outputs.version }}"
           SHORT_SHA="${{ needs.build-check.outputs.short_sha }}"
           CREATE_LATEST="${{ needs.build-check.outputs.create_latest }}"
+          VARIANT_SUFFIX="${{ matrix.suffix }}"
 
           # Convert version format for Dockerfile compatibility
           case "$VERSION" in
@@ -326,14 +332,15 @@ jobs:
 
           # Generate tags based on build type
           # Only support release and prerelease builds (no development builds)
-          TAGS="${{ env.REGISTRY_DOCKERHUB }}:${VERSION}"
+          TAG_BASE="${VERSION}${VARIANT_SUFFIX}"
+          TAGS="${{ env.REGISTRY_DOCKERHUB }}:$TAG_BASE,${{ env.REGISTRY_GHCR }}:$TAG_BASE,${{ env.REGISTRY_QUAY }}:$TAG_BASE"
 
           # Add channel tags for prereleases and latest for stable
           if [[ "$CREATE_LATEST" == "true" ]]; then
             # TODO: Temporary change - the current alpha version will also create the latest tag
             # After the version is stabilized, the logic here remains unchanged, but the upstream CREATE_LATEST setting needs to be restored.
             # Stable release (and temporary alpha versions)
-            TAGS="$TAGS,${{ env.REGISTRY_DOCKERHUB }}:latest"
+            TAGS="$TAGS,${{ env.REGISTRY_DOCKERHUB }}:latest${VARIANT_SUFFIX},${{ env.REGISTRY_GHCR }}:latest${VARIANT_SUFFIX},${{ env.REGISTRY_QUAY }}:latest${VARIANT_SUFFIX}"
           elif [[ "$BUILD_TYPE" == "prerelease" ]]; then
             # Prerelease channel tags (alpha, beta, rc)
             if [[ "$VERSION" == *"alpha"* ]]; then
@@ -345,7 +352,7 @@ jobs:
             fi
 
             if [[ -n "$CHANNEL" ]]; then
-              TAGS="$TAGS,${{ env.REGISTRY_DOCKERHUB }}:${CHANNEL}"
+              TAGS="$TAGS,${{ env.REGISTRY_DOCKERHUB }}:${CHANNEL}${VARIANT_SUFFIX},${{ env.REGISTRY_GHCR }}:${CHANNEL}${VARIANT_SUFFIX},${{ env.REGISTRY_QUAY }}:${CHANNEL}${VARIANT_SUFFIX}"
             fi
           fi
 
@@ -372,15 +379,15 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile
+          file: ${{ matrix.file }}
           platforms: ${{ env.DOCKER_PLATFORMS }}
           push: ${{ needs.build-check.outputs.should_push == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: |
-            type=gha,scope=docker-binary
+            type=gha,scope=docker-${{ matrix.variant }}
           cache-to: |
-            type=gha,mode=max,scope=docker-binary
+            type=gha,mode=max,scope=docker-${{ matrix.variant }}
           build-args: |
             BUILDTIME=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
             VERSION=${{ needs.build-check.outputs.version }}
@@ -429,10 +436,8 @@ jobs:
             "prerelease")
               echo "🧪 Prerelease Docker image has been built with ${VERSION} tags"
               echo "⚠️  This is a prerelease image - use with caution"
-              # TODO: Temporary change - alpha versions currently create the latest tag
-              # After the version is stable, you need to restore the following prompt information
-              if [[ "$VERSION" == *"alpha"* ]] && [[ "$CREATE_LATEST" == "true" ]]; then
-                echo "🏷️  Latest tag has been created for alpha version (temporary measures)"
+              if [[ "$CREATE_LATEST" == "true" ]]; then
+                echo "🏷️  Latest tag has been explicitly created for prerelease"
               else
                 echo "🚫 Latest tag NOT created for prerelease"
               fi

.github/workflows/e2e-s3tests.yml

@@ -50,6 +50,11 @@ env:
 
   RUST_LOG: info
   PLATFORM: linux/amd64
+  BUILDX_CACHE_SCOPE: rustfs-e2e-s3tests-source
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.inputs['test-mode'] || 'single' }}
+  cancel-in-progress: true
 
 defaults:
   run:
@@ -57,12 +62,25 @@ defaults:
 
 jobs:
   s3tests-single:
-    if: github.event.inputs.test-mode == 'single'
+    if: github.event.inputs['test-mode'] == 'single'
     runs-on: ubicloud-standard-2
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v6
 
+      - name: Cache pip downloads
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-e2e-s3tests-${{ hashFiles('.github/workflows/e2e-s3tests.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-e2e-s3tests-
+
+      - name: Install Python tools
+        run: |
+          python3 -m pip install --user --upgrade pip awscurl tox
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: Enable buildx
         uses: docker/setup-buildx-action@v3
 
@@ -70,8 +88,8 @@ jobs:
         run: |
           DOCKER_BUILDKIT=1 docker buildx build --load \
             --platform ${PLATFORM} \
-            --cache-from type=gha \
-            --cache-to type=gha,mode=max \
+            --cache-from type=gha,scope=${BUILDX_CACHE_SCOPE} \
+            --cache-to type=gha,mode=max,scope=${BUILDX_CACHE_SCOPE} \
             -t rustfs-ci \
             -f Dockerfile.source .
 
@@ -121,9 +139,6 @@ jobs:
 
       - name: Provision s3-tests alt user (required by suite)
         run: |
-          python3 -m pip install --user --upgrade pip awscurl
-          export PATH="$HOME/.local/bin:$PATH"
-
           # Admin API requires AWS SigV4 signing. awscurl is used by RustFS codebase as well.
           awscurl \
             --service s3 \
@@ -156,8 +171,6 @@ jobs:
 
       - name: Prepare s3-tests
         run: |
-          python3 -m pip install --user --upgrade pip tox
-          export PATH="$HOME/.local/bin:$PATH"
           git clone --depth 1 https://github.com/ceph/s3-tests.git s3-tests
 
       - name: Run ceph s3-tests (debug friendly)
@@ -211,12 +224,25 @@ jobs:
           path: artifacts/**
 
   s3tests-multi:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.test-mode == 'multi'
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs['test-mode'] == 'multi'
     runs-on: ubicloud-standard-2
     timeout-minutes: 150
     steps:
       - uses: actions/checkout@v6
 
+      - name: Cache pip downloads
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-e2e-s3tests-${{ hashFiles('.github/workflows/e2e-s3tests.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-e2e-s3tests-
+
+      - name: Install Python tools
+        run: |
+          python3 -m pip install --user --upgrade pip awscurl tox
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: Enable buildx
         uses: docker/setup-buildx-action@v3
 
@@ -224,8 +250,8 @@ jobs:
         run: |
           DOCKER_BUILDKIT=1 docker buildx build --load \
             --platform ${PLATFORM} \
-            --cache-from type=gha \
-            --cache-to type=gha,mode=max \
+            --cache-from type=gha,scope=${BUILDX_CACHE_SCOPE} \
+            --cache-to type=gha,mode=max,scope=${BUILDX_CACHE_SCOPE} \
             -t rustfs-ci \
             -f Dockerfile.source .
 
@@ -337,9 +363,6 @@ jobs:
 
       - name: Provision s3-tests alt user (required by suite)
         run: |
-          python3 -m pip install --user --upgrade pip awscurl
-          export PATH="$HOME/.local/bin:$PATH"
-
           awscurl \
             --service s3 \
             --region "${S3_REGION}" \
@@ -368,8 +391,6 @@ jobs:
 
       - name: Prepare s3-tests
         run: |
-          python3 -m pip install --user --upgrade pip tox
-          export PATH="$HOME/.local/bin:$PATH"
           git clone --depth 1 https://github.com/ceph/s3-tests.git s3-tests
 
       - name: Run ceph s3-tests (multi, debug friendly)

.github/workflows/helm-package.yml

@@ -44,7 +44,6 @@ jobs:
           set -x
           old_version=$(grep "^appVersion:" helm/rustfs/Chart.yaml | awk '{print $2}')
           sed -i "s/$old_version/$new_version/g" helm/rustfs/Chart.yaml
-          sed  -i "/^image:/,/^[^ ]/ s/tag:.*/tag: "$new_version"/" helm/rustfs/values.yaml
 
       - name: Set up Helm
         uses: azure/setup-helm@v4.3.0

.github/workflows/nix-flake-update.yml

@@ -0,0 +1,61 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Update Nix Flake
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 0' # Weekly on Sundays
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  update-flake:
+    name: Update flake.lock
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@v3
+
+      - name: Check Nix flake inputs
+        uses: DeterminateSystems/flake-checker-action@v12
+
+      - name: Update flake.lock
+        id: update
+        uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "chore(deps): update flake.lock"
+          pr-labels: |
+            dependencies
+            nix
+            automated
+          commit-msg: "chore(deps): update flake.lock"
+          pr-reviewers: houseme, heihutu
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log PR details
+        if: steps.update.outputs.pull-request-number
+        run: |
+          echo "Pull Request created: ${{ steps.update.outputs.pull-request-number }}"

.github/workflows/nix.yml

@@ -0,0 +1,84 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Nix CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/nix.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/nix.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+
+jobs:
+  nix-validation:
+    name: Nix Build & Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Setup Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@v13
+
+      - name: Setup Flake Checker
+        uses: DeterminateSystems/flake-checker-action@v12
+
+      - name: Verify Flake
+        run: |
+          echo "Checking flake structure and evaluation..."
+          nix flake show
+          nix flake check --print-build-logs
+
+      - name: Build RustFS
+        run: |
+          echo "Building the default package..."
+          nix build .#default --print-build-logs
+
+      - name: Test Binary
+        run: |
+          echo "Verifying the built binary..."
+          if [ -x "./result/bin/rustfs" ]; then
+              ./result/bin/rustfs --help
+              echo "Binary verification successful."
+          else
+              echo "Error: Binary not found or not executable at ./result/bin/rustfs"
+              exit 1
+          fi

.gitignore

@@ -2,10 +2,13 @@
 .DS_Store
 .idea
 .vscode
+.cursor
 .direnv/
 /test
 /logs
 /data
+/docs
+/rustfs-data/
 .devcontainer
 rustfs/static/*
 !rustfs/static/.gitkeep
@@ -34,3 +37,12 @@ artifacts/
 *.events
 *.audit
 *.snappy
+PR_DESCRIPTION.md
+IMPLEMENTATION_PLAN.md
+scripts/s3-tests/selected_tests.txt
+docs
+
+# nix stuff
+result*
+*.gz
+rustfs-webdav.code-workspace

.rules.md

@@ -1,702 +0,0 @@
-# RustFS Project AI Coding Rules
-
-## 🚨🚨🚨 CRITICAL DEVELOPMENT RULES - ZERO TOLERANCE 🚨🚨🚨
-
-### ⛔️ ABSOLUTE PROHIBITION: NEVER COMMIT DIRECTLY TO MASTER/MAIN BRANCH ⛔️
-
-**🔥 THIS IS THE MOST CRITICAL RULE - VIOLATION WILL RESULT IN IMMEDIATE REVERSAL 🔥**
-
-- **🚫 ZERO DIRECT COMMITS TO MAIN/MASTER BRANCH - ABSOLUTELY FORBIDDEN**
-- **🚫 ANY DIRECT COMMIT TO MAIN BRANCH MUST BE IMMEDIATELY REVERTED**
-- **🚫 NO EXCEPTIONS FOR HOTFIXES, EMERGENCIES, OR URGENT CHANGES**
-- **🚫 NO EXCEPTIONS FOR SMALL CHANGES, TYPOS, OR DOCUMENTATION UPDATES**
-- **🚫 NO EXCEPTIONS FOR ANYONE - MAINTAINERS, CONTRIBUTORS, OR ADMINS**
-
-### 📋 MANDATORY WORKFLOW - STRICTLY ENFORCED
-
-**EVERY SINGLE CHANGE MUST FOLLOW THIS WORKFLOW:**
-
-1. **Check current branch**: `git branch` (MUST NOT be on main/master)
-2. **Switch to main**: `git checkout main`
-3. **Pull latest**: `git pull origin main`
-4. **Create feature branch**: `git checkout -b feat/your-feature-name`
-5. **Make changes ONLY on feature branch**
-6. **Test thoroughly before committing**
-7. **Commit and push to feature branch**: `git push origin feat/your-feature-name`
-8. **Create Pull Request**: Use `gh pr create` (MANDATORY)
-9. **Wait for PR approval**: NO self-merging allowed
-10. **Merge through GitHub interface**: ONLY after approval
-
-### 🔒 ENFORCEMENT MECHANISMS
-
-- **Branch protection rules**: Main branch is protected
-- **Pre-commit hooks**: Will block direct commits to main
-- **CI/CD checks**: All PRs must pass before merging
-- **Code review requirement**: At least one approval needed
-- **Automated reversal**: Direct commits to main will be automatically reverted
-
-## 🎯 Core AI Development Principles
-
-### Five Execution Steps
-
-#### 1. Task Analysis and Planning
-- **Clear Objectives**: Deeply understand task requirements and expected results before starting coding
-- **Plan Development**: List specific files, components, and functions that need modification, explaining the reasons for changes
-- **Risk Assessment**: Evaluate the impact of changes on existing functionality, develop rollback plans
-
-#### 2. Precise Code Location
-- **File Identification**: Determine specific files and line numbers that need modification
-- **Impact Analysis**: Avoid modifying irrelevant files, clearly state the reason for each file modification
-- **Minimization Principle**: Unless explicitly required by the task, do not create new abstraction layers or refactor existing code
-
-#### 3. Minimal Code Changes
-- **Focus on Core**: Only write code directly required by the task
-- **Avoid Redundancy**: Do not add unnecessary logs, comments, tests, or error handling
-- **Isolation**: Ensure new code does not interfere with existing functionality, maintain code independence
-
-#### 4. Strict Code Review
-- **Correctness Check**: Verify the correctness and completeness of code logic
-- **Style Consistency**: Ensure code conforms to established project coding style
-- **Side Effect Assessment**: Evaluate the impact of changes on downstream systems
-
-#### 5. Clear Delivery Documentation
-- **Change Summary**: Detailed explanation of all modifications and reasons
-- **File List**: List all modified files and their specific changes
-- **Risk Statement**: Mark any assumptions or potential risk points
-
-### Core Principles
-- **🎯 Precise Execution**: Strictly follow task requirements, no arbitrary innovation
-- **⚡ Efficient Development**: Avoid over-design, only do necessary work
-- **🛡️ Safe and Reliable**: Always follow development processes, ensure code quality and system stability
-- **🔒 Cautious Modification**: Only modify when clearly knowing what needs to be changed and having confidence
-
-### Additional AI Behavior Rules
-
-1. **Use English for all code comments and documentation** - All comments, variable names, function names, documentation, and user-facing text in code should be in English
-2. **Clean up temporary scripts after use** - Any temporary scripts, test files, or helper files created during AI work should be removed after task completion
-3. **Only make confident modifications** - Do not make speculative changes or "convenient" modifications outside the task scope. If uncertain about a change, ask for clarification rather than guessing
-
-## Project Overview
-
-RustFS is a high-performance distributed object storage system written in Rust, compatible with S3 API. The project adopts a modular architecture, supporting erasure coding storage, multi-tenant management, observability, and other enterprise-level features.
-
-## Core Architecture Principles
-
-### 1. Modular Design
-
-- Project uses Cargo workspace structure, containing multiple independent crates
-- Core modules: `rustfs` (main service), `ecstore` (erasure coding storage), `common` (shared components)
-- Functional modules: `iam` (identity management), `madmin` (management interface), `crypto` (encryption), etc.
-- Tool modules: `cli` (command line tool), `crates/*` (utility libraries)
-
-### 2. Asynchronous Programming Pattern
-
-- Comprehensive use of `tokio` async runtime
-- Prioritize `async/await` syntax
-- Use `async-trait` for async methods in traits
-- Avoid blocking operations, use `spawn_blocking` when necessary
-
-### 3. Error Handling Strategy
-
-- **Use modular, type-safe error handling with `thiserror`**
-- Each module should define its own error type using `thiserror::Error` derive macro
-- Support error chains and context information through `#[from]` and `#[source]` attributes
-- Use `Result<T>` type aliases for consistency within each module
-- Error conversion between modules should use explicit `From` implementations
-- Follow the pattern: `pub type Result<T> = core::result::Result<T, Error>`
-- Use `#[error("description")]` attributes for clear error messages
-- Support error downcasting when needed through `other()` helper methods
-- Implement `Clone` for errors when required by the domain logic
-
-## Code Style Guidelines
-
-### 1. Formatting Configuration
-
-```toml
-max_width = 130
-fn_call_width = 90
-single_line_let_else_max_width = 100
-```
-
-### 2. **🔧 MANDATORY Code Formatting Rules**
-
-**CRITICAL**: All code must be properly formatted before committing. This project enforces strict formatting standards to maintain code consistency and readability.
-
-#### Pre-commit Requirements (MANDATORY)
-
-Before every commit, you **MUST**:
-
-1. **Format your code**:
-   ```bash
-   cargo fmt --all
-   ```
-
-2. **Verify formatting**:
-   ```bash
-   cargo fmt --all --check
-   ```
-
-3. **Pass clippy checks**:
-   ```bash
-   cargo clippy --all-targets --all-features -- -D warnings
-   ```
-
-4. **Ensure compilation**:
-   ```bash
-   cargo check --all-targets
-   ```
-
-#### Quick Commands
-
-Use these convenient Makefile targets for common tasks:
-
-```bash
-# Format all code
-make fmt
-
-# Check if code is properly formatted
-make fmt-check
-
-# Run clippy checks
-make clippy
-
-# Run compilation check
-make check
-
-# Run tests
-make test
-
-# Run all pre-commit checks (format + clippy + check + test)
-make pre-commit
-
-# Setup git hooks (one-time setup)
-make setup-hooks
-```
-
-### 3. Naming Conventions
-
-- Use `snake_case` for functions, variables, modules
-- Use `PascalCase` for types, traits, enums
-- Constants use `SCREAMING_SNAKE_CASE`
-- Global variables prefix `GLOBAL_`, e.g., `GLOBAL_Endpoints`
-- Use meaningful and descriptive names for variables, functions, and methods
-- Avoid meaningless names like `temp`, `data`, `foo`, `bar`, `test123`
-- Choose names that clearly express the purpose and intent
-
-### 4. Type Declaration Guidelines
-
-- **Prefer type inference over explicit type declarations** when the type is obvious from context
-- Let the Rust compiler infer types whenever possible to reduce verbosity and improve maintainability
-- Only specify types explicitly when:
-  - The type cannot be inferred by the compiler
-  - Explicit typing improves code clarity and readability
-  - Required for API boundaries (function signatures, public struct fields)
-  - Needed to resolve ambiguity between multiple possible types
-
-### 5. Documentation Comments
-
-- Public APIs must have documentation comments
-- Use `///` for documentation comments
-- Complex functions add `# Examples` and `# Parameters` descriptions
-- Error cases use `# Errors` descriptions
-- Always use English for all comments and documentation
-- Avoid meaningless comments like "debug 111" or placeholder text
-
-### 6. Import Guidelines
-
-- Standard library imports first
-- Third-party crate imports in the middle
-- Project internal imports last
-- Group `use` statements with blank lines between groups
-
-## Asynchronous Programming Guidelines
-
-### 1. Trait Definition
-
-```rust
-#[async_trait::async_trait]
-pub trait StorageAPI: Send + Sync {
-    async fn get_object(&self, bucket: &str, object: &str) -> Result<ObjectInfo>;
-}
-```
-
-### 2. Error Handling
-
-```rust
-// Use ? operator to propagate errors
-async fn example_function() -> Result<()> {
-    let data = read_file("path").await?;
-    process_data(data).await?;
-    Ok(())
-}
-```
-
-### 3. Concurrency Control
-
-- Use `Arc` and `Mutex`/`RwLock` for shared state management
-- Prioritize async locks from `tokio::sync`
-- Avoid holding locks for long periods
-
-## Logging and Tracing Guidelines
-
-### 1. Tracing Usage
-
-```rust
-#[tracing::instrument(skip(self, data))]
-async fn process_data(&self, data: &[u8]) -> Result<()> {
-    info!("Processing {} bytes", data.len());
-    // Implementation logic
-}
-```
-
-### 2. Log Levels
-
-- `error!`: System errors requiring immediate attention
-- `warn!`: Warning information that may affect functionality
-- `info!`: Important business information
-- `debug!`: Debug information for development use
-- `trace!`: Detailed execution paths
-
-### 3. Structured Logging
-
-```rust
-info!(
-    counter.rustfs_api_requests_total = 1_u64,
-    key_request_method = %request.method(),
-    key_request_uri_path = %request.uri().path(),
-    "API request processed"
-);
-```
-
-## Error Handling Guidelines
-
-### 1. Error Type Definition
-
-```rust
-// Use thiserror for module-specific error types
-#[derive(thiserror::Error, Debug)]
-pub enum MyError {
-    #[error("IO error: {0}")]
-    Io(#[from] std::io::Error),
-
-    #[error("Storage error: {0}")]
-    Storage(#[from] ecstore::error::StorageError),
-
-    #[error("Custom error: {message}")]
-    Custom { message: String },
-
-    #[error("File not found: {path}")]
-    FileNotFound { path: String },
-
-    #[error("Invalid configuration: {0}")]
-    InvalidConfig(String),
-}
-
-// Provide Result type alias for the module
-pub type Result<T> = core::result::Result<T, MyError>;
-```
-
-### 2. Error Helper Methods
-
-```rust
-impl MyError {
-    /// Create error from any compatible error type
-    pub fn other<E>(error: E) -> Self
-    where
-        E: Into<Box<dyn std::error::Error + Send + Sync>>,
-    {
-        MyError::Io(std::io::Error::other(error))
-    }
-}
-```
-
-### 3. Error Context and Propagation
-
-```rust
-// Use ? operator for clean error propagation
-async fn example_function() -> Result<()> {
-    let data = read_file("path").await?;
-    process_data(data).await?;
-    Ok(())
-}
-
-// Add context to errors
-fn process_with_context(path: &str) -> Result<()> {
-    std::fs::read(path)
-        .map_err(|e| MyError::Custom {
-            message: format!("Failed to read {}: {}", path, e)
-        })?;
-    Ok(())
-}
-```
-
-## Performance Optimization Guidelines
-
-### 1. Memory Management
-
-- Use `Bytes` instead of `Vec<u8>` for zero-copy operations
-- Avoid unnecessary cloning, use reference passing
-- Use `Arc` for sharing large objects
-
-### 2. Concurrency Optimization
-
-```rust
-// Use join_all for concurrent operations
-let futures = disks.iter().map(|disk| disk.operation());
-let results = join_all(futures).await;
-```
-
-### 3. Caching Strategy
-
-- Use `LazyLock` for global caching
-- Implement LRU cache to avoid memory leaks
-
-## Testing Guidelines
-
-### 1. Unit Tests
-
-```rust
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use test_case::test_case;
-
-    #[tokio::test]
-    async fn test_async_function() {
-        let result = async_function().await;
-        assert!(result.is_ok());
-    }
-
-    #[test_case("input1", "expected1")]
-    #[test_case("input2", "expected2")]
-    fn test_with_cases(input: &str, expected: &str) {
-        assert_eq!(function(input), expected);
-    }
-}
-```
-
-### 2. Integration Tests
-
-- Use `e2e_test` module for end-to-end testing
-- Simulate real storage environments
-
-### 3. Test Quality Standards
-
-- Write meaningful test cases that verify actual functionality
-- Avoid placeholder or debug content like "debug 111", "test test", etc.
-- Use descriptive test names that clearly indicate what is being tested
-- Each test should have a clear purpose and verify specific behavior
-- Test data should be realistic and representative of actual use cases
-
-## Cross-Platform Compatibility Guidelines
-
-### 1. CPU Architecture Compatibility
-
-- **Always consider multi-platform and different CPU architecture compatibility** when writing code
-- Support major architectures: x86_64, aarch64 (ARM64), and other target platforms
-- Use conditional compilation for architecture-specific code:
-
-```rust
-#[cfg(target_arch = "x86_64")]
-fn optimized_x86_64_function() { /* x86_64 specific implementation */ }
-
-#[cfg(target_arch = "aarch64")]
-fn optimized_aarch64_function() { /* ARM64 specific implementation */ }
-
-#[cfg(not(any(target_arch = "x86_64", target_arch = "aarch64")))]
-fn generic_function() { /* Generic fallback implementation */ }
-```
-
-### 2. Platform-Specific Dependencies
-
-- Use feature flags for platform-specific dependencies
-- Provide fallback implementations for unsupported platforms
-- Test on multiple architectures in CI/CD pipeline
-
-### 3. Endianness Considerations
-
-- Use explicit byte order conversion when dealing with binary data
-- Prefer `to_le_bytes()`, `from_le_bytes()` for consistent little-endian format
-- Use `byteorder` crate for complex binary format handling
-
-### 4. SIMD and Performance Optimizations
-
-- Use portable SIMD libraries like `wide` or `packed_simd`
-- Provide fallback implementations for non-SIMD architectures
-- Use runtime feature detection when appropriate
-
-## Security Guidelines
-
-### 1. Memory Safety
-
-- Disable `unsafe` code (workspace.lints.rust.unsafe_code = "deny")
-- Use `rustls` instead of `openssl`
-
-### 2. Authentication and Authorization
-
-```rust
-// Use IAM system for permission checks
-let identity = iam.authenticate(&access_key, &secret_key).await?;
-iam.authorize(&identity, &action, &resource).await?;
-```
-
-## Configuration Management Guidelines
-
-### 1. Environment Variables
-
-- Use `RUSTFS_` prefix
-- Support both configuration files and environment variables
-- Provide reasonable default values
-
-### 2. Configuration Structure
-
-```rust
-#[derive(Debug, Deserialize, Clone)]
-pub struct Config {
-    pub address: String,
-    pub volumes: String,
-    #[serde(default)]
-    pub console_enable: bool,
-}
-```
-
-## Dependency Management Guidelines
-
-### 1. Workspace Dependencies
-
-- Manage versions uniformly at workspace level
-- Use `workspace = true` to inherit configuration
-
-### 2. Feature Flags
-
-```rust
-[features]
-default = ["file"]
-gpu = ["dep:nvml-wrapper"]
-kafka = ["dep:rdkafka"]
-```
-
-## Deployment and Operations Guidelines
-
-### 1. Containerization
-
-- Provide Dockerfile and docker-compose configuration
-- Support multi-stage builds to optimize image size
-
-### 2. Observability
-
-- Integrate OpenTelemetry for distributed tracing
-- Support Prometheus metrics collection
-- Provide Grafana dashboards
-
-### 3. Health Checks
-
-```rust
-// Implement health check endpoint
-async fn health_check() -> Result<HealthStatus> {
-    // Check component status
-}
-```
-
-## Code Review Checklist
-
-### 1. **Code Formatting and Quality (MANDATORY)**
-
-- [ ] **Code is properly formatted** (`cargo fmt --all --check` passes)
-- [ ] **All clippy warnings are resolved** (`cargo clippy --all-targets --all-features -- -D warnings` passes)
-- [ ] **Code compiles successfully** (`cargo check --all-targets` passes)
-- [ ] **Pre-commit hooks are working** and all checks pass
-- [ ] **No formatting-related changes** mixed with functional changes (separate commits)
-
-### 2. Functionality
-
-- [ ] Are all error cases properly handled?
-- [ ] Is there appropriate logging?
-- [ ] Is there necessary test coverage?
-
-### 3. Performance
-
-- [ ] Are unnecessary memory allocations avoided?
-- [ ] Are async operations used correctly?
-- [ ] Are there potential deadlock risks?
-
-### 4. Security
-
-- [ ] Are input parameters properly validated?
-- [ ] Are there appropriate permission checks?
-- [ ] Is information leakage avoided?
-
-### 5. Cross-Platform Compatibility
-
-- [ ] Does the code work on different CPU architectures (x86_64, aarch64)?
-- [ ] Are platform-specific features properly gated with conditional compilation?
-- [ ] Is byte order handling correct for binary data?
-- [ ] Are there appropriate fallback implementations for unsupported platforms?
-
-### 6. Code Commits and Documentation
-
-- [ ] Does it comply with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)?
-- [ ] Are commit messages concise and under 72 characters for the title line?
-- [ ] Commit titles should be concise and in English, avoid Chinese
-- [ ] Is PR description provided in copyable markdown format for easy copying?
-
-## Common Patterns and Best Practices
-
-### 1. Resource Management
-
-```rust
-// Use RAII pattern for resource management
-pub struct ResourceGuard {
-    resource: Resource,
-}
-
-impl Drop for ResourceGuard {
-    fn drop(&mut self) {
-        // Clean up resources
-    }
-}
-```
-
-### 2. Dependency Injection
-
-```rust
-// Use dependency injection pattern
-pub struct Service {
-    config: Arc<Config>,
-    storage: Arc<dyn StorageAPI>,
-}
-```
-
-### 3. Graceful Shutdown
-
-```rust
-// Implement graceful shutdown
-async fn shutdown_gracefully(shutdown_rx: &mut Receiver<()>) {
-    tokio::select! {
-        _ = shutdown_rx.recv() => {
-            info!("Received shutdown signal");
-            // Perform cleanup operations
-        }
-        _ = tokio::time::sleep(SHUTDOWN_TIMEOUT) => {
-            warn!("Shutdown timeout reached");
-        }
-    }
-}
-```
-
-## Domain-Specific Guidelines
-
-### 1. Storage Operations
-
-- All storage operations must support erasure coding
-- Implement read/write quorum mechanisms
-- Support data integrity verification
-
-### 2. Network Communication
-
-- Use gRPC for internal service communication
-- HTTP/HTTPS support for S3-compatible API
-- Implement connection pooling and retry mechanisms
-
-### 3. Metadata Management
-
-- Use FlatBuffers for serialization
-- Support version control and migration
-- Implement metadata caching
-
-## Branch Management and Development Workflow
-
-### Branch Management
-
-- **🚨 CRITICAL: NEVER modify code directly on main or master branch - THIS IS ABSOLUTELY FORBIDDEN 🚨**
-- **⚠️ ANY DIRECT COMMITS TO MASTER/MAIN WILL BE REJECTED AND MUST BE REVERTED IMMEDIATELY ⚠️**
-- **🔒 ALL CHANGES MUST GO THROUGH PULL REQUESTS - NO DIRECT COMMITS TO MAIN UNDER ANY CIRCUMSTANCES 🔒**
-- **Always work on feature branches - NO EXCEPTIONS**
-- Always check the .rules.md file before starting to ensure you understand the project guidelines
-- **MANDATORY workflow for ALL changes:**
-   1. `git checkout main` (switch to main branch)
-   2. `git pull` (get latest changes)
-   3. `git checkout -b feat/your-feature-name` (create and switch to feature branch)
-   4. Make your changes ONLY on the feature branch
-   5. Test thoroughly before committing
-   6. Commit and push to the feature branch
-   7. **Create a pull request for code review - THIS IS THE ONLY WAY TO MERGE TO MAIN**
-   8. **Wait for PR approval before merging - NEVER merge your own PRs without review**
-- Use descriptive branch names following the pattern: `feat/feature-name`, `fix/issue-name`, `refactor/component-name`, etc.
-- **Double-check current branch before ANY commit: `git branch` to ensure you're NOT on main/master**
-- **Pull Request Requirements:**
-  - All changes must be submitted via PR regardless of size or urgency
-  - PRs must include comprehensive description and testing information
-  - PRs must pass all CI/CD checks before merging
-  - PRs require at least one approval from code reviewers
-  - Even hotfixes and emergency changes must go through PR process
-- **Enforcement:**
-  - Main branch should be protected with branch protection rules
-  - Direct pushes to main should be blocked by repository settings
-  - Any accidental direct commits to main must be immediately reverted via PR
-
-### Development Workflow
-
-## 🎯 **Core Development Principles**
-
-- **🔴 Every change must be precise - don't modify unless you're confident**
-  - Carefully analyze code logic and ensure complete understanding before making changes
-  - When uncertain, prefer asking users or consulting documentation over blind modifications
-  - Use small iterative steps, modify only necessary parts at a time
-  - Evaluate impact scope before changes to ensure no new issues are introduced
-
-- **🚀 GitHub PR creation prioritizes gh command usage**
-  - Prefer using `gh pr create` command to create Pull Requests
-  - Avoid having users manually create PRs through web interface
-  - Provide clear and professional PR titles and descriptions
-  - Using `gh` commands ensures better integration and automation
-
-## 📝 **Code Quality Requirements**
-
-- Use English for all code comments, documentation, and variable names
-- Write meaningful and descriptive names for variables, functions, and methods
-- Avoid meaningless test content like "debug 111" or placeholder values
-- Before each change, carefully read the existing code to ensure you understand the code structure and implementation, do not break existing logic implementation, do not introduce new issues
-- Ensure each change provides sufficient test cases to guarantee code correctness
-- Do not arbitrarily modify numbers and constants in test cases, carefully analyze their meaning to ensure test case correctness
-- When writing or modifying tests, check existing test cases to ensure they have scientific naming and rigorous logic testing, if not compliant, modify test cases to ensure scientific and rigorous testing
-- **Before committing any changes, run `cargo clippy --all-targets --all-features -- -D warnings` to ensure all code passes Clippy checks**
-- After each development completion, first git add . then git commit -m "feat: feature description" or "fix: issue description", ensure compliance with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
-- **Keep commit messages concise and under 72 characters** for the title line, use body for detailed explanations if needed
-- After each development completion, first git push to remote repository
-- After each change completion, summarize the changes, do not create summary files, provide a brief change description, ensure compliance with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
-- Provide change descriptions needed for PR in the conversation, ensure compliance with [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
-- **Always provide PR descriptions in English** after completing any changes, including:
-  - Clear and concise title following Conventional Commits format
-  - Detailed description of what was changed and why
-  - List of key changes and improvements
-  - Any breaking changes or migration notes if applicable
-  - Testing information and verification steps
-- **Provide PR descriptions in copyable markdown format** enclosed in code blocks for easy one-click copying
-
-## 🚫 AI Documentation Generation Restrictions
-
-### Forbidden Summary Documents
-
-- **Strictly forbidden to create any form of AI-generated summary documents**
-- **Do not create documents containing large amounts of emoji, detailed formatting tables and typical AI style**
-- **Do not generate the following types of documents in the project:**
-  - Benchmark summary documents (BENCHMARK*.md)
-  - Implementation comparison analysis documents (IMPLEMENTATION_COMPARISON*.md)
-  - Performance analysis report documents
-  - Architecture summary documents
-  - Feature comparison documents
-  - Any documents with large amounts of emoji and formatted content
-- **If documentation is needed, only create when explicitly requested by the user, and maintain a concise and practical style**
-- **Documentation should focus on actually needed information, avoiding excessive formatting and decorative content**
-- **Any discovered AI-generated summary documents should be immediately deleted**
-
-### Allowed Documentation Types
-
-- README.md (project introduction, keep concise)
-- Technical documentation (only create when explicitly needed)
-- User manual (only create when explicitly needed)
-- API documentation (generated from code)
-- Changelog (CHANGELOG.md)
-
-These rules should serve as guiding principles when developing the RustFS project, ensuring code quality, performance, and maintainability.

.vscode/launch.json

@@ -99,7 +99,17 @@
             "name": "Debug executable target/debug/rustfs",
             "type":  "lldb",
             "request": "launch",
-            "program": "${workspaceFolder}/target/debug/rustfs",
+            "cargo": {
+                "args": [
+                    "run",
+                    "--bin",
+                    "rustfs",
+                    "-j",
+                    "1",
+                    "--profile",
+                    "dev"
+                ]
+            },
             "args": [],
             "cwd": "${workspaceFolder}",
             //"stopAtEntry": false,
@@ -107,7 +117,7 @@
             "env": {
                 "RUSTFS_ACCESS_KEY": "rustfsadmin",
                 "RUSTFS_SECRET_KEY": "rustfsadmin",
-                "RUSTFS_VOLUMES": "./target/volume/test{1...4}",
+                //"RUSTFS_VOLUMES": "./target/volume/test{1...4}",
                 "RUSTFS_ADDRESS": ":9000",
                 "RUSTFS_CONSOLE_ENABLE": "true",
                 // "RUSTFS_OBS_TRACE_ENDPOINT": "http://127.0.0.1:4318/v1/traces", // jeager otlp http endpoint
@@ -116,11 +126,31 @@
                 // "RUSTFS_COMPRESS_ENABLE": "true",
                 "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
                 "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
+                "RUST_LOG":"rustfs=debug,ecstore=debug,s3s=debug,iam=debug",
             },
             "sourceLanguages": [
                 "rust"
             ],
         },
+        {
+            "type": "lldb",
+            "request": "launch",
+            "name": "Debug test_lifecycle_transition_basic",
+            "cargo": {
+                "args": [
+                    "test",
+                    "-p",
+                    "rustfs-scanner",
+                    "--test",
+                    "lifecycle_integration_test",
+                    "serial_tests::test_lifecycle_transition_basic",
+                    "-j",
+                    "1"
+                ]
+            },
+            "args": [],
+            "cwd": "${workspaceFolder}"
+        },
         {
             "name": "Debug executable target/debug/test",
             "type":  "lldb",
@@ -140,6 +170,81 @@
             "sourceLanguages": [
                 "rust"
             ],
-        }
+        },
+        {
+            "name": "Debug executable target/debug/rustfs with sse",
+            "type":  "lldb",
+            "request": "launch",
+            "program": "${workspaceFolder}/target/debug/rustfs",
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            //"stopAtEntry": false,
+            //"preLaunchTask": "cargo build",
+            "env": {
+                "RUSTFS_ACCESS_KEY": "rustfsadmin",
+                "RUSTFS_SECRET_KEY": "rustfsadmin",
+                "RUSTFS_VOLUMES": "./target/volumes/test{1...4}",
+                "RUSTFS_ADDRESS": ":9000",
+                "RUSTFS_CONSOLE_ENABLE": "true",
+                "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
+                "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
+                // "RUSTFS_OBS_TRACE_ENDPOINT": "http://127.0.0.1:4318/v1/traces", // jeager otlp http endpoint
+                // "RUSTFS_OBS_METRIC_ENDPOINT": "http://127.0.0.1:4318/v1/metrics", // default otlp http endpoint
+                // "RUSTFS_OBS_LOG_ENDPOINT": "http://127.0.0.1:4318/v1/logs", // default otlp http endpoint
+                // "RUSTFS_COMPRESS_ENABLE": "true",
+
+                // 1. simple sse test key (no kms system)
+                // "__RUSTFS_SSE_SIMPLE_CMK": "2dfNXGHlsEflGVCxb+5DIdGEl1sIvtwX+QfmYasi5QM=",
+
+                // 2. kms local backend test key
+                "RUSTFS_KMS_ENABLE": "true",
+                "RUSTFS_KMS_BACKEND": "local",
+                "RUSTFS_KMS_KEY_DIR": "./target/kms-key-dir",
+                "RUSTFS_KMS_LOCAL_MASTER_KEY": "my-secret-key", // Some Password
+                "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
+
+                // 3. kms vault backend test key
+                // "RUSTFS_KMS_ENABLE": "true",
+                // "RUSTFS_KMS_BACKEND": "vault",
+                // "RUSTFS_KMS_VAULT_ADDRESS": "http://127.0.0.1:8200",
+                // "RUSTFS_KMS_VAULT_TOKEN": "Dev Token",
+                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
+
+            },
+            "sourceLanguages": [
+                "rust"
+            ],
+        },
+        {
+            "name": "E2E test executable target/debug/rustfs",
+            "type":  "lldb",
+            "request": "launch",
+            "program": "${workspaceFolder}/target/debug/rustfs",
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            //"stopAtEntry": false,
+            //"preLaunchTask": "cargo build",
+            "env": {
+                "RUST_LOG": "rustfs=debug,ecstore=info,s3s=debug,iam=debug",
+                "RUST_BACKTRACE": "full",
+                "RUSTFS_ACCESS_KEY": "rustfsadmin",
+                "RUSTFS_SECRET_KEY": "rustfsadmin",
+                "RUSTFS_VOLUMES": "./target/e2e-test/test{1...4}",
+                "RUSTFS_REGION": "us-east-1",
+                "RUSTFS_ADDRESS": ":9000",
+                "RUSTFS_CONSOLE_ENABLE": "true",
+                "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
+                "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
+
+                "RUSTFS_KMS_ENABLE": "true",
+                "RUSTFS_KMS_BACKEND": "local",
+                "RUSTFS_KMS_KEY_DIR": "./target/e2e-key-dir",
+                "RUSTFS_KMS_LOCAL_MASTER_KEY": "my-secret-key", // Some Password
+                "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
+            },
+            "sourceLanguages": [
+                "rust"
+            ],
+        },
     ]
 }

AGENTS.md

@@ -1,41 +1,67 @@
-# Repository Guidelines
+# RustFS Agent Instructions (Global)
+
+This root file keeps repository-wide rules only.
+Use the nearest subdirectory `AGENTS.md` for path-specific guidance.
+
+## Rule Precedence
+
+1. System/developer instructions.
+2. This file (global defaults).
+3. The nearest `AGENTS.md` in the current path (more specific scope wins).
+
+If repo-level instructions conflict, follow the nearest file and keep behavior aligned with CI.
+
+## Communication and Language
+
+- Respond in the same language used by the requester.
+- Keep source code, comments, commit messages, and PR title/body in English.
+
+## Sources of Truth
+
+- Workspace layout and crate membership: `Cargo.toml` (`[workspace].members`)
+- Local quality commands: `Makefile` and `.config/make/`
+- CI quality gates: `.github/workflows/ci.yml`
+- PR template: `.github/pull_request_template.md`
+
+Avoid duplicating long crate lists or command matrices in instruction files.
+Reference the source files above instead.
+
+## Mandatory Before Commit
+
+Run and pass:
 
-## ⚠️ Pre-Commit Checklist (MANDATORY)
-**Before EVERY commit, you MUST run and pass ALL of the following:**
 ```bash
-cargo fmt --all --check    # Code formatting
-cargo clippy --all-targets --all-features -- -D warnings  # Lints
-cargo test --workspace --exclude e2e_test  # Unit tests
+make pre-commit
 ```
-Or simply run `make pre-commit` which covers all checks. **DO NOT commit if any check fails.**
 
-## Communication Rules
-- Respond to the user in Chinese; use English in all other contexts.
-- Code and documentation must be written in English only. Chinese text is allowed solely as test data/fixtures when a case explicitly requires Chinese-language content for validation.
-- **Pull Request titles and descriptions must be written in English** to ensure consistency and accessibility for all contributors.
+If `make` is unavailable, run the equivalent checks defined under `.config/make/`.
+Do not commit when required checks fail.
 
-## Project Structure & Module Organization
-The workspace root hosts shared dependencies in `Cargo.toml`. The service binary lives under `rustfs/src/main.rs`, while reusable crates sit in `crates/` (`crypto`, `iam`, `kms`, and `e2e_test`). Local fixtures for standalone flows reside in `test_standalone/`, deployment manifests are under `deploy/`, Docker assets sit at the root, and automation lives in `scripts/`. Skim each crate’s README or module docs before contributing changes.
+## Git and PR Baseline
 
-## Build, Test, and Development Commands
-Run `cargo check --all-targets` for fast validation. Build release binaries via `cargo build --release` or the pipeline-aligned `make build`. Use `./build-rustfs.sh --dev` for iterative development and `./build-rustfs.sh --platform <target>` for cross-compiles. Prefer `make pre-commit` before pushing to cover formatting, clippy, checks, and tests.
-Always ensure `cargo fmt --all --check`, `cargo test --workspace --exclude e2e_test`, and `cargo clippy --all-targets --all-features -- -D warnings` complete successfully after each code change to keep the tree healthy and warning-free.
+- Use feature branches based on the latest `main`.
+- Follow Conventional Commits, with subject length <= 72 characters.
+- Keep PR title and description in English.
+- Use `.github/pull_request_template.md` and keep all section headings.
+- Use `N/A` for non-applicable template sections.
+- Include verification commands in the PR description.
+- When using `gh pr create`/`gh pr edit`, use `--body-file` instead of inline `--body` for multiline markdown.
 
-## Coding Style & Naming Conventions
-Formatting follows the repo `rustfmt.toml` (130-column width). Use `snake_case` for items, `PascalCase` for types, and `SCREAMING_SNAKE_CASE` for constants. Avoid `unwrap()` or `expect()` outside tests; bubble errors with `Result` and crate-specific `thiserror` types. Keep async code non-blocking and offload CPU-heavy work with `tokio::task::spawn_blocking` when necessary.
+## Security Baseline
 
-## Testing Guidelines
-Co-locate unit tests with their modules and give behavior-led names such as `handles_expired_token`. Integration suites belong in each crate’s `tests/` directory, while exhaustive end-to-end scenarios live in `crates/e2e_test/`. Run `cargo test --workspace --exclude e2e_test` during iteration, `cargo nextest run --all --exclude e2e_test` when available, and finish with `cargo test --all` before requesting review. Use `NO_PROXY=127.0.0.1,localhost HTTP_PROXY= HTTPS_PROXY=` for KMS e2e tests.
-When fixing bugs or adding features, include regression tests that capture the new behavior so future changes cannot silently break it.
+- Never commit secrets, credentials, or key material.
+- Use environment variables or vault tooling for sensitive configuration.
+- For localhost-sensitive tests, verify proxy settings to avoid traffic leakage.
 
-## Commit & Pull Request Guidelines
-Work on feature branches (e.g., `feat/...`) after syncing `main`. Follow Conventional Commits under 72 characters (e.g., `feat: add kms key rotation`). Each commit must compile, format cleanly, and pass `make pre-commit`. 
+## Scoped Guidance in This Repository
 
-**Pull Request Requirements:**
-- PR titles and descriptions **MUST be written in English**
-- Open PRs with a concise summary, note verification commands, link relevant issues
-- Follow the PR template format and fill in all required sections
-- Wait for reviewer approval before merging
-
-## Security & Configuration Tips
-Do not commit secrets or cloud credentials; prefer environment variables or vault tooling. Review IAM- and KMS-related changes with a second maintainer. Confirm proxy settings before running sensitive tests to avoid leaking traffic outside localhost.
+- `.github/AGENTS.md`
+- `crates/AGENTS.md`
+- `crates/config/AGENTS.md`
+- `crates/ecstore/AGENTS.md`
+- `crates/e2e_test/AGENTS.md`
+- `crates/iam/AGENTS.md`
+- `crates/kms/AGENTS.md`
+- `crates/policy/AGENTS.md`
+- `rustfs/src/admin/AGENTS.md`
+- `rustfs/src/storage/AGENTS.md`

CHANGELOG.md

@@ -0,0 +1,79 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Fixed
+- **Helm Ingress**: `customAnnotations` are now merged with class-specific annotations (nginx/traefik) instead of being ignored when `ingress.className` is set.
+
+### Added
+- **OpenStack Keystone Authentication Integration**: Full support for OpenStack Keystone authentication via X-Auth-Token headers
+  - Tower-based middleware (`KeystoneAuthLayer`) self-contained within `rustfs-keystone` crate
+  - Task-local storage for async-safe credential passing between middleware and auth handlers
+  - Automatic detection of Keystone credentials (access keys prefixed with `keystone:`)
+  - Role-based permission mapping (admin/reseller_admin roles grant owner permissions)
+  - Token caching for high-performance validation with configurable cache size and TTL
+  - Dual authentication support: Keystone and standard AWS Signature v4 work simultaneously
+  - Immediate 401 response for invalid tokens (no fallback to local auth)
+  - XML-formatted error responses compatible with S3 API
+  - Comprehensive integration documentation with manual testing guide
+  - **32 unit and integration tests** covering middleware, auth handlers, task-local storage, and role detection
+
+### Changed
+- **HTTP Server Stack**: Integrated `KeystoneAuthLayer` middleware from `rustfs-keystone` crate into service stack (positioned after ReadinessGateLayer)
+- **IAMAuth**: Enhanced `get_secret_key()` to return empty secret for Keystone credentials (bypasses signature validation)
+- **Auth Module**: Modified `check_key_valid()` to retrieve Keystone credentials from task-local storage and determine admin status
+
+### Technical Details
+- Middleware is self-contained in `rustfs-keystone` crate following the trusted-proxies pattern for integration-specific middleware
+- Uses `BoxBody` pattern for Hyper 1.x compatibility
+- Task-local storage provides request-scoped credential passing without modifying HTTP request/response types
+- Integration preserves existing S3 authentication flow while adding Keystone support
+- Zero breaking changes to existing functionality
+- No new top-level directories in main binary crate (middleware lives in integration crate)
+
+### Documentation
+- Updated `crates/keystone/README.md` with complete integration architecture and workflow
+- Added detailed manual testing guide with 10 test scenarios
+- Updated main `README.md` to list Keystone authentication as available feature
+- Added troubleshooting section for common integration issues
+
+### Configuration
+New environment variables:
+- `RUSTFS_KEYSTONE_ENABLE` - Enable/disable Keystone authentication (default: false)
+- `RUSTFS_KEYSTONE_AUTH_URL` - Keystone API endpoint URL
+- `RUSTFS_KEYSTONE_VERSION` - Keystone API version (v3)
+- `RUSTFS_KEYSTONE_ADMIN_USER` - Admin username for privileged operations
+- `RUSTFS_KEYSTONE_ADMIN_PASSWORD` - Admin password
+- `RUSTFS_KEYSTONE_ADMIN_PROJECT` - Admin project name
+- `RUSTFS_KEYSTONE_ADMIN_DOMAIN` - Admin domain name (default: Default)
+- `RUSTFS_KEYSTONE_CACHE_SIZE` - Token cache size (default: 10000)
+- `RUSTFS_KEYSTONE_CACHE_TTL` - Token cache TTL in seconds (default: 300)
+- `RUSTFS_KEYSTONE_VERIFY_SSL` - Verify SSL certificates (default: true)
+
+### Files Modified
+- `crates/keystone/src/middleware.rs` - Created Keystone authentication middleware (self-contained in keystone crate)
+- `crates/keystone/src/lib.rs` - Exported middleware module and KEYSTONE_CREDENTIALS
+- `crates/keystone/Cargo.toml` - Added Tower/HTTP dependencies for middleware functionality
+- `rustfs/src/server/http.rs` - Integrated KeystoneAuthLayer from rustfs-keystone crate
+- `rustfs/src/auth.rs` - Enhanced IAMAuth and check_key_valid for Keystone support, imported KEYSTONE_CREDENTIALS from rustfs-keystone
+- `crates/keystone/README.md` - Comprehensive integration documentation
+- `README.md` - Added Keystone as available feature
+
+### Testing
+- 16 unit tests in rustfs-keystone crate (config, auth, middleware, identity)
+- 10 integration tests in rustfs-keystone crate (task-local storage, middleware layer, scope isolation)
+- 6 auth unit tests in rustfs crate (role detection, task-local storage, Keystone credential handling)
+- **Total: 32 tests** passing with zero compilation errors
+- Manual testing guide provided for end-to-end validation
+- All tests passing with `cargo test --all --exclude e2e_test`
+
+---
+
+## Previous Releases
+
+See [GitHub Releases](https://github.com/rustfs/rustfs/releases) for previous version history.

CLA.md

@@ -1,85 +1,60 @@
-RustFS Individual Contributor License Agreement
+# RustFS Individual Contributor License Agreement
 
-Thank you for your interest in contributing documentation and related software code to a project hosted or managed by
-RustFS. In order to clarify the intellectual property license granted with Contributions from any person or entity,
-RustFS must have a Contributor License Agreement ("CLA") on file that has been signed by each Contributor, indicating
-agreement to the license terms below. This version of the Contributor License Agreement allows an individual to submit
-Contributions to the applicable project. If you are making a submission on behalf of a legal entity, then you should
-sign the separate Corporate Contributor License Agreement.
+Thank you for your interest in contributing to RustFS. In order to clarify the intellectual property license granted with Contributions from any person or entity, RustFS, Inc. ("RustFS") must have a Contributor License Agreement ("CLA") on file that has been signed by each Contributor, indicating agreement to the license terms below. This license is for your protection as a Contributor as well as the protection of RustFS and its users; it does not change your rights to use your own Contributions for any other purpose.
 
-You accept and agree to the following terms and conditions for Your present and future Contributions submitted to
-RustFS. You hereby irrevocably assign and transfer to RustFS all right, title, and interest in and to Your
-Contributions, including all copyrights and other intellectual property rights therein.
+You accept and agree to the following terms and conditions for Your present and future Contributions submitted to RustFS. Except for the license granted herein to RustFS and recipients of software distributed by RustFS, You reserve all right, title, and interest in and to Your Contributions.
 
-Definitions
+**You understand and agree that You will not receive any royalty or other compensation for Your Contributions.**
 
-“You” (or “Your”) shall mean the copyright owner or legal entity authorized by the copyright owner that is making this
-Agreement with RustFS. For legal entities, the entity making a Contribution and all other entities that control, are
-controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes
-of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such
-entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares,
-or (iii) beneficial ownership of such entity.
+## 1. Definitions
 
-“Contribution” shall mean any original work of authorship, including any modifications or additions to an existing work,
-that is intentionally submitted by You to RustFS for inclusion in, or documentation of, any of the products or projects
-owned or managed by RustFS (the "Work"), including without limitation any Work described in Schedule A. For the purposes
-of this definition, "submitted" means any form of electronic or written communication sent to RustFS or its
-representatives, including but not limited to communication on electronic mailing lists, source code control systems,
-and issue tracking systems that are managed by, or on behalf of, RustFS for the purpose of discussing and improving the
-Work.
+*   **"You"** (or **"Your"**) shall mean the copyright owner or legal entity authorized by the copyright owner that is making this Agreement with RustFS. For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
 
-Assignment of Copyright
+*   **"Contribution"** shall mean any original work of authorship, including any modifications or additions to an existing work, that is intentionally submitted by You to RustFS for inclusion in, or documentation of, any of the products or projects owned or managed by RustFS (the "Work"). For the purposes of this definition, "submitted" means any form of electronic or written communication sent to RustFS or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, RustFS for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by You as "Not a Contribution."
 
-Subject to the terms and conditions of this Agreement, You hereby irrevocably assign and transfer to RustFS all right,
-title, and interest in and to Your Contributions, including all copyrights and other intellectual property rights
-therein, for the entire term of such rights, including all renewals and extensions. You agree to execute all documents
-and take all actions as may be reasonably necessary to vest in RustFS the ownership of Your Contributions and to assist
-RustFS in perfecting, maintaining, and enforcing its rights in Your Contributions.
+## 2. Grant of Copyright License
 
-Grant of Patent License
+Subject to the terms and conditions of this Agreement, You hereby grant to RustFS and to recipients of software distributed by RustFS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works under any license, including proprietary or commercial licenses and open-source licenses, at RustFS's sole discretion.
 
-Subject to the terms and conditions of this Agreement, You hereby grant to RustFS and to recipients of documentation and
-software distributed by RustFS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as
-stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the
-Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your
-Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was
-submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or
-counterclaim in a lawsuit) alleging that your Contribution, or the Work to which you have contributed, constitutes
-direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for
-that Contribution or Work shall terminate as of the date such litigation is filed.
+## 3. Grant of Patent License
 
-You represent that you are legally entitled to grant the above assignment and license.
+Subject to the terms and conditions of this Agreement, You hereby grant to RustFS and to recipients of software distributed by RustFS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that your Contribution, or the Work to which you have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for that Contribution or Work shall terminate as of the date such litigation is filed.
 
-You represent that each of Your Contributions is Your original creation (see section 7 for submissions on behalf of
-others). You represent that Your Contribution submissions include complete details of any third-party license or other
-restriction (including, but not limited to, related patents and trademarks) of which you are personally aware and which
-are associated with any part of Your Contributions.
+## 4. Representations
 
-You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You
-may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You
-provide Your Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
-including, without limitation, any warranties or conditions of TITLE, NON- INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR
-A PARTICULAR PURPOSE.
+You represent that you are legally entitled to grant the above license. If your employer(s) has rights to intellectual property that you create that includes your Contributions, you represent that you have received permission to make Contributions on behalf of that employer, that your employer has waived such rights for your Contributions to RustFS, or that your employer has executed a separate Corporate CLA with RustFS.
 
-Should You wish to submit work that is not Your original creation, You may submit it to RustFS separately from any
-Contribution, identifying the complete details of its source and of any license or other restriction (including, but not
-limited to, related patents, trademarks, and license agreements) of which you are personally aware, and conspicuously
-marking the work as "Submitted on behalf of a third-party: [named here]”.
+You represent that each of Your Contributions is Your original creation. You represent that Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which you are personally aware and which are associated with any part of Your Contributions.
 
-You agree to notify RustFS of any facts or circumstances of which you become aware that would make these representations
-inaccurate in any respect.
+## 5. Support and Warranty
 
-Modification of CLA
+You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You provide Your Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of **TITLE**, **NON-INFRINGEMENT**, **MERCHANTABILITY**, or **FITNESS FOR A PARTICULAR PURPOSE**.
 
-RustFS reserves the right to update or modify this CLA in the future. Any updates or modifications to this CLA shall
-apply only to Contributions made after the effective date of the revised CLA. Contributions made prior to the update
-shall remain governed by the version of the CLA that was in effect at the time of submission. It is not necessary for
-all Contributors to re-sign the CLA when the CLA is updated or modified.
+## 6. Third-Party Work
 
-Governing Law and Dispute Resolution
+Should You wish to submit work that is not Your original creation, You may submit it to RustFS separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which you are personally aware, and conspicuously marking the work as "Submitted on behalf of a third-party: [named here]".
 
-This Agreement will be governed by and construed in accordance with the laws of the People's Republic of China excluding
-that body of laws known as conflict of laws. The parties expressly agree that the United Nations Convention on Contracts
-for the International Sale of Goods will not apply. Any legal action or proceeding arising under this Agreement will be
-brought exclusively in the courts located in Beijing, China, and the parties hereby irrevocably consent to the personal
-jurisdiction and venue therein.
+## 7. Governing Law and Jurisdiction
+
+This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of laws principles. The parties expressly agree that the United Nations Convention on Contracts for the International Sale of Goods will not apply. Any legal action or proceeding arising under or in connection with this Agreement shall be brought exclusively in the state or federal courts located in the State of Delaware, United States of America, and the parties hereby irrevocably consent to the personal jurisdiction and venue therein.
+
+## 8. Severability
+
+If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.
+
+## 9. Entire Agreement and Assignment
+
+This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements, understandings, negotiations, and discussions, whether written or oral. RustFS may assign its rights and obligations under this Agreement to any third party. You may not assign Your rights or obligations under this Agreement without the prior written consent of RustFS.
+
+---
+
+**Please read the terms of this Agreement carefully. By submitting a Contribution to RustFS, You agree to be bound by the terms and conditions of this Agreement.**
+
+| | |
+|---|---|
+| **Full Name** | __________________________________ |
+| **GitHub Username** | __________________________________ |
+| **Email Address** | __________________________________ |
+| **Date** | __________________________________ |
+
+*(Electronic signature or acknowledgement via GitHub commit/Pull Request constitutes valid acceptance of this Agreement).*

CLAUDE.md

@@ -1,275 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-RustFS is a high-performance distributed object storage software built with Rust, providing S3-compatible APIs and
-advanced features like data lakes, AI, and big data support. It's designed as an alternative to MinIO with better
-performance and a more business-friendly Apache 2.0 license.
-
-## Build Commands
-
-### Primary Build Commands
-
-- `cargo build --release` - Build the main RustFS binary
-- `./build-rustfs.sh` - Recommended build script that handles console resources and cross-platform compilation
-- `./build-rustfs.sh --dev` - Development build with debug symbols
-- `make build` or `just build` - Use Make/Just for standardized builds
-
-### Platform-Specific Builds
-
-- `./build-rustfs.sh --platform x86_64-unknown-linux-musl` - Build for musl target
-- `./build-rustfs.sh --platform aarch64-unknown-linux-gnu` - Build for ARM64
-- `make build-musl` or `just build-musl` - Build musl variant
-- `make build-cross-all` - Build all supported architectures
-
-### Testing Commands
-
-- `cargo test --workspace --exclude e2e_test` - Run unit tests (excluding e2e tests)
-- `cargo nextest run --all --exclude e2e_test` - Use nextest if available (faster)
-- `cargo test --all --doc` - Run documentation tests
-- `make test` or `just test` - Run full test suite
-- `make pre-commit` - Run all quality checks (fmt, clippy, check, test)
-
-### End-to-End Testing
-
-- `cargo test --package e2e_test` - Run all e2e tests
-- `./scripts/run_e2e_tests.sh` - Run e2e tests via script
-- `./scripts/run_scanner_benchmarks.sh` - Run scanner performance benchmarks
-
-### KMS-Specific Testing (with proxy bypass)
-
--
-`NO_PROXY=127.0.0.1,localhost HTTP_PROXY= HTTPS_PROXY= http_proxy= https_proxy= cargo test --package e2e_test test_local_kms_end_to_end -- --nocapture --test-threads=1` -
-Run complete KMS end-to-end test
--
-`NO_PROXY=127.0.0.1,localhost HTTP_PROXY= HTTPS_PROXY= http_proxy= https_proxy= cargo test --package e2e_test kms:: -- --nocapture --test-threads=1` -
-Run all KMS tests
-- `cargo test --package e2e_test test_local_kms_key_isolation -- --nocapture --test-threads=1` - Test KMS key isolation
-- `cargo test --package e2e_test test_local_kms_large_file -- --nocapture --test-threads=1` - Test KMS with large files
-
-### Code Quality
-
-- `cargo fmt --all` - Format code
-- `cargo clippy --all-targets --all-features -- -D warnings` - Lint code
-- `make pre-commit` or `just pre-commit` - Run all quality checks (fmt, clippy, check, test)
-
-### Quick Development Commands
-
-- `make help` or `just help` - Show all available commands with descriptions
-- `make help-build` - Show detailed build options and cross-compilation help
-- `make help-docker` - Show comprehensive Docker build and deployment options
-- `./scripts/dev_deploy.sh <IP>` - Deploy development build to remote server
-- `./scripts/run.sh` - Start local development server
-- `./scripts/probe.sh` - Health check and connectivity testing
-
-### Docker Build Commands
-
-- `make docker-buildx` - Build multi-architecture production images
-- `make docker-dev-local` - Build development image for local use
-- `./docker-buildx.sh --push` - Build and push production images
-
-## Architecture Overview
-
-### Core Components
-
-**Main Binary (`rustfs/`):**
-
-- Entry point at `rustfs/src/main.rs`
-- Core modules: admin, auth, config, server, storage, license management, profiling
-- HTTP server with S3-compatible APIs
-- Service state management and graceful shutdown
-- Parallel service initialization with DNS resolver, bucket metadata, and IAM
-
-**Key Crates (`crates/`):**
-
-- `ecstore` - Erasure coding storage implementation (core storage layer)
-- `iam` - Identity and Access Management
-- `kms` - Key Management Service for encryption and key handling
-- `madmin` - Management dashboard and admin API interface
-- `s3select-api` & `s3select-query` - S3 Select API and query engine
-- `config` - Configuration management with notify features
-- `crypto` - Cryptography and security features
-- `lock` - Distributed locking implementation
-- `filemeta` - File metadata management
-- `rio` - Rust I/O utilities and abstractions
-- `common` - Shared utilities and data structures
-- `protos` - Protocol buffer definitions
-- `audit-logger` - Audit logging for file operations
-- `notify` - Event notification system
-- `obs` - Observability utilities
-- `workers` - Worker thread pools and task scheduling
-- `appauth` - Application authentication and authorization
-- `ahm` - Asynchronous Hash Map for concurrent data structures
-- `mcp` - MCP server for S3 operations
-- `signer` - Client request signing utilities
-- `checksums` - Client checksum calculation utilities
-- `utils` - General utility functions and helpers
-- `zip` - ZIP file handling and compression
-- `targets` - Target-specific configurations and utilities
-
-### Build System
-
-- Cargo workspace with 25+ crates (including new KMS functionality)
-- Custom `build-rustfs.sh` script for advanced build options
-- Multi-architecture Docker builds via `docker-buildx.sh`
-- Both Make and Just task runners supported with comprehensive help
-- Cross-compilation support for multiple Linux targets
-- Automated CI/CD with GitHub Actions for testing, building, and Docker publishing
-- Performance benchmarking and audit workflows
-
-### Key Dependencies
-
-- `axum` - HTTP framework for S3 API server
-- `tokio` - Async runtime
-- `s3s` - S3 protocol implementation library
-- `datafusion` - For S3 Select query processing
-- `hyper`/`hyper-util` - HTTP client/server utilities
-- `rustls` - TLS implementation
-- `serde`/`serde_json` - Serialization
-- `tracing` - Structured logging and observability
-- `pprof` - Performance profiling with flamegraph support
-- `tikv-jemallocator` - Memory allocator for Linux GNU builds
-
-### Development Workflow
-
-- Console resources are embedded during build via `rust-embed`
-- Protocol buffers generated via custom `gproto` binary
-- E2E tests in separate crate (`e2e_test`) with comprehensive KMS testing
-- Shadow build for version/metadata embedding
-- Support for both GNU and musl libc targets
-- Development scripts in `scripts/` directory for common tasks
-- Git hooks setup available via `make setup-hooks` or `just setup-hooks`
-
-### Performance & Observability
-
-- Performance profiling available with `pprof` integration (disabled on Windows)
-- Profiling enabled via environment variables in production
-- Built-in observability with OpenTelemetry integration
-- Background services (scanner, heal) can be controlled via environment variables:
-    - `RUSTFS_ENABLE_SCANNER` (default: true)
-    - `RUSTFS_ENABLE_HEAL` (default: true)
-
-### Service Architecture
-
-- Service state management with graceful shutdown handling
-- Parallel initialization of core systems (DNS, bucket metadata, IAM)
-- Event notification system with MQTT and webhook support
-- Auto-heal and data scanner for storage integrity
-- Jemalloc allocator for Linux GNU targets for better performance
-
-## Environment Variables
-
-- `RUSTFS_ENABLE_SCANNER` - Enable/disable background data scanner (default: true)
-- `RUSTFS_ENABLE_HEAL` - Enable/disable auto-heal functionality (default: true)
-- Various profiling and observability controls
-- Build-time variables for Docker builds (RELEASE, REGISTRY, etc.)
-- Test environment configurations in `scripts/dev_rustfs.env`
-
-### KMS Environment Variables
-
-- `NO_PROXY=127.0.0.1,localhost` - Required for KMS E2E tests to bypass proxy
-- `HTTP_PROXY=` `HTTPS_PROXY=` `http_proxy=` `https_proxy=` - Clear proxy settings for local KMS testing
-
-## KMS (Key Management Service) Architecture
-
-### KMS Implementation Status
-
-- **Full KMS Integration:** Complete implementation with Local and Vault backends
-- **Automatic Configuration:** KMS auto-configures on startup with `--kms-enable` flag
-- **Encryption Support:** Full S3-compatible server-side encryption (SSE-S3, SSE-KMS, SSE-C)
-- **Admin API:** Complete KMS management via HTTP admin endpoints
-- **Production Ready:** Comprehensive testing including large files and key isolation
-
-### KMS Configuration
-
-- **Local Backend:** `--kms-backend local --kms-key-dir <path> --kms-default-key-id <id>`
-- **Vault Backend:** `--kms-backend vault --kms-vault-endpoint <url> --kms-vault-key-name <name>`
-- **Auto-startup:** KMS automatically initializes when `--kms-enable` is provided
-- **Manual Configuration:** Also supports dynamic configuration via admin API
-
-### S3 Encryption Support
-
-- **SSE-S3:** Server-side encryption with S3-managed keys (`ServerSideEncryption: AES256`)
-- **SSE-KMS:** Server-side encryption with KMS-managed keys (`ServerSideEncryption: aws:kms`)
-- **SSE-C:** Server-side encryption with customer-provided keys
-- **Response Headers:** All encryption types return correct `server_side_encryption` headers in PUT/GET responses
-
-### KMS Testing Architecture
-
-- **Comprehensive E2E Tests:** Located in `crates/e2e_test/src/kms/`
-- **Test Environments:** Automated test environment setup with temporary directories
-- **Encryption Coverage:** Tests all three encryption types (SSE-S3, SSE-KMS, SSE-C)
-- **API Coverage:** Tests all KMS admin APIs (CreateKey, DescribeKey, ListKeys, etc.)
-- **Edge Cases:** Key isolation, large file handling, error scenarios
-
-### Key Files for KMS
-
-- `crates/kms/` - Core KMS implementation with Local/Vault backends
-- `rustfs/src/main.rs` - KMS auto-initialization in `init_kms_system()`
-- `rustfs/src/storage/ecfs.rs` - SSE encryption/decryption in PUT/GET operations
-- `rustfs/src/admin/handlers/kms*.rs` - KMS admin endpoints
-- `crates/e2e_test/src/kms/` - Comprehensive KMS test suite
-- `crates/rio/src/encrypt_reader.rs` - Streaming encryption for large files
-
-## Code Style and Safety Requirements
-
-- **Language Requirements:**
-    - Communicate with me in Chinese, but **only English can be used in code files**
-    - Code comments, function names, variable names, and all text in source files must be in English only
-    - No Chinese characters, emojis, or non-ASCII characters are allowed in any source code files
-    - This includes comments, strings, documentation, and any other text within code files
-- **Safety-Critical Rules:**
-    - `unsafe_code = "deny"` enforced at workspace level
-    - Never use `unwrap()`, `expect()`, or panic-inducing code except in tests
-    - Avoid blocking I/O operations in async contexts
-    - Use proper error handling with `Result<T, E>` and `Option<T>`
-    - Follow Rust's ownership and borrowing rules strictly
-- **Performance Guidelines:**
-    - Use `cargo clippy --all-targets --all-features -- -D warnings` to catch issues
-    - Prefer `anyhow` for error handling in applications, `thiserror` for libraries
-    - Use appropriate async runtimes and avoid blocking calls
-- **Testing Standards:**
-    - All new features must include comprehensive tests
-    - Use `#[cfg(test)]` for test-only code that may use panic macros
-    - E2E tests should cover KMS integration scenarios
-
-## Common Development Tasks
-
-### Running KMS Tests Locally
-
-1. **Clear proxy settings:** KMS tests require direct localhost connections
-2. **Use serial execution:** `--test-threads=1` prevents port conflicts
-3. **Enable output:** `--nocapture` shows detailed test logs
-4. **Full command:**
-   `NO_PROXY=127.0.0.1,localhost HTTP_PROXY= HTTPS_PROXY= http_proxy= https_proxy= cargo test --package e2e_test test_local_kms_end_to_end -- --nocapture --test-threads=1`
-
-### KMS Development Workflow
-
-1. **Code changes:** Modify KMS-related code in `crates/kms/` or `rustfs/src/`
-2. **Compile:** Always run `cargo build` after changes
-3. **Test specific functionality:** Use targeted test commands for faster iteration
-4. **Full validation:** Run complete end-to-end tests before commits
-
-### Debugging KMS Issues
-
-- **Server startup:** Check that KMS auto-initializes with debug logs
-- **Encryption failures:** Verify SSE headers are correctly set in both PUT and GET responses
-- **Test failures:** Use `--nocapture` to see detailed error messages
-- **Key management:** Test admin API endpoints with proper authentication
-
-## Important Reminders
-
-- **Always compile after code changes:** Use `cargo build` to catch errors early
-- **Don't bypass tests:** All functionality must be properly tested, not worked around
-- **Use proper error handling:** Never use `unwrap()` or `expect()` in production code (except tests)
-- **Follow S3 compatibility:** Ensure all encryption types return correct HTTP response headers
-
-# important-instruction-reminders
-
-Do what has been asked; nothing more, nothing less.
-NEVER create files unless they're absolutely necessary for achieving your goal.
-ALWAYS prefer editing an existing file to creating a new one.
-NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly
-requested by the User.

Cargo.toml

@@ -17,6 +17,7 @@ members = [
     "rustfs", # Core file system implementation
     "crates/appauth", # Application authentication and authorization
     "crates/audit", # Audit target management system with multi-target fan-out
+    "crates/checksums", # client checksums
     "crates/common", # Shared utilities and data structures
     "crates/config", # Configuration management
     "crates/credentials", # Credential management system
@@ -24,38 +25,44 @@ members = [
     "crates/ecstore", # Erasure coding storage implementation
     "crates/e2e_test", # End-to-end test suite
     "crates/filemeta", # File metadata management
+    "crates/heal", # Erasure set and object healing
     "crates/iam", # Identity and Access Management
+    "crates/keystone", # OpenStack Keystone integration
+    "crates/kms", # Key Management Service
     "crates/lock", # Distributed locking implementation
     "crates/madmin", # Management dashboard and admin API interface
+    "crates/mcp", # MCP server for S3 operations
+    "crates/metrics", # Metrics collection and reporting
     "crates/notify", # Notification system for events
     "crates/obs", # Observability utilities
     "crates/policy", # Policy management
+    "crates/protocols", # Protocol implementations (FTPS, SFTP, etc.)
     "crates/protos", # Protocol buffer definitions
     "crates/rio", # Rust I/O utilities and abstractions
-    "crates/targets", # Target-specific configurations and utilities
+    "crates/s3-common", # Common utilities and data structures for S3 compatibility
     "crates/s3select-api", # S3 Select API interface
     "crates/s3select-query", # S3 Select query engine
+    "crates/scanner", # Scanner for data integrity checks and health monitoring
     "crates/signer", # client signer
-    "crates/checksums", # client checksums
+    "crates/targets", # Target-specific configurations and utilities
+    "crates/trusted-proxies", # Trusted proxies management
     "crates/utils", # Utility functions and helpers
     "crates/workers", # Worker thread pools and task scheduling
     "crates/zip", # ZIP file handling and compression
-    "crates/ahm", # Asynchronous Hash Map for concurrent data structures
-    "crates/mcp", # MCP server for S3 operations
-    "crates/kms", # Key Management Service
 ]
-resolver = "2"
+resolver = "3"
 
 [workspace.package]
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
-rust-version = "1.90"
+rust-version = "1.93.0"
 version = "0.0.5"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
 categories = ["web-programming", "development-tools", "filesystem", "network-programming"]
+authors = ["RustFS Team"]
 
 [workspace.lints.rust]
 unsafe_code = "deny"
@@ -66,7 +73,7 @@ all = "warn"
 [workspace.dependencies]
 # RustFS Internal Crates
 rustfs = { path = "./rustfs", version = "0.0.5" }
-rustfs-ahm = { path = "crates/ahm", version = "0.0.5" }
+rustfs-heal = { path = "crates/heal", version = "0.0.5" }
 rustfs-appauth = { path = "crates/appauth", version = "0.0.5" }
 rustfs-audit = { path = "crates/audit", version = "0.0.5" }
 rustfs-checksums = { path = "crates/checksums", version = "0.0.5" }
@@ -77,183 +84,191 @@ rustfs-crypto = { path = "crates/crypto", version = "0.0.5" }
 rustfs-ecstore = { path = "crates/ecstore", version = "0.0.5" }
 rustfs-filemeta = { path = "crates/filemeta", version = "0.0.5" }
 rustfs-iam = { path = "crates/iam", version = "0.0.5" }
+rustfs-keystone = { path = "crates/keystone", version = "0.0.5" }
 rustfs-kms = { path = "crates/kms", version = "0.0.5" }
 rustfs-lock = { path = "crates/lock", version = "0.0.5" }
 rustfs-madmin = { path = "crates/madmin", version = "0.0.5" }
 rustfs-mcp = { path = "crates/mcp", version = "0.0.5" }
+rustfs-metrics = { path = "crates/metrics", version = "0.0.5" }
 rustfs-notify = { path = "crates/notify", version = "0.0.5" }
 rustfs-obs = { path = "crates/obs", version = "0.0.5" }
 rustfs-policy = { path = "crates/policy", version = "0.0.5" }
 rustfs-protos = { path = "crates/protos", version = "0.0.5" }
 rustfs-rio = { path = "crates/rio", version = "0.0.5" }
+rustfs-s3-common = { path = "crates/s3-common", version = "0.0.5" }
 rustfs-s3select-api = { path = "crates/s3select-api", version = "0.0.5" }
 rustfs-s3select-query = { path = "crates/s3select-query", version = "0.0.5" }
+rustfs-scanner = { path = "crates/scanner", version = "0.0.5" }
 rustfs-signer = { path = "crates/signer", version = "0.0.5" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "0.0.5" }
 rustfs-targets = { path = "crates/targets", version = "0.0.5" }
 rustfs-utils = { path = "crates/utils", version = "0.0.5" }
 rustfs-workers = { path = "crates/workers", version = "0.0.5" }
 rustfs-zip = { path = "./crates/zip", version = "0.0.5" }
+rustfs-protocols = { path = "crates/protocols", version = "0.0.5" }
 
 # Async Runtime and Networking
 async-channel = "2.5.0"
-async-compression = { version = "0.4.19" }
+async-compression = { version = "0.4.41" }
 async-recursion = "1.1.1"
 async-trait = "0.1.89"
 axum = "0.8.8"
-axum-server = { version = "0.8.0", features = ["tls-rustls"], default-features = false }
-futures = "0.3.31"
-futures-core = "0.3.31"
-futures-util = "0.3.31"
+futures = "0.3.32"
+futures-core = "0.3.32"
+futures-util = "0.3.32"
 pollster = "0.4.0"
 hyper = { version = "1.8.1", features = ["http2", "http1", "server"] }
 hyper-rustls = { version = "0.27.7", default-features = false, features = ["native-tokio", "http1", "tls12", "logging", "http2", "aws-lc-rs", "webpki-roots"] }
-hyper-util = { version = "0.1.19", features = ["tokio", "server-auto", "server-graceful"] }
+hyper-util = { version = "0.1.20", features = ["tokio", "server-auto", "server-graceful", "tracing"] }
 http = "1.4.0"
 http-body = "1.0.1"
 http-body-util = "0.1.3"
-reqwest = { version = "0.12.28", default-features = false, features = ["rustls-tls-no-provider", "charset", "http2", "system-proxy", "stream", "json", "blocking"] }
-socket2 = "0.6.1"
-tokio = { version = "1.49.0", features = ["fs", "rt-multi-thread"] }
+reqwest = { version = "0.13.2", default-features = false, features = ["rustls", "charset", "http2", "system-proxy", "stream", "json", "blocking", "query", "form"] }
+socket2 = { version = "0.6.3", features = ["all"] }
+tokio = { version = "1.50.0", features = ["fs", "rt-multi-thread"] }
 tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "tls12", "aws-lc-rs"] }
 tokio-stream = { version = "0.1.18" }
 tokio-test = "0.4.5"
 tokio-util = { version = "0.7.18", features = ["io", "compat"] }
-tonic = { version = "0.14.2", features = ["gzip"] }
-tonic-prost = { version = "0.14.2" }
-tonic-prost-build = { version = "0.14.2" }
-tower = { version = "0.5.2", features = ["timeout"] }
+tonic = { version = "0.14.5", features = ["gzip"] }
+tonic-prost = { version = "0.14.5" }
+tonic-prost-build = { version = "0.14.5" }
+tower = { version = "0.5.3", features = ["timeout"] }
 tower-http = { version = "0.6.8", features = ["cors"] }
 
 # Serialization and Data Formats
-bytes = { version = "1.11.0", features = ["serde"] }
+bytes = { version = "1.11.1", features = ["serde"] }
 bytesize = "2.3.1"
 byteorder = "1.5.0"
 flatbuffers = "25.12.19"
 form_urlencoded = "1.2.2"
-prost = "0.14.1"
-quick-xml = "0.38.4"
-rmcp = { version = "0.12.0" }
+prost = "0.14.3"
+quick-xml = "0.39.2"
+rmcp = { version = "1.2.0" }
 rmp = { version = "0.8.15" }
 rmp-serde = { version = "1.3.1" }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.149", features = ["raw_value"] }
 serde_urlencoded = "0.7.1"
-schemars = "1.2.0"
+schemars = "1.2.1"
 
 # Cryptography and Security
-aes-gcm = { version = "0.11.0-rc.2", features = ["rand_core"] }
-argon2 = { version = "0.6.0-rc.5" }
-blake3 = { version = "1.8.2", features = ["rayon", "mmap"] }
-chacha20poly1305 = { version = "0.11.0-rc.2" }
-crc-fast = "1.6.0"
-hmac = { version = "0.13.0-rc.3" }
-jsonwebtoken = { version = "10.2.0", features = ["rust_crypto"] }
-pbkdf2 = "0.13.0-rc.5"
-rsa = { version = "0.10.0-rc.11" }
-rustls = { version = "0.23.36", default-features = false, features = ["aws-lc-rs", "logging", "tls12", "prefer-post-quantum", "std"] }
-rustls-pemfile = "2.2.0"
-rustls-pki-types = "1.13.2"
-sha1 = "0.11.0-rc.3"
-sha2 = "0.11.0-rc.3"
+aes-gcm = { version = "0.11.0-rc.3", features = ["rand_core"] }
+argon2 = { version = "0.6.0-rc.7" }
+blake3 = { version = "1.8.3", features = ["rayon", "mmap"] }
+chacha20poly1305 = { version = "0.11.0-rc.3" }
+crc-fast = "1.9.0"
+hmac = { version = "0.13.0-rc.5" }
+jsonwebtoken = { version = "10.3.0", features = ["aws_lc_rs"] }
+openidconnect = { version = "4.0", default-features = false }
+pbkdf2 = "0.13.0-rc.9"
+rsa = { version = "0.10.0-rc.17" }
+rustls = { version = "0.23.37", default-features = false, features = ["aws-lc-rs", "logging", "tls12", "prefer-post-quantum", "std"] }
+rustls-pki-types = "1.14.0"
+sha1 = "0.11.0-rc.5"
+sha2 = "0.11.0-rc.5"
 subtle = "2.6"
 zeroize = { version = "1.8.2", features = ["derive"] }
 
 # Time and Date
-chrono = { version = "0.4.42", features = ["serde"] }
+chrono = { version = "0.4.44", features = ["serde"] }
 humantime = "2.3.0"
-time = { version = "0.3.44", features = ["std", "parsing", "formatting", "macros", "serde"] }
+jiff = { version = "0.2.23", features = ["serde"] }
+time = { version = "0.3.47", features = ["std", "parsing", "formatting", "macros", "serde"] }
 
 # Utilities and Tools
-anyhow = "1.0.100"
-arc-swap = "1.8.0"
+anyhow = "1.0.102"
+arc-swap = "1.8.2"
 astral-tokio-tar = "0.5.6"
 atoi = "2.0.0"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.8.12" }
-aws-credential-types = { version = "1.2.11" }
-aws-sdk-s3 = { version = "1.119.0", default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
-aws-smithy-types = { version = "1.3.5" }
+aws-config = { version = "1.8.15" }
+aws-credential-types = { version = "1.2.14" }
+aws-sdk-s3 = { version = "1.126.0", default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
+aws-smithy-http-client = { version = "1.1.12", default-features = false, features = ["default-client", "rustls-aws-lc"] }
+aws-smithy-types = { version = "1.4.6" }
+backtrace = "0.3.76"
 base64 = "0.22.1"
 base64-simd = "0.8.0"
 brotli = "8.0.2"
 cfg-if = "1.0.4"
-clap = { version = "4.5.54", features = ["derive", "env"] }
-const-str = { version = "1.0.0", features = ["std", "proc"] }
-convert_case = "0.10.0"
+clap = { version = "4.6.0", features = ["derive", "env"] }
+const-str = { version = "1.1.0", features = ["std", "proc"] }
+convert_case = "0.11.0"
 criterion = { version = "0.8", features = ["html_reports"] }
 crossbeam-queue = "0.3.12"
-datafusion = "51.0.0"
+datafusion = "52.3.0"
 derive_builder = "0.20.2"
 enumset = "1.1.10"
 faster-hex = "0.10.0"
-flate2 = "1.1.5"
-flexi_logger = { version = "0.31.7", features = ["trc", "dont_minimize_extra_stacks", "compress", "kv", "json"] }
+flate2 = "1.1.9"
 glob = "0.3.3"
-google-cloud-storage = "1.5.0"
-google-cloud-auth = "1.3.0"
+google-cloud-storage = "1.9.0"
+google-cloud-auth = "1.7.0"
 hashbrown = { version = "0.16.1", features = ["serde", "rayon"] }
-heed = { version = "0.22.0" }
+hex = "0.4.3"
 hex-simd = "0.8.0"
 highway = { version = "1.3.0" }
 ipnetwork = { version = "0.21.1", features = ["serde"] }
 lazy_static = "1.5.0"
-libc = "0.2.179"
+libc = "0.2.183"
 libsystemd = "0.7.2"
-local-ip-address = "0.6.8"
+local-ip-address = "0.6.10"
 lz4 = "1.28.1"
 matchit = "0.9.1"
-md-5 = "0.11.0-rc.3"
+md-5 = "0.11.0-rc.5"
 md5 = "0.8.0"
 mime_guess = "2.0.5"
-moka = { version = "0.12.12", features = ["future"] }
+moka = { version = "0.12.14", features = ["future"] }
 netif = "0.1.6"
-nix = { version = "0.30.1", features = ["fs"] }
-nu-ansi-term = "0.50.3"
 num_cpus = { version = "1.17.0" }
-nvml-wrapper = "0.11.0"
-object_store = "0.12.4"
+nvml-wrapper = "0.12.0"
+object_store = "0.12.5"
 parking_lot = "0.12.5"
 path-absolutize = "3.1.1"
 path-clean = "1.0.1"
-pin-project-lite = "0.2.16"
+percent-encoding = "2.3.2"
+pin-project-lite = "0.2.17"
 pretty_assertions = "1.4.1"
-rand = { version = "0.10.0-rc.6", features = ["serde"] }
+rand = { version = "0.10.0", features = ["serde"] }
+ratelimit = "0.10.0"
 rayon = "1.11.0"
 reed-solomon-simd = { version = "3.1.0" }
-regex = { version = "1.12.2" }
+regex = { version = "1.12.3" }
 rumqttc = { version = "0.25.1" }
-rust-embed = { version = "8.9.0" }
+rustix = { version = "1.1.4", features = ["fs"] }
+rust-embed = { version = "8.11.0" }
 rustc-hash = { version = "2.1.1" }
-s3s = { version = "0.13.0-alpha", features = ["minio"], git = "https://github.com/s3s-project/s3s.git", branch = "main" }
-serial_test = "3.3.1"
-shadow-rs = { version = "1.5.0", default-features = false }
-siphasher = "1.0.1"
+s3s = { git = "https://github.com/s3s-project/s3s", rev = "c2dc7b16535659904d4efff52c558fc039be1ef3", features = ["minio"] }
+serial_test = "3.4.0"
+shadow-rs = { version = "1.7.1", default-features = false }
+siphasher = "1.0.2"
 smallvec = { version = "1.15.1", features = ["serde"] }
 smartstring = "1.0.1"
-snafu = "0.8.9"
+snafu = "0.9.0"
 snap = "1.1.1"
-starshard = { version = "0.6.0", features = ["rayon", "async", "serde"] }
-strum = { version = "0.27.2", features = ["derive"] }
-sysinfo = "0.37.2"
+starshard = { version = "1.1.0", features = ["rayon", "async", "serde"] }
+strum = { version = "0.28.0", features = ["derive"] }
+sysinfo = "0.38.4"
 temp-env = "0.3.6"
-tempfile = "3.24.0"
+tempfile = "3.27.0"
 test-case = "3.3.1"
-thiserror = "2.0.17"
+thiserror = "2.0.18"
 tracing = { version = "0.1.44" }
 tracing-appender = "0.2.4"
 tracing-error = "0.2.1"
-tracing-opentelemetry = "0.32.0"
-tracing-subscriber = { version = "0.3.22", features = ["env-filter", "time"] }
+tracing-opentelemetry = "0.32.1"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter", "time"] }
 transform-stream = "0.3.1"
 url = "2.5.8"
 urlencoding = "2.1.3"
-uuid = { version = "1.19.0", features = ["v4", "fast-rng", "macro-diagnostics"] }
+uuid = { version = "1.22.0", features = ["v4", "fast-rng", "macro-diagnostics"] }
 vaultrs = { version = "0.7.4" }
 walkdir = "2.5.0"
 wildmatch = { version = "2.6.1", features = ["serde"] }
-winapi = { version = "0.3.9" }
+windows = { version = "0.62.2" }
 xxhash-rust = { version = "0.8.15", features = ["xxh64", "xxh3"] }
-zip = "7.0.0"
+zip = "8.2.0"
 zstd = "0.13.3"
 
 # Observability and Metrics
@@ -264,14 +279,16 @@ opentelemetry-otlp = { version = "0.31.0", features = ["gzip-http", "reqwest-rus
 opentelemetry_sdk = { version = "0.31.0" }
 opentelemetry-semantic-conventions = { version = "0.31.0", features = ["semconv_experimental"] }
 opentelemetry-stdout = { version = "0.31.0" }
+pyroscope = { version = "2.0.0", features = ["backend-pprof-rs"] }
 
 # FTP and SFTP
-libunftp = "0.21.0"
-russh = { version = "0.56.0", features = ["aws-lc-rs", "rsa"], default-features = false }
-russh-sftp = "2.1.1"
-ssh-key = { version = "0.7.0-rc.4", features = ["std", "rsa", "ed25519"] }
-suppaftp = { version = "7.0.7", features = ["tokio", "tokio-rustls", "rustls"] }
-rcgen = "0.14.6"
+libunftp = { version = "0.23.0", features = ["experimental"] }
+unftp-core = "0.1.0"
+suppaftp = { version = "8.0.2", features = ["tokio", "tokio-rustls-aws-lc-rs"] }
+rcgen = "0.14.7"
+
+# WebDAV
+dav-server = "0.11.0"
 
 # Performance Analysis and Memory Profiling
 mimalloc = "0.1"
@@ -280,9 +297,11 @@ tikv-jemallocator = { version = "0.6", features = ["profiling", "stats", "unpref
 # Used to control and obtain statistics for jemalloc at runtime
 tikv-jemalloc-ctl = { version = "0.6", features = ["use_std", "stats", "profiling"] }
 # Used to generate pprof-compatible memory profiling data and support symbolization and flame graphs
-jemalloc_pprof = { version = "0.8.1", features = ["symbolize", "flamegraph"] }
+jemalloc_pprof = { version = "0.8.2", features = ["symbolize", "flamegraph"] }
 # Used to generate CPU performance analysis data and flame diagrams
-pprof = { version = "0.15.0", features = ["flamegraph", "protobuf-codec"] }
+# pprof = { version = "0.15.0", features = ["flamegraph", "protobuf-codec"] }
+# Pyroscope uses a patched pprof, until they merge back upstream, replace all references. Otherwise, two pprof libs with symbol collision.
+pprof = { package = "pprof-pyroscope-fork", version = "0.1500.3", features = ["flamegraph", "protobuf-codec"] }
 
 [workspace.metadata.cargo-shear]
 ignored = ["rustfs", "rustfs-mcp"]

Dockerfile

@@ -1,3 +1,17 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 FROM alpine:3.23 AS build
 
 ARG TARGETARCH
@@ -77,11 +91,12 @@ ENV RUSTFS_ADDRESS=":9000" \
     RUSTFS_ACCESS_KEY="rustfsadmin" \
     RUSTFS_SECRET_KEY="rustfsadmin" \
     RUSTFS_CONSOLE_ENABLE="true" \
-    RUSTFS_EXTERNAL_ADDRESS="" \
     RUSTFS_CORS_ALLOWED_ORIGINS="*" \
     RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
     RUSTFS_VOLUMES="/data" \
-    RUST_LOG="warn"
+    RUSTFS_OBS_LOGGER_LEVEL=warn \
+    RUSTFS_OBS_LOG_DIRECTORY=/logs \
+    RUSTFS_OBS_ENVIRONMENT=production
     
 EXPOSE 9000 9001
 

Dockerfile.glibc

@@ -0,0 +1,115 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM ubuntu:24.04 AS build
+
+ARG TARGETARCH
+ARG RELEASE=latest
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+RUN set -eux; \
+    case "$TARGETARCH" in \
+      amd64)  ARCH_SUBSTR="x86_64-gnu"  ;; \
+      arm64)  ARCH_SUBSTR="aarch64-gnu" ;; \
+      *) echo "Unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+    esac; \
+    \
+    if [ "$RELEASE" = "latest" ]; then \
+      TAG="$(curl -fsSL https://api.github.com/repos/rustfs/rustfs/releases \
+              | grep -o '"tag_name": "[^"]*"' | cut -d'"' -f4 | head -n 1)"; \
+    else \
+      TAG="$RELEASE"; \
+    fi; \
+    \
+    URL="$(curl -fsSL "https://api.github.com/repos/rustfs/rustfs/releases/tags/$TAG" \
+           | grep -o "\"browser_download_url\": \"[^\"]*${ARCH_SUBSTR}[^\"]*\\.zip\"" \
+           | cut -d'"' -f4 | head -n 1)"; \
+    \
+    if [ -z "$URL" ]; then echo "Failed to locate release asset for $ARCH_SUBSTR at tag $TAG" >&2; exit 1; fi; \
+    \
+    curl -fL "$URL" -o rustfs.zip; \
+    unzip -q rustfs.zip -d /build; \
+    \
+    if [ ! -x /build/rustfs ]; then \
+      BIN_PATH="$(unzip -Z -1 rustfs.zip | grep -E '(^|/)rustfs$' | head -n 1 || true)"; \
+      if [ -n "$BIN_PATH" ]; then \
+        mkdir -p /build/.tmp && unzip -q rustfs.zip "$BIN_PATH" -d /build/.tmp && \
+        mv "/build/.tmp/$BIN_PATH" /build/rustfs; \
+      fi; \
+    fi; \
+    [ -x /build/rustfs ] || { echo "rustfs binary not found in asset" >&2; exit 1; }; \
+    chmod +x /build/rustfs; \
+    rm -rf rustfs.zip /build/.tmp || true
+
+FROM ubuntu:24.04
+
+ARG RELEASE=latest
+ARG BUILD_DATE
+ARG VCS_REF
+
+LABEL name="RustFS" \
+      vendor="RustFS Team" \
+      maintainer="RustFS Team <dev@rustfs.com>" \
+      version="v${RELEASE#v}" \
+      release="${RELEASE}" \
+      build-date="${BUILD_DATE}" \
+      vcs-ref="${VCS_REF}" \
+      summary="High-performance distributed object storage system (glibc)" \
+      url="https://rustfs.com" \
+      license="Apache-2.0"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /build/rustfs /usr/bin/rustfs
+COPY entrypoint.sh /entrypoint.sh
+
+RUN chmod +x /usr/bin/rustfs /entrypoint.sh
+
+RUN groupadd -g 10001 rustfs && \
+    useradd -u 10001 -g rustfs -m -s /sbin/nologin rustfs && \
+    mkdir -p /data /logs && \
+    chown -R rustfs:rustfs /data /logs && \
+    chmod 0750 /data /logs
+
+ENV RUSTFS_ADDRESS=":9000" \
+    RUSTFS_CONSOLE_ADDRESS=":9001" \
+    RUSTFS_ACCESS_KEY="rustfsadmin" \
+    RUSTFS_SECRET_KEY="rustfsadmin" \
+    RUSTFS_CONSOLE_ENABLE="true" \
+    RUSTFS_CORS_ALLOWED_ORIGINS="*" \
+    RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
+    RUSTFS_VOLUMES="/data" \
+    RUSTFS_OBS_LOGGER_LEVEL=warn \
+    RUSTFS_OBS_LOG_DIRECTORY=/logs \
+    RUSTFS_OBS_ENVIRONMENT=production
+    
+EXPOSE 9000 9001
+
+VOLUME ["/data"]
+
+USER rustfs
+
+ENTRYPOINT ["/entrypoint.sh"]
+
+CMD ["rustfs"]

Dockerfile.source

@@ -1,4 +1,18 @@
 # syntax=docker/dockerfile:1.6
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # Multi-stage Dockerfile for RustFS - LOCAL DEVELOPMENT ONLY
 #
 # IMPORTANT: This Dockerfile builds RustFS from source for local development and testing.
@@ -83,6 +97,10 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 # 3) copy full sources (this is the main cache invalidation point)
 COPY . .
 
+# Generate static files
+
+RUN ./scripts/static.sh
+
 # Cargo build configuration for lean release artifacts
 ENV CARGO_NET_GIT_FETCH_WITH_CLI=true \
     CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse \

README.md

@@ -1,4 +1,4 @@
-[![RustFS](https://rustfs.com/images/rustfs-github.png)](https://rustfs.com)
+[![RustFS](https://repository-images.githubusercontent.com/722597620/0fa936a2-8164-4f53-867f-def4beb64b21)](https://rustfs.com)
 
 <p align="center">RustFS is a high-performance, distributed object storage system built in Rust.</p>
 
@@ -11,10 +11,10 @@
 </p>
 
 <p align="center">
-<a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://trendshift.io/api/badge/repositories/14181" alt="rustfs%2Frustfs | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+<a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://trendshift.io/api/badge/repositories/14181" alt="rustfs%2Frustfs | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a> 
+<a href="https://runacap.com/ross-index/q4-2025/" target="_blank" rel="noopener"><img style="width: 260px; height: 55px" src="https://runacap.com/wp-content/uploads/2026/01/ROSS_badge_white_Q4_2025.svg" alt="ROSS Index - Fastest Growing Open-Source Startups in Q4 2025 | Runa Capital" height="55" /></a>
 </p>
 
-
 <p align="center">
   <a href="https://docs.rustfs.com/installation/">Getting Started</a>
   · <a href="https://docs.rustfs.com/">Docs</a>
@@ -42,28 +42,29 @@ Unlike other storage systems, RustFS is released under the permissible Apache 2.
 - **High Performance**: Built with Rust to ensure maximum speed and resource efficiency.
 - **Distributed Architecture**: Scalable and fault-tolerant design suitable for large-scale deployments.
 - **S3 Compatibility**: Seamless integration with existing S3-compatible applications and tools.
+- **OpenStack Swift API**: Native support for Swift protocol with Keystone authentication.
+- **OpenStack Keystone Integration**: Native support for OpenStack Keystone authentication with X-Auth-Token headers.
 - **Data Lake Support**: Optimized for high-throughput big data and AI workloads.
 - **Open Source**: Licensed under Apache 2.0, encouraging unrestricted community contributions and commercial usage.
 - **User-Friendly**: Designed with simplicity in mind for easy deployment and management.
 
-| Feature | Status | Feature | Status |
-| :--- | :--- | :--- | :--- |
-| **S3 Core Features** | ✅ Available | **Bitrot Protection** | ✅ Available |
-| **Upload / Download** | ✅ Available | **Single Node Mode** | ✅ Available |
-| **Versioning** | ✅ Available |  **Bucket Replication** | ✅ Available |
-| **Logging** | ✅ Available |  **Lifecycle Management** | 🚧 Under Testing |
-| **Event Notifications** | ✅ Available |  **Distributed Mode** | 🚧 Under Testing |
-| **K8s Helm Charts** | ✅ Available |   **RustFS KMS** | 🚧 Under Testing | 
-
-
-
+| Feature                 | Status       | Feature                  | Status           |
+| :---------------------- | :----------- | :----------------------- | :--------------- |
+| **S3 Core Features**    | ✅ Available | **Bitrot Protection**    | ✅ Available     |
+| **Upload / Download**   | ✅ Available | **Single Node Mode**     | ✅ Available     |
+| **Versioning**          | ✅ Available | **Bucket Replication**   | ✅ Available     |
+| **Logging**             | ✅ Available | **Lifecycle Management** | 🚧 Under Testing |
+| **Event Notifications** | ✅ Available | **Distributed Mode**     | 🚧 Under Testing |
+| **K8s Helm Charts**     | ✅ Available | **RustFS KMS**           | 🚧 Under Testing |
+| **Keystone Auth**       | ✅ Available | **Multi-Tenancy**        | ✅ Available     |
+| **Swift API**           | ✅ Available | **Swift Metadata Ops**   | 🚧 Partial       |
 
 ## RustFS vs MinIO Performance
 
 **Stress Test Environment:**
 
 | Type    | Parameter | Remark                                                   |
-|---------|-----------|----------------------------------------------------------|
+| ------- | --------- | -------------------------------------------------------- |
 | CPU     | 2 Core    | Intel Xeon (Sapphire Rapids) Platinum 8475B, 2.7/3.2 GHz |
 | Memory  | 4GB       |                                                          |
 | Network | 15Gbps    |                                                          |
@@ -73,15 +74,21 @@ Unlike other storage systems, RustFS is released under the permissible Apache 2.
 
 ### RustFS vs Other Object Storage
 
-| Feature | RustFS | Other Object Storage |
-| :--- | :--- | :--- |
-| **Console Experience** | **Powerful Console**<br>Comprehensive management interface. | **Basic / Limited Console**<br>Often overly simple or lacking critical features. |
-| **Language & Safety** | **Rust-based**<br>Memory safety by design. | **Go or C-based**<br>Potential for memory GC pauses or leaks. |
-| **Data Sovereignty** | **No Telemetry / Full Compliance**<br>Guards against unauthorized cross-border data egress. Compliant with GDPR (EU/UK), CCPA (US), and APPI (Japan). | **Potential Risk**<br>Possible legal exposure and unwanted data telemetry. |
-| **Licensing** | **Permissive Apache 2.0**<br>Business-friendly, no "poison pill" clauses. | **Restrictive AGPL v3**<br>Risk of license traps and intellectual property pollution. |
-| **Compatibility** | **100% S3 Compatible**<br>Works with any cloud provider or client, anywhere. | **Variable Compatibility**<br>May lack support for local cloud vendors or specific APIs. |
-| **Edge & IoT** | **Strong Edge Support**<br>Ideal for secure, innovative edge devices. | **Weak Edge Support**<br>Often too heavy for edge gateways. |
-| **Risk Profile** | **Enterprise Risk Mitigation**<br>Clear IP rights and safe for commercial use. | **Legal Risks**<br>Intellectual property ambiguity and usage restrictions. |
+| Feature                | RustFS                                                                                                                                                | Other Object Storage                                                                     |
+| :--------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------- |
+| **Console Experience** | **Powerful Console**<br>Comprehensive management interface.                                                                                           | **Basic / Limited Console**<br>Often overly simple or lacking critical features.         |
+| **Language & Safety**  | **Rust-based**<br>Memory safety by design.                                                                                                            | **Go or C-based**<br>Potential for memory GC pauses or leaks.                            |
+| **Data Sovereignty**   | **No Telemetry / Full Compliance**<br>Guards against unauthorized cross-border data egress. Compliant with GDPR (EU/UK), CCPA (US), and APPI (Japan). | **Potential Risk**<br>Possible legal exposure and unwanted data telemetry.               |
+| **Licensing**          | **Permissive Apache 2.0**<br>Business-friendly, no "poison pill" clauses.                                                                             | **Restrictive AGPL v3**<br>Risk of license traps and intellectual property pollution.    |
+| **Compatibility**      | **100% S3 Compatible**<br>Works with any cloud provider or client, anywhere.                                                                          | **Variable Compatibility**<br>May lack support for local cloud vendors or specific APIs. |
+| **Edge & IoT**         | **Strong Edge Support**<br>Ideal for secure, innovative edge devices.                                                                                 | **Weak Edge Support**<br>Often too heavy for edge gateways.                              |
+| **Risk Profile**       | **Enterprise Risk Mitigation**<br>Clear IP rights and safe for commercial use.                                                                        | **Legal Risks**<br>Intellectual property ambiguity and usage restrictions.               |
+
+## Staying ahead
+
+Star RustFS on GitHub and be instantly notified of new releases.
+
+<img src="https://github.com/user-attachments/assets/7ee40bb4-3e46-4eac-b0d0-5fbeb85ff8f3" />
 
 ## Quickstart
 
@@ -89,9 +96,9 @@ To get started with RustFS, follow these steps:
 
 ### 1. One-click Installation (Option 1)
 
-  ```bash
-  curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
-````
+```bash
+curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
+```
 
 ### 2\. Docker Quick Start (Option 2)
 
@@ -111,12 +118,24 @@ The RustFS container runs as a non-root user `rustfs` (UID `10001`). If you run
  docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-alpha.76
 ```
 
+If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
+
+```bash
+ podman run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
+```
+
 You can also use Docker Compose. Using the `docker-compose.yml` file in the root directory:
 
 ```bash
 docker compose --profile observability up -d
 ```
 
+Similarly, you can run the command with podman
+
+```bash
+podman compose --profile observability up -d
+```
+
 **NOTE**: We recommend reviewing the `docker-compose.yaml` file before running. It defines several services including Grafana, Prometheus, and Jaeger, which are helpful for RustFS observability. If you wish to start Redis or Nginx containers, you can specify the corresponding profiles.
 
 ### 3\. Build from Source (Option 3) - Advanced Users
@@ -138,10 +157,11 @@ For developers who want to build RustFS Docker images from source with multi-arc
 ```
 
 The `docker-buildx.sh` script supports:
-\- **Multi-architecture builds**: `linux/amd64`, `linux/arm64`
-\- **Automatic version detection**: Uses git tags or commit hashes
-\- **Registry flexibility**: Supports Docker Hub, GitHub Container Registry, etc.
-\- **Build optimization**: Includes caching and parallel builds
+
+- **Multi-architecture builds**: `linux/amd64`, `linux/arm64`
+- **Automatic version detection**: Uses git tags or commit hashes
+- **Registry flexibility**: Supports Docker Hub, GitHub Container Registry, etc.
+- **Build optimization**: Includes caching and parallel builds
 
 You can also use Make targets for convenience:
 
@@ -175,14 +195,14 @@ nix build
 nix run
 ```
 
------
+---
 
 ### Accessing RustFS
 
-5.  **Access the Console**: Open your web browser and navigate to `http://localhost:9001` to access the RustFS console.
-      * Default credentials: `rustfsadmin` / `rustfsadmin`
-6.  **Create a Bucket**: Use the console to create a new bucket for your objects.
-7.  **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs/clients to interact with your RustFS instance.
+1. **Access the Console**: Open your web browser and navigate to `http://localhost:9001` to access the RustFS console.
+    - Default credentials: `rustfsadmin` / `rustfsadmin`
+2. **Create a Bucket**: Use the console to create a new bucket for your objects.
+3. **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs/clients to interact with your RustFS instance.
 
 **NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured.html).
 
@@ -194,23 +214,23 @@ For detailed documentation, including configuration options, API references, and
 
 If you have any questions or need assistance:
 
-  - Check the [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) for common issues and solutions.
-  - Join our [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) to ask questions and share your experiences.
-  - Open an issue on our [GitHub Issues](https://github.com/rustfs/rustfs/issues) page for bug reports or feature requests.
+- Check the [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) for common issues and solutions.
+- Join our [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) to ask questions and share your experiences.
+- Open an issue on our [GitHub Issues](https://github.com/rustfs/rustfs/issues) page for bug reports or feature requests.
 
 ## Links
 
-  - [Documentation](https://docs.rustfs.com) - The manual you should read
-  - [Changelog](https://github.com/rustfs/rustfs/releases) - What we broke and fixed
-  - [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) - Where the community lives
+- [Documentation](https://docs.rustfs.com) - The manual you should read
+- [Changelog](https://github.com/rustfs/rustfs/releases) - What we broke and fixed
+- [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) - Where the community lives
 
 ## Contact
 
-  - **Bugs**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
-  - **Business**: [hello@rustfs.com](mailto:hello@rustfs.com)
-  - **Jobs**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
-  - **General Discussion**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
-  - **Contributing**: [CONTRIBUTING.md](CONTRIBUTING.md)
+- **Bugs**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
+- **Business**: [hello@rustfs.com](mailto:hello@rustfs.com)
+- **Jobs**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
+- **General Discussion**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
+- **Contributing**: [CONTRIBUTING.md](CONTRIBUTING.md)
 
 ## Contributors
 
@@ -220,7 +240,6 @@ RustFS is a community-driven project, and we appreciate all contributions. Check
 <img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="Contributors" />
 </a>
 
-
 ## Star History
 
 [![Star History Chart](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
@@ -230,4 +249,3 @@ RustFS is a community-driven project, and we appreciate all contributions. Check
 [Apache 2.0](https://opensource.org/licenses/Apache-2.0)
 
 **RustFS** is a trademark of RustFS, Inc. All other trademarks are the property of their respective owners.
-

README_ZH.md

@@ -1,4 +1,4 @@
-[![RustFS](https://rustfs.com/images/rustfs-github.png)](https://rustfs.com)
+[![RustFS](https://github.com/user-attachments/assets/1b5afcd6-a2c3-47ff-8bc3-ce882b0ddca7)](https://rustfs.com.cn)
 
 <p align="center">RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。</p>
 
@@ -10,8 +10,10 @@
   <a href="https://hellogithub.com/repository/rustfs/rustfs" target="_blank"><img src="https://abroad.hellogithub.com/v1/widgets/recommend.svg?rid=b95bcb72bdc340b68f16fdf6790b7d5b&claim_uid=MsbvjYeLDKAH457&theme=small" alt="Featured｜HelloGitHub" /></a>
 </p>
 
+
 <p align="center">
-<a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://trendshift.io/api/badge/repositories/14181" alt="rustfs%2Frustfs | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+<a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://trendshift.io/api/badge/repositories/14181" alt="rustfs%2Frustfs | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a> 
+<a href="https://runacap.com/ross-index/q4-2025/" target="_blank" rel="noopener"><img style="width: 260px; height: 55px" src="https://runacap.com/wp-content/uploads/2026/01/ROSS_badge_white_Q4_2025.svg" alt="ROSS Index - Fastest Growing Open-Source Startups in Q4 2025 | Runa Capital" height="55" /></a>
 </p>
 
 <p align="center">
@@ -21,8 +23,6 @@
   · <a href="https://github.com/rustfs/rustfs/discussions">社区讨论</a>
 </p>
 
-
-
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/blob/main/README.md">English</a> | 简体中文 |
   <a href="https://readme-i18n.com/rustfs/rustfs?lang=de">Deutsch</a> |
@@ -47,44 +47,46 @@ RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust
 - **完全开源**：采用 Apache 2.0 许可证，鼓励社区贡献和商业使用。
 - **简单易用**：设计简洁，易于部署和管理。
 
-
-| 功能 | 状态 |   功能 | 状态 | 
-| :--- | :--- | :--- | :--- |
-| **S3 核心功能** | ✅ 可用 |    **Bitrot (防数据腐烂)** | ✅ 可用 |
-| **上传 / 下载** | ✅ 可用 |     **单机模式** | ✅ 可用 |
-| **版本控制** | ✅ 可用 | **存储桶复制** | ✅ 可用 |
-| **日志功能** | ✅ 可用 |  **生命周期管理** | 🚧 测试中 |
-| **事件通知** | ✅ 可用 |  **分布式模式** | 🚧 测试中 |
-| **K8s Helm Chart** | ✅ 可用 |  **OPA (策略引擎)** | 🚧 测试中 |
-
-
-
+| 功能               | 状态    | 功能                    | 状态      |
+| :----------------- | :------ | :---------------------- | :-------- |
+| **S3 核心功能**    | ✅ 可用 | **Bitrot (防数据腐烂)** | ✅ 可用   |
+| **上传 / 下载**    | ✅ 可用 | **单机模式**            | ✅ 可用   |
+| **版本控制**       | ✅ 可用 | **存储桶复制**          | ✅ 可用   |
+| **日志功能**       | ✅ 可用 | **生命周期管理**        | 🚧 测试中 |
+| **事件通知**       | ✅ 可用 | **分布式模式**          | 🚧 测试中 |
+| **K8s Helm Chart** | ✅ 可用 | **OPA (策略引擎)**      | 🚧 测试中 |
 
 ## RustFS vs MinIO 性能对比
 
 **压力测试环境参数：**
 
-| 类型    | 参数 | 备注                                                   |
-|---------|-----------|----------------------------------------------------------|
-| CPU     | 2 核    | Intel Xeon (Sapphire Rapids) Platinum 8475B , 2.7/3.2 GHz |
-| 内存  | 4GB       |                                                          |
-| 网络 | 15Gbps     |                                                          |
-| 硬盘  | 40GB x 4  | IOPS 3800 / Drive                                       |
+| 类型 | 参数     | 备注                                                      |
+| ---- | -------- | --------------------------------------------------------- |
+| CPU  | 2 核     | Intel Xeon (Sapphire Rapids) Platinum 8475B , 2.7/3.2 GHz |
+| 内存 | 4GB      |                                                           |
+| 网络 | 15Gbps   |                                                           |
+| 硬盘 | 40GB x 4 | IOPS 3800 / Drive                                         |
 
 <https://github.com/user-attachments/assets/2e4979b5-260c-4f2c-ac12-c87fd558072a>
 
 ### RustFS vs 其他对象存储
 
-| 特性 | RustFS | 其他对象存储 |
-| :--- | :--- | :--- |
-| **控制台体验** | **功能强大的控制台**<br>提供全面的管理界面。 | **基础/简陋的控制台**<br>通常功能过于简单或缺失关键特性。 |
-| **语言与安全** | **基于 Rust 开发**<br>天生的内存安全。 | **基于 Go 或 C 开发**<br>存在内存 GC 停顿或内存泄漏的潜在风险。 |
-| **数据主权** | **无遥测 / 完全合规**<br>防止未经授权的数据跨境传输。完全符合 GDPR (欧盟/英国)、CCPA (美国) 和 APPI (日本) 等法规。 | **潜在风险**<br>可能存在法律风险和隐蔽的数据遥测（Telemetry）。 |
-| **开源协议** | **宽松的 Apache 2.0**<br>商业友好，无“毒丸”条款。 | **受限的 AGPL v3**<br>存在许可证陷阱和知识产权污染的风险。 |
-| **兼容性** | **100% S3 兼容**<br>适用于任何云提供商和客户端，随处运行。 | **兼容性不一**<br>虽然支持 S3，但可能缺乏对本地云厂商或特定 API 的支持。 |
-| **边缘与 IoT** | **强大的边缘支持**<br>非常适合安全、创新的边缘设备。 | **边缘支持较弱**<br>对于边缘网关来说通常过于沉重。 |
-| **成本** | **稳定且免费**<br>免费社区支持，稳定的商业定价。 | **高昂成本**<br>1PiB 的成本可能高达 250,000 美元。 |
-| **风险控制** | **企业级风险规避**<br>清晰的知识产权，商业使用安全无忧。 | **法律风险**<br>知识产权归属模糊及使用限制风险。 |
+| 特性           | RustFS                                                                                                              | 其他对象存储                                                             |
+| :------------- | :------------------------------------------------------------------------------------------------------------------ | :----------------------------------------------------------------------- |
+| **控制台体验** | **功能强大的控制台**<br>提供全面的管理界面。                                                                        | **基础/简陋的控制台**<br>通常功能过于简单或缺失关键特性。                |
+| **语言与安全** | **基于 Rust 开发**<br>天生的内存安全。                                                                              | **基于 Go 或 C 开发**<br>存在内存 GC 停顿或内存泄漏的潜在风险。          |
+| **数据主权**   | **无遥测 / 完全合规**<br>防止未经授权的数据跨境传输。完全符合 GDPR (欧盟/英国)、CCPA (美国) 和 APPI (日本) 等法规。 | **潜在风险**<br>可能存在法律风险和隐蔽的数据遥测（Telemetry）。          |
+| **开源协议**   | **宽松的 Apache 2.0**<br>商业友好，无“毒丸”条款。                                                                   | **受限的 AGPL v3**<br>存在许可证陷阱和知识产权污染的风险。               |
+| **兼容性**     | **100% S3 兼容**<br>适用于任何云提供商和客户端，随处运行。                                                          | **兼容性不一**<br>虽然支持 S3，但可能缺乏对本地云厂商或特定 API 的支持。 |
+| **边缘与 IoT** | **强大的边缘支持**<br>非常适合安全、创新的边缘设备。                                                                | **边缘支持较弱**<br>对于边缘网关来说通常过于沉重。                       |
+| **成本**       | **稳定且免费**<br>免费社区支持，稳定的商业定价。                                                                    | **高昂成本**<br>1PiB 的成本可能高达 250,000 美元。                       |
+| **风险控制**   | **企业级风险规避**<br>清晰的知识产权，商业使用安全无忧。                                                            | **法律风险**<br>知识产权归属模糊及使用限制风险。                         |
+
+## 保持领先
+
+在 GitHub 上为 RustFS 点赞，即可第一时间收到新版本发布通知。
+
+<img src="https://github.com/user-attachments/assets/7ee40bb4-3e46-4eac-b0d0-5fbeb85ff8f3" />
 
 ## 快速开始
 
@@ -92,13 +94,13 @@ RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust
 
 ### 1. 一键安装脚本 (选项 1)
 
-  ```bash
-  curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
-````
+```bash
+curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
+```
 
 ### 2\. Docker 快速启动 (选项 2)
 
-RustFS 容器以非 root 用户 `rustfs` (UID `10001`) 运行。如果您使用 Docker 的 `-v` 参数挂载宿主机目录，请务必确保宿主机目录的所有者已更改为 `1000`，否则会遇到权限拒绝错误。
+RustFS 容器以非 root 用户 `rustfs` (UID `10001`) 运行。如果您使用 Docker 的 `-v` 参数挂载宿主机目录，请务必确保宿主机目录的所有者已更改为 `10001`，否则会遇到权限拒绝错误。
 
 ```bash
  # 创建数据和日志目录
@@ -141,10 +143,10 @@ docker compose --profile observability up -d
 ```
 
 `docker-buildx.sh` 脚本支持：
-\- **多架构构建**: `linux/amd64`, `linux/arm64`
-\- **自动版本检测**: 使用 git tags 或 commit hash
-\- **灵活的仓库支持**: 支持 Docker Hub, GitHub Container Registry 等
-\- **构建优化**: 包含缓存和并行构建
+- **多架构构建**: `linux/amd64`, `linux/arm64`
+- **自动版本检测**: 使用 git tags 或 commit hash
+- **灵活的仓库支持**: 支持 Docker Hub, GitHub Container Registry 等
+- **构建优化**: 包含缓存和并行构建
 
 为了方便起见，您也可以使用 Make 命令：
 
@@ -161,14 +163,14 @@ make help-docker                      # 显示所有 Docker 相关命令
 
 请按照 [Helm Chart README](https://charts.rustfs.com) 上的说明在 Kubernetes 集群上安装 RustFS。
 
------
+---
 
 ### 访问 RustFS
 
-5.  **访问控制台**: 打开浏览器并访问 `http://localhost:9000` 进入 RustFS 控制台。
-      * 默认账号/密码: `rustfsadmin` / `rustfsadmin`
-6.  **创建存储桶**: 使用控制台为您​​的对象创建一个新的存储桶 (Bucket)。
-7.  **上传对象**: 您可以直接通过控制台上传文件，或使用 S3 兼容的 API/客户端与您的 RustFS 实例进行交互。
+1. **访问控制台**: 打开浏览器并访问 `http://localhost:9000` 进入 RustFS 控制台。
+   - 默认账号/密码: `rustfsadmin` / `rustfsadmin`
+2. **创建存储桶**: 使用控制台为您​​的对象创建一个新的存储桶 (Bucket)。
+3. **上传对象**: 您可以直接通过控制台上传文件，或使用 S3 兼容的 API/客户端与您的 RustFS 实例进行交互。
 
 **注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured.html)。
 
@@ -180,23 +182,23 @@ make help-docker                      # 显示所有 Docker 相关命令
 
 如果您有任何问题或需要帮助：
 
-  - 查看 [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) 寻找常见问题和解决方案。
-  - 加入我们的 [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) 提问并分享您的经验。
-  - 在我们的 [GitHub Issues](https://github.com/rustfs/rustfs/issues) 页面提交 Bug 报告或功能请求。
+- 查看 [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) 寻找常见问题和解决方案。
+- 加入我们的 [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) 提问并分享您的经验。
+- 在我们的 [GitHub Issues](https://github.com/rustfs/rustfs/issues) 页面提交 Bug 报告或功能请求。
 
 ## 链接
 
-  - [官方文档](https://docs.rustfs.com) - 必读手册
-  - [更新日志](https://github.com/rustfs/rustfs/releases) - 版本变更记录
-  - [社区讨论](https://github.com/rustfs/rustfs/discussions) - 社区交流地
+- [官方文档](https://docs.rustfs.com) - 必读手册
+- [更新日志](https://github.com/rustfs/rustfs/releases) - 版本变更记录
+- [社区讨论](https://github.com/rustfs/rustfs/discussions) - 社区交流地
 
 ## 联系方式
 
-  - **Bug 反馈**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
-  - **商务合作**: [hello@rustfs.com](mailto:hello@rustfs.com)
-  - **工作机会**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
-  - **一般讨论**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
-  - **贡献指南**: [CONTRIBUTING.md](https://www.google.com/search?q=CONTRIBUTING.md)
+- **Bug 反馈**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
+- **商务合作**: [hello@rustfs.com](mailto:hello@rustfs.com)
+- **工作机会**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
+- **一般讨论**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
+- **贡献指南**: [CONTRIBUTING.md](https://www.google.com/search?q=CONTRIBUTING.md)
 
 ## 贡献者
 
@@ -206,16 +208,12 @@ RustFS 是一个社区驱动的项目，我们感谢所有的贡献。请查看
 <img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="Contributors" />
 </a>
 
-
-
 ## Star 历史
 
 [![Star History Chart](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
 
-
 ## 许可证
 
 [Apache 2.0](https://opensource.org/licenses/Apache-2.0)
 
 **RustFS** 是 RustFS, Inc. 的商标。所有其他商标均为其各自所有者的财产。
-

_typos.toml

@@ -37,8 +37,13 @@ datas = "datas"
 bre = "bre"
 abd = "abd"
 mak = "mak"
+gae = "gae"
+GAE = "GAE"
 # s3-tests original test names (cannot be changed)
 nonexisted = "nonexisted"
+consts = "consts"
+# Swift API - company/product names
+Hashi = "Hashi"  # HashiCorp
 
 [files]
 extend-exclude = []

build-rustfs.sh

@@ -31,7 +31,7 @@ detect_platform() {
                     echo "armv7-unknown-linux-gnueabihf"
                     ;;
                 "loongarch64")
-                    echo "loongarch64-unknown-linux-musl"
+                    echo "loongarch64-unknown-linux-gnu"
                     ;;
                 *)
                     echo "unknown-platform"
@@ -126,6 +126,7 @@ usage() {
     echo "                              Supported platforms:"
     echo "                                x86_64-unknown-linux-gnu"
     echo "                                aarch64-unknown-linux-gnu"
+    echo "                                loongarch64-unknown-linux-gnu"
     echo "                                armv7-unknown-linux-gnueabihf"
     echo "                                x86_64-unknown-linux-musl"
     echo "                                aarch64-unknown-linux-musl"

crates/AGENTS.md

@@ -0,0 +1,20 @@
+# Crates Instructions
+
+Applies to all paths under `crates/`.
+
+## Library Design
+
+- Treat crate code as reusable library code by default.
+- Prefer `thiserror` for library-facing error types.
+- Do not use `unwrap()`, `expect()`, or panic-driven control flow outside tests.
+
+## Testing
+
+- Keep unit tests close to the module they test.
+- Keep integration tests under each crate's `tests/` directory.
+- Add regression tests for bug fixes and behavior changes.
+
+## Async and Performance
+
+- Keep async paths non-blocking.
+- Move CPU-heavy operations out of async hot paths with `tokio::task::spawn_blocking` when appropriate.

crates/ahm/src/scanner/checkpoint.rs

@@ -1,326 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::scanner::node_scanner::ScanProgress;
-use crate::{Error, Result};
-use serde::{Deserialize, Serialize};
-use std::{
-    path::{Path, PathBuf},
-    time::{Duration, SystemTime},
-};
-use tokio::sync::RwLock;
-use tracing::{debug, error, info, warn};
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct CheckpointData {
-    pub version: u32,
-    pub timestamp: SystemTime,
-    pub progress: ScanProgress,
-    pub node_id: String,
-    pub checksum: u64,
-}
-
-impl CheckpointData {
-    pub fn new(progress: ScanProgress, node_id: String) -> Self {
-        let mut checkpoint = Self {
-            version: 1,
-            timestamp: SystemTime::now(),
-            progress,
-            node_id,
-            checksum: 0,
-        };
-
-        checkpoint.checksum = checkpoint.calculate_checksum();
-        checkpoint
-    }
-
-    fn calculate_checksum(&self) -> u64 {
-        use std::collections::hash_map::DefaultHasher;
-        use std::hash::{Hash, Hasher};
-
-        let mut hasher = DefaultHasher::new();
-        self.version.hash(&mut hasher);
-        self.node_id.hash(&mut hasher);
-        self.progress.current_cycle.hash(&mut hasher);
-        self.progress.current_disk_index.hash(&mut hasher);
-
-        if let Some(ref bucket) = self.progress.current_bucket {
-            bucket.hash(&mut hasher);
-        }
-
-        if let Some(ref key) = self.progress.last_scan_key {
-            key.hash(&mut hasher);
-        }
-
-        hasher.finish()
-    }
-
-    pub fn verify_integrity(&self) -> bool {
-        let calculated_checksum = self.calculate_checksum();
-        self.checksum == calculated_checksum
-    }
-}
-
-pub struct CheckpointManager {
-    checkpoint_file: PathBuf,
-    backup_file: PathBuf,
-    temp_file: PathBuf,
-    save_interval: Duration,
-    last_save: RwLock<SystemTime>,
-    node_id: String,
-}
-
-impl CheckpointManager {
-    pub fn new(node_id: &str, data_dir: &Path) -> Self {
-        if !data_dir.exists()
-            && let Err(e) = std::fs::create_dir_all(data_dir)
-        {
-            error!("create data dir failed {:?}: {}", data_dir, e);
-        }
-
-        let checkpoint_file = data_dir.join(format!("scanner_checkpoint_{node_id}.json"));
-        let backup_file = data_dir.join(format!("scanner_checkpoint_{node_id}.backup"));
-        let temp_file = data_dir.join(format!("scanner_checkpoint_{node_id}.tmp"));
-
-        Self {
-            checkpoint_file,
-            backup_file,
-            temp_file,
-            save_interval: Duration::from_secs(30), // 30s
-            last_save: RwLock::new(SystemTime::UNIX_EPOCH),
-            node_id: node_id.to_string(),
-        }
-    }
-
-    pub async fn save_checkpoint(&self, progress: &ScanProgress) -> Result<()> {
-        let now = SystemTime::now();
-        let last_save = *self.last_save.read().await;
-
-        if now.duration_since(last_save).unwrap_or(Duration::ZERO) < self.save_interval {
-            return Ok(());
-        }
-
-        let checkpoint_data = CheckpointData::new(progress.clone(), self.node_id.clone());
-
-        let json_data = serde_json::to_string_pretty(&checkpoint_data)
-            .map_err(|e| Error::Serialization(format!("serialize checkpoint failed: {e}")))?;
-
-        tokio::fs::write(&self.temp_file, json_data)
-            .await
-            .map_err(|e| Error::IO(format!("write temp checkpoint file failed: {e}")))?;
-
-        if self.checkpoint_file.exists() {
-            tokio::fs::copy(&self.checkpoint_file, &self.backup_file)
-                .await
-                .map_err(|e| Error::IO(format!("backup checkpoint file failed: {e}")))?;
-        }
-
-        tokio::fs::rename(&self.temp_file, &self.checkpoint_file)
-            .await
-            .map_err(|e| Error::IO(format!("replace checkpoint file failed: {e}")))?;
-
-        *self.last_save.write().await = now;
-
-        debug!(
-            "save checkpoint to {:?}, cycle: {}, disk index: {}",
-            self.checkpoint_file, checkpoint_data.progress.current_cycle, checkpoint_data.progress.current_disk_index
-        );
-
-        Ok(())
-    }
-
-    pub async fn load_checkpoint(&self) -> Result<Option<ScanProgress>> {
-        // first try main checkpoint file
-        match self.load_checkpoint_from_file(&self.checkpoint_file).await {
-            Ok(checkpoint) => {
-                info!(
-                    "restore scan progress from main checkpoint file: cycle={}, disk index={}, last scan key={:?}",
-                    checkpoint.current_cycle, checkpoint.current_disk_index, checkpoint.last_scan_key
-                );
-                Ok(Some(checkpoint))
-            }
-            Err(e) => {
-                warn!("main checkpoint file is corrupted or not exists: {}", e);
-
-                // try backup file
-                match self.load_checkpoint_from_file(&self.backup_file).await {
-                    Ok(checkpoint) => {
-                        warn!(
-                            "restore scan progress from backup file: cycle={}, disk index={}",
-                            checkpoint.current_cycle, checkpoint.current_disk_index
-                        );
-
-                        // copy backup file to main checkpoint file
-                        if let Err(copy_err) = tokio::fs::copy(&self.backup_file, &self.checkpoint_file).await {
-                            warn!("restore main checkpoint file failed: {}", copy_err);
-                        }
-
-                        Ok(Some(checkpoint))
-                    }
-                    Err(backup_e) => {
-                        warn!("backup file is corrupted or not exists: {}", backup_e);
-                        info!("cannot restore scan progress, will start fresh scan");
-                        Ok(None)
-                    }
-                }
-            }
-        }
-    }
-
-    /// load checkpoint from file
-    async fn load_checkpoint_from_file(&self, file_path: &Path) -> Result<ScanProgress> {
-        if !file_path.exists() {
-            return Err(Error::NotFound(format!("checkpoint file not exists: {file_path:?}")));
-        }
-
-        // read file content
-        let content = tokio::fs::read_to_string(file_path)
-            .await
-            .map_err(|e| Error::IO(format!("read checkpoint file failed: {e}")))?;
-
-        // deserialize
-        let checkpoint_data: CheckpointData =
-            serde_json::from_str(&content).map_err(|e| Error::Serialization(format!("deserialize checkpoint failed: {e}")))?;
-
-        // validate checkpoint data
-        self.validate_checkpoint(&checkpoint_data)?;
-
-        Ok(checkpoint_data.progress)
-    }
-
-    /// validate checkpoint data
-    fn validate_checkpoint(&self, checkpoint: &CheckpointData) -> Result<()> {
-        // validate data integrity
-        if !checkpoint.verify_integrity() {
-            return Err(Error::InvalidCheckpoint(
-                "checkpoint data verification failed, may be corrupted".to_string(),
-            ));
-        }
-
-        // validate node id match
-        if checkpoint.node_id != self.node_id {
-            return Err(Error::InvalidCheckpoint(format!(
-                "checkpoint node id not match: expected {}, actual {}",
-                self.node_id, checkpoint.node_id
-            )));
-        }
-
-        let now = SystemTime::now();
-        let checkpoint_age = now.duration_since(checkpoint.timestamp).unwrap_or(Duration::MAX);
-
-        // checkpoint is too old (more than 24 hours), may be data expired
-        if checkpoint_age > Duration::from_secs(24 * 3600) {
-            return Err(Error::InvalidCheckpoint(format!("checkpoint data is too old: {checkpoint_age:?}")));
-        }
-
-        // validate version compatibility
-        if checkpoint.version > 1 {
-            return Err(Error::InvalidCheckpoint(format!(
-                "unsupported checkpoint version: {}",
-                checkpoint.version
-            )));
-        }
-
-        Ok(())
-    }
-
-    /// clean checkpoint file
-    ///
-    /// called when scanner stops or resets
-    pub async fn cleanup_checkpoint(&self) -> Result<()> {
-        // delete main file
-        if self.checkpoint_file.exists() {
-            tokio::fs::remove_file(&self.checkpoint_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete main checkpoint file failed: {e}")))?;
-        }
-
-        // delete backup file
-        if self.backup_file.exists() {
-            tokio::fs::remove_file(&self.backup_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete backup checkpoint file failed: {e}")))?;
-        }
-
-        // delete temp file
-        if self.temp_file.exists() {
-            tokio::fs::remove_file(&self.temp_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete temp checkpoint file failed: {e}")))?;
-        }
-
-        info!("cleaned up all checkpoint files");
-        Ok(())
-    }
-
-    /// get checkpoint file info
-    pub async fn get_checkpoint_info(&self) -> Result<Option<CheckpointInfo>> {
-        if !self.checkpoint_file.exists() {
-            return Ok(None);
-        }
-
-        let metadata = tokio::fs::metadata(&self.checkpoint_file)
-            .await
-            .map_err(|e| Error::IO(format!("get checkpoint file metadata failed: {e}")))?;
-
-        let content = tokio::fs::read_to_string(&self.checkpoint_file)
-            .await
-            .map_err(|e| Error::IO(format!("read checkpoint file failed: {e}")))?;
-
-        let checkpoint_data: CheckpointData =
-            serde_json::from_str(&content).map_err(|e| Error::Serialization(format!("deserialize checkpoint failed: {e}")))?;
-
-        Ok(Some(CheckpointInfo {
-            file_size: metadata.len(),
-            last_modified: metadata.modified().unwrap_or(SystemTime::UNIX_EPOCH),
-            checkpoint_timestamp: checkpoint_data.timestamp,
-            current_cycle: checkpoint_data.progress.current_cycle,
-            current_disk_index: checkpoint_data.progress.current_disk_index,
-            completed_disks_count: checkpoint_data.progress.completed_disks.len(),
-            is_valid: checkpoint_data.verify_integrity(),
-        }))
-    }
-
-    /// force save checkpoint (ignore time interval limit)
-    pub async fn force_save_checkpoint(&self, progress: &ScanProgress) -> Result<()> {
-        // temporarily reset last save time, force save
-        *self.last_save.write().await = SystemTime::UNIX_EPOCH;
-        self.save_checkpoint(progress).await
-    }
-
-    /// set save interval
-    pub async fn set_save_interval(&mut self, interval: Duration) {
-        self.save_interval = interval;
-        info!("checkpoint save interval set to: {:?}", interval);
-    }
-}
-
-/// checkpoint info
-#[derive(Debug, Clone)]
-pub struct CheckpointInfo {
-    /// file size
-    pub file_size: u64,
-    /// file last modified time
-    pub last_modified: SystemTime,
-    /// checkpoint creation time
-    pub checkpoint_timestamp: SystemTime,
-    /// current scan cycle
-    pub current_cycle: u64,
-    /// current disk index
-    pub current_disk_index: usize,
-    /// completed disks count
-    pub completed_disks_count: usize,
-    /// checkpoint is valid
-    pub is_valid: bool,
-}

crates/ahm/src/scanner/histogram.rs

@@ -1,305 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use serde::{Deserialize, Serialize};
-use std::{
-    collections::HashMap,
-    sync::atomic::{AtomicU64, Ordering},
-    time::{Duration, SystemTime},
-};
-use tracing::info;
-
-/// Scanner metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ScannerMetrics {
-    /// Total objects scanned since server start
-    pub objects_scanned: u64,
-    /// Total object versions scanned since server start
-    pub versions_scanned: u64,
-    /// Total directories scanned since server start
-    pub directories_scanned: u64,
-    /// Total bucket scans started since server start
-    pub bucket_scans_started: u64,
-    /// Total bucket scans finished since server start
-    pub bucket_scans_finished: u64,
-    /// Total objects with health issues found
-    pub objects_with_issues: u64,
-    /// Total heal tasks queued
-    pub heal_tasks_queued: u64,
-    /// Total heal tasks completed
-    pub heal_tasks_completed: u64,
-    /// Total heal tasks failed
-    pub heal_tasks_failed: u64,
-    /// Total healthy objects found
-    pub healthy_objects: u64,
-    /// Total corrupted objects found
-    pub corrupted_objects: u64,
-    /// Last scan activity time
-    pub last_activity: Option<SystemTime>,
-    /// Current scan cycle
-    pub current_cycle: u64,
-    /// Total scan cycles completed
-    pub total_cycles: u64,
-    /// Current scan duration
-    pub current_scan_duration: Option<Duration>,
-    /// Average scan duration
-    pub avg_scan_duration: Duration,
-    /// Objects scanned per second
-    pub objects_per_second: f64,
-    /// Buckets scanned per second
-    pub buckets_per_second: f64,
-    /// Storage metrics by bucket
-    pub bucket_metrics: HashMap<String, BucketMetrics>,
-    /// Disk metrics
-    pub disk_metrics: HashMap<String, DiskMetrics>,
-}
-
-/// Bucket-specific metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct BucketMetrics {
-    /// Bucket name
-    pub bucket: String,
-    /// Total objects in bucket
-    pub total_objects: u64,
-    /// Total size of objects in bucket (bytes)
-    pub total_size: u64,
-    /// Objects with health issues
-    pub objects_with_issues: u64,
-    /// Last scan time
-    pub last_scan_time: Option<SystemTime>,
-    /// Scan duration
-    pub scan_duration: Option<Duration>,
-    /// Heal tasks queued for this bucket
-    pub heal_tasks_queued: u64,
-    /// Heal tasks completed for this bucket
-    pub heal_tasks_completed: u64,
-    /// Heal tasks failed for this bucket
-    pub heal_tasks_failed: u64,
-}
-
-/// Disk-specific metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct DiskMetrics {
-    /// Disk path
-    pub disk_path: String,
-    /// Total disk space (bytes)
-    pub total_space: u64,
-    /// Used disk space (bytes)
-    pub used_space: u64,
-    /// Free disk space (bytes)
-    pub free_space: u64,
-    /// Objects scanned on this disk
-    pub objects_scanned: u64,
-    /// Objects with issues on this disk
-    pub objects_with_issues: u64,
-    /// Last scan time
-    pub last_scan_time: Option<SystemTime>,
-    /// Whether disk is online
-    pub is_online: bool,
-    /// Whether disk is being scanned
-    pub is_scanning: bool,
-}
-
-/// Thread-safe metrics collector
-pub struct MetricsCollector {
-    /// Atomic counters for real-time metrics
-    objects_scanned: AtomicU64,
-    versions_scanned: AtomicU64,
-    directories_scanned: AtomicU64,
-    bucket_scans_started: AtomicU64,
-    bucket_scans_finished: AtomicU64,
-    objects_with_issues: AtomicU64,
-    heal_tasks_queued: AtomicU64,
-    heal_tasks_completed: AtomicU64,
-    heal_tasks_failed: AtomicU64,
-    current_cycle: AtomicU64,
-    total_cycles: AtomicU64,
-    healthy_objects: AtomicU64,
-    corrupted_objects: AtomicU64,
-}
-
-impl MetricsCollector {
-    /// Create a new metrics collector
-    pub fn new() -> Self {
-        Self {
-            objects_scanned: AtomicU64::new(0),
-            versions_scanned: AtomicU64::new(0),
-            directories_scanned: AtomicU64::new(0),
-            bucket_scans_started: AtomicU64::new(0),
-            bucket_scans_finished: AtomicU64::new(0),
-            objects_with_issues: AtomicU64::new(0),
-            heal_tasks_queued: AtomicU64::new(0),
-            heal_tasks_completed: AtomicU64::new(0),
-            heal_tasks_failed: AtomicU64::new(0),
-            current_cycle: AtomicU64::new(0),
-            total_cycles: AtomicU64::new(0),
-            healthy_objects: AtomicU64::new(0),
-            corrupted_objects: AtomicU64::new(0),
-        }
-    }
-
-    /// Increment objects scanned count
-    pub fn increment_objects_scanned(&self, count: u64) {
-        self.objects_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment versions scanned count
-    pub fn increment_versions_scanned(&self, count: u64) {
-        self.versions_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment directories scanned count
-    pub fn increment_directories_scanned(&self, count: u64) {
-        self.directories_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment bucket scans started count
-    pub fn increment_bucket_scans_started(&self, count: u64) {
-        self.bucket_scans_started.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment bucket scans finished count
-    pub fn increment_bucket_scans_finished(&self, count: u64) {
-        self.bucket_scans_finished.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment objects with issues count
-    pub fn increment_objects_with_issues(&self, count: u64) {
-        self.objects_with_issues.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks queued count
-    pub fn increment_heal_tasks_queued(&self, count: u64) {
-        self.heal_tasks_queued.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks completed count
-    pub fn increment_heal_tasks_completed(&self, count: u64) {
-        self.heal_tasks_completed.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks failed count
-    pub fn increment_heal_tasks_failed(&self, count: u64) {
-        self.heal_tasks_failed.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Set current cycle
-    pub fn set_current_cycle(&self, cycle: u64) {
-        self.current_cycle.store(cycle, Ordering::Relaxed);
-    }
-
-    /// Increment total cycles
-    pub fn increment_total_cycles(&self) {
-        self.total_cycles.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Increment healthy objects count
-    pub fn increment_healthy_objects(&self) {
-        self.healthy_objects.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Increment corrupted objects count
-    pub fn increment_corrupted_objects(&self) {
-        self.corrupted_objects.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Get current metrics snapshot
-    pub fn get_metrics(&self) -> ScannerMetrics {
-        ScannerMetrics {
-            objects_scanned: self.objects_scanned.load(Ordering::Relaxed),
-            versions_scanned: self.versions_scanned.load(Ordering::Relaxed),
-            directories_scanned: self.directories_scanned.load(Ordering::Relaxed),
-            bucket_scans_started: self.bucket_scans_started.load(Ordering::Relaxed),
-            bucket_scans_finished: self.bucket_scans_finished.load(Ordering::Relaxed),
-            objects_with_issues: self.objects_with_issues.load(Ordering::Relaxed),
-            heal_tasks_queued: self.heal_tasks_queued.load(Ordering::Relaxed),
-            heal_tasks_completed: self.heal_tasks_completed.load(Ordering::Relaxed),
-            heal_tasks_failed: self.heal_tasks_failed.load(Ordering::Relaxed),
-            healthy_objects: self.healthy_objects.load(Ordering::Relaxed),
-            corrupted_objects: self.corrupted_objects.load(Ordering::Relaxed),
-            last_activity: Some(SystemTime::now()),
-            current_cycle: self.current_cycle.load(Ordering::Relaxed),
-            total_cycles: self.total_cycles.load(Ordering::Relaxed),
-            current_scan_duration: None,       // Will be set by scanner
-            avg_scan_duration: Duration::ZERO, // Will be calculated
-            objects_per_second: 0.0,           // Will be calculated
-            buckets_per_second: 0.0,           // Will be calculated
-            bucket_metrics: HashMap::new(),    // Will be populated by scanner
-            disk_metrics: HashMap::new(),      // Will be populated by scanner
-        }
-    }
-
-    /// Reset all metrics
-    pub fn reset(&self) {
-        self.objects_scanned.store(0, Ordering::Relaxed);
-        self.versions_scanned.store(0, Ordering::Relaxed);
-        self.directories_scanned.store(0, Ordering::Relaxed);
-        self.bucket_scans_started.store(0, Ordering::Relaxed);
-        self.bucket_scans_finished.store(0, Ordering::Relaxed);
-        self.objects_with_issues.store(0, Ordering::Relaxed);
-        self.heal_tasks_queued.store(0, Ordering::Relaxed);
-        self.heal_tasks_completed.store(0, Ordering::Relaxed);
-        self.heal_tasks_failed.store(0, Ordering::Relaxed);
-        self.current_cycle.store(0, Ordering::Relaxed);
-        self.total_cycles.store(0, Ordering::Relaxed);
-        self.healthy_objects.store(0, Ordering::Relaxed);
-        self.corrupted_objects.store(0, Ordering::Relaxed);
-
-        info!("Scanner metrics reset");
-    }
-}
-
-impl Default for MetricsCollector {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_metrics_collector_creation() {
-        let collector = MetricsCollector::new();
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 0);
-        assert_eq!(metrics.versions_scanned, 0);
-    }
-
-    #[test]
-    fn test_metrics_increment() {
-        let collector = MetricsCollector::new();
-
-        collector.increment_objects_scanned(10);
-        collector.increment_versions_scanned(5);
-        collector.increment_objects_with_issues(2);
-
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 10);
-        assert_eq!(metrics.versions_scanned, 5);
-        assert_eq!(metrics.objects_with_issues, 2);
-    }
-
-    #[test]
-    fn test_metrics_reset() {
-        let collector = MetricsCollector::new();
-
-        collector.increment_objects_scanned(10);
-        collector.reset();
-
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 0);
-    }
-}

crates/ahm/src/scanner/io_monitor.rs

@@ -1,555 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::Result;
-use crate::scanner::LoadLevel;
-use serde::{Deserialize, Serialize};
-use std::{
-    collections::VecDeque,
-    sync::{
-        Arc,
-        atomic::{AtomicU64, Ordering},
-    },
-    time::{Duration, SystemTime},
-};
-use tokio::sync::RwLock;
-use tokio_util::sync::CancellationToken;
-use tracing::{debug, error, info, warn};
-
-/// IO monitor config   
-#[derive(Debug, Clone)]
-pub struct IOMonitorConfig {
-    /// monitor interval
-    pub monitor_interval: Duration,
-    /// history data retention time
-    pub history_retention: Duration,
-    /// load evaluation window size
-    pub load_window_size: usize,
-    /// whether to enable actual system monitoring
-    pub enable_system_monitoring: bool,
-    /// disk path list (for monitoring specific disks)
-    pub disk_paths: Vec<String>,
-}
-
-impl Default for IOMonitorConfig {
-    fn default() -> Self {
-        Self {
-            monitor_interval: Duration::from_secs(1),    // 1 second monitor interval
-            history_retention: Duration::from_secs(300), // keep 5 minutes history
-            load_window_size: 30,                        // 30 sample points sliding window
-            enable_system_monitoring: false,             // default use simulated data
-            disk_paths: Vec::new(),
-        }
-    }
-}
-
-/// IO monitor metrics
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct IOMetrics {
-    /// timestamp
-    pub timestamp: SystemTime,
-    /// disk IOPS (read + write)
-    pub iops: u64,
-    /// read IOPS
-    pub read_iops: u64,
-    /// write IOPS
-    pub write_iops: u64,
-    /// disk queue depth
-    pub queue_depth: u64,
-    /// average latency (milliseconds)
-    pub avg_latency: u64,
-    /// read latency (milliseconds)
-    pub read_latency: u64,
-    /// write latency (milliseconds)
-    pub write_latency: u64,
-    /// CPU usage (0-100)
-    pub cpu_usage: u8,
-    /// memory usage (0-100)
-    pub memory_usage: u8,
-    /// disk usage (0-100)
-    pub disk_utilization: u8,
-    /// network IO (Mbps)
-    pub network_io: u64,
-}
-
-impl Default for IOMetrics {
-    fn default() -> Self {
-        Self {
-            timestamp: SystemTime::now(),
-            iops: 0,
-            read_iops: 0,
-            write_iops: 0,
-            queue_depth: 0,
-            avg_latency: 0,
-            read_latency: 0,
-            write_latency: 0,
-            cpu_usage: 0,
-            memory_usage: 0,
-            disk_utilization: 0,
-            network_io: 0,
-        }
-    }
-}
-
-/// load level stats
-#[derive(Debug, Clone, Default)]
-pub struct LoadLevelStats {
-    /// low load duration (seconds)
-    pub low_load_duration: u64,
-    /// medium load duration (seconds)
-    pub medium_load_duration: u64,
-    /// high load duration (seconds)
-    pub high_load_duration: u64,
-    /// critical load duration (seconds)
-    pub critical_load_duration: u64,
-    /// load transitions
-    pub load_transitions: u64,
-}
-
-/// advanced IO monitor
-pub struct AdvancedIOMonitor {
-    /// config
-    config: Arc<RwLock<IOMonitorConfig>>,
-    /// current metrics
-    current_metrics: Arc<RwLock<IOMetrics>>,
-    /// history metrics (sliding window)
-    history_metrics: Arc<RwLock<VecDeque<IOMetrics>>>,
-    /// current load level
-    current_load_level: Arc<RwLock<LoadLevel>>,
-    /// load level history
-    load_level_history: Arc<RwLock<VecDeque<(SystemTime, LoadLevel)>>>,
-    /// load level stats
-    load_stats: Arc<RwLock<LoadLevelStats>>,
-    /// business IO metrics (updated by external)
-    business_metrics: Arc<BusinessIOMetrics>,
-    /// cancel token
-    cancel_token: CancellationToken,
-}
-
-/// business IO metrics
-pub struct BusinessIOMetrics {
-    /// business request latency (milliseconds)
-    pub request_latency: AtomicU64,
-    /// business request QPS
-    pub request_qps: AtomicU64,
-    /// business error rate (0-10000, 0.00%-100.00%)
-    pub error_rate: AtomicU64,
-    /// active connections
-    pub active_connections: AtomicU64,
-    /// last update time
-    pub last_update: Arc<RwLock<SystemTime>>,
-}
-
-impl Default for BusinessIOMetrics {
-    fn default() -> Self {
-        Self {
-            request_latency: AtomicU64::new(0),
-            request_qps: AtomicU64::new(0),
-            error_rate: AtomicU64::new(0),
-            active_connections: AtomicU64::new(0),
-            last_update: Arc::new(RwLock::new(SystemTime::UNIX_EPOCH)),
-        }
-    }
-}
-
-impl AdvancedIOMonitor {
-    /// create new advanced IO monitor
-    pub fn new(config: IOMonitorConfig) -> Self {
-        Self {
-            config: Arc::new(RwLock::new(config)),
-            current_metrics: Arc::new(RwLock::new(IOMetrics::default())),
-            history_metrics: Arc::new(RwLock::new(VecDeque::new())),
-            current_load_level: Arc::new(RwLock::new(LoadLevel::Low)),
-            load_level_history: Arc::new(RwLock::new(VecDeque::new())),
-            load_stats: Arc::new(RwLock::new(LoadLevelStats::default())),
-            business_metrics: Arc::new(BusinessIOMetrics::default()),
-            cancel_token: CancellationToken::new(),
-        }
-    }
-
-    /// start monitoring
-    pub async fn start(&self) -> Result<()> {
-        info!("start advanced IO monitor");
-
-        let monitor = self.clone_for_background();
-        tokio::spawn(async move {
-            if let Err(e) = monitor.monitoring_loop().await {
-                error!("IO monitoring loop failed: {}", e);
-            }
-        });
-
-        Ok(())
-    }
-
-    /// stop monitoring
-    pub async fn stop(&self) {
-        info!("stop IO monitor");
-        self.cancel_token.cancel();
-    }
-
-    /// monitoring loop
-    async fn monitoring_loop(&self) -> Result<()> {
-        let mut interval = {
-            let config = self.config.read().await;
-            tokio::time::interval(config.monitor_interval)
-        };
-
-        let mut last_load_level = LoadLevel::Low;
-        let mut load_level_start_time = SystemTime::now();
-
-        loop {
-            tokio::select! {
-                _ = self.cancel_token.cancelled() => {
-                    info!("IO monitoring loop cancelled");
-                    break;
-                }
-                _ = interval.tick() => {
-                    // collect system metrics
-                    let metrics = self.collect_system_metrics().await;
-
-                    // update current metrics
-                    *self.current_metrics.write().await = metrics.clone();
-
-                    // update history metrics
-                    self.update_metrics_history(metrics.clone()).await;
-
-                    // calculate load level
-                    let new_load_level = self.calculate_load_level(&metrics).await;
-
-                    // check if load level changed
-                    if new_load_level != last_load_level {
-                        self.handle_load_level_change(last_load_level, new_load_level, load_level_start_time).await;
-                        last_load_level = new_load_level;
-                        load_level_start_time = SystemTime::now();
-                    }
-
-                    // update current load level
-                    *self.current_load_level.write().await = new_load_level;
-
-                    debug!("IO monitor updated: IOPS={}, queue depth={}, latency={}ms, load level={:?}",
-                           metrics.iops, metrics.queue_depth, metrics.avg_latency, new_load_level);
-                }
-            }
-        }
-
-        Ok(())
-    }
-
-    /// collect system metrics
-    async fn collect_system_metrics(&self) -> IOMetrics {
-        let config = self.config.read().await;
-
-        if config.enable_system_monitoring {
-            // actual system monitoring implementation
-            self.collect_real_system_metrics().await
-        } else {
-            // simulated data
-            self.generate_simulated_metrics().await
-        }
-    }
-
-    /// collect real system metrics (need to be implemented according to specific system)
-    async fn collect_real_system_metrics(&self) -> IOMetrics {
-        // TODO: implement actual system metrics collection
-        // can use procfs, sysfs or other system API
-
-        let metrics = IOMetrics {
-            timestamp: SystemTime::now(),
-            ..Default::default()
-        };
-
-        // example: read /proc/diskstats
-        if let Ok(diskstats) = tokio::fs::read_to_string("/proc/diskstats").await {
-            // parse disk stats info
-            // here need to implement specific parsing logic
-            debug!("read disk stats info: {} bytes", diskstats.len());
-        }
-
-        // example: read /proc/stat to get CPU info
-        if let Ok(stat) = tokio::fs::read_to_string("/proc/stat").await {
-            // parse CPU stats info
-            debug!("read CPU stats info: {} bytes", stat.len());
-        }
-
-        // example: read /proc/meminfo to get memory info
-        if let Ok(meminfo) = tokio::fs::read_to_string("/proc/meminfo").await {
-            // parse memory stats info
-            debug!("read memory stats info: {} bytes", meminfo.len());
-        }
-
-        metrics
-    }
-
-    /// generate simulated metrics (for testing and development)
-    async fn generate_simulated_metrics(&self) -> IOMetrics {
-        use rand::Rng;
-        let mut rng = rand::rng();
-
-        // get business metrics impact
-        let business_latency = self.business_metrics.request_latency.load(Ordering::Relaxed);
-        let business_qps = self.business_metrics.request_qps.load(Ordering::Relaxed);
-
-        // generate simulated system metrics based on business load
-        let base_iops = 100 + (business_qps / 10);
-        let base_latency = 5 + (business_latency / 10);
-
-        IOMetrics {
-            timestamp: SystemTime::now(),
-            iops: base_iops + rng.random_range(0..50),
-            read_iops: (base_iops * 6 / 10) + rng.random_range(0..20),
-            write_iops: (base_iops * 4 / 10) + rng.random_range(0..20),
-            queue_depth: rng.random_range(1..20),
-            avg_latency: base_latency + rng.random_range(0..10),
-            read_latency: base_latency + rng.random_range(0..5),
-            write_latency: base_latency + rng.random_range(0..15),
-            cpu_usage: rng.random_range(10..70),
-            memory_usage: rng.random_range(30..80),
-            disk_utilization: rng.random_range(20..90),
-            network_io: rng.random_range(10..1000),
-        }
-    }
-
-    /// update metrics history
-    async fn update_metrics_history(&self, metrics: IOMetrics) {
-        let mut history = self.history_metrics.write().await;
-        let config = self.config.read().await;
-
-        // add new metrics
-        history.push_back(metrics);
-
-        // clean expired data
-        let retention_cutoff = SystemTime::now() - config.history_retention;
-        while let Some(front) = history.front() {
-            if front.timestamp < retention_cutoff {
-                history.pop_front();
-            } else {
-                break;
-            }
-        }
-
-        // limit window size
-        while history.len() > config.load_window_size {
-            history.pop_front();
-        }
-    }
-
-    /// calculate load level
-    async fn calculate_load_level(&self, metrics: &IOMetrics) -> LoadLevel {
-        // multi-dimensional load evaluation algorithm
-        let mut load_score = 0u32;
-
-        // IOPS load evaluation (weight: 25%)
-        let iops_score = match metrics.iops {
-            0..=200 => 0,
-            201..=500 => 15,
-            501..=1000 => 25,
-            _ => 35,
-        };
-        load_score += iops_score;
-
-        // latency load evaluation (weight: 30%)
-        let latency_score = match metrics.avg_latency {
-            0..=10 => 0,
-            11..=50 => 20,
-            51..=100 => 30,
-            _ => 40,
-        };
-        load_score += latency_score;
-
-        // queue depth evaluation (weight: 20%)
-        let queue_score = match metrics.queue_depth {
-            0..=5 => 0,
-            6..=15 => 10,
-            16..=30 => 20,
-            _ => 25,
-        };
-        load_score += queue_score;
-
-        // CPU usage evaluation (weight: 15%)
-        let cpu_score = match metrics.cpu_usage {
-            0..=30 => 0,
-            31..=60 => 8,
-            61..=80 => 12,
-            _ => 15,
-        };
-        load_score += cpu_score;
-
-        // disk usage evaluation (weight: 10%)
-        let disk_score = match metrics.disk_utilization {
-            0..=50 => 0,
-            51..=75 => 5,
-            76..=90 => 8,
-            _ => 10,
-        };
-        load_score += disk_score;
-
-        // business metrics impact
-        let business_latency = self.business_metrics.request_latency.load(Ordering::Relaxed);
-        let business_error_rate = self.business_metrics.error_rate.load(Ordering::Relaxed);
-
-        if business_latency > 100 {
-            load_score += 20; // business latency too high
-        }
-        if business_error_rate > 100 {
-            // > 1%
-            load_score += 15; // business error rate too high
-        }
-
-        // history trend analysis
-        let trend_score = self.calculate_trend_score().await;
-        load_score += trend_score;
-
-        // determine load level based on total score
-        match load_score {
-            0..=30 => LoadLevel::Low,
-            31..=60 => LoadLevel::Medium,
-            61..=90 => LoadLevel::High,
-            _ => LoadLevel::Critical,
-        }
-    }
-
-    /// calculate trend score
-    async fn calculate_trend_score(&self) -> u32 {
-        let history = self.history_metrics.read().await;
-
-        if history.len() < 5 {
-            return 0; // data insufficient, cannot analyze trend
-        }
-
-        // analyze trend of last 5 samples
-        let recent: Vec<_> = history.iter().rev().take(5).collect();
-
-        // check IOPS rising trend
-        let mut iops_trend = 0;
-        for i in 1..recent.len() {
-            if recent[i - 1].iops > recent[i].iops {
-                iops_trend += 1;
-            }
-        }
-
-        // check latency rising trend
-        let mut latency_trend = 0;
-        for i in 1..recent.len() {
-            if recent[i - 1].avg_latency > recent[i].avg_latency {
-                latency_trend += 1;
-            }
-        }
-
-        // if IOPS and latency are both rising, increase load score
-        if iops_trend >= 3 && latency_trend >= 3 {
-            15 // obvious rising trend
-        } else if iops_trend >= 2 || latency_trend >= 2 {
-            5 // slight rising trend
-        } else {
-            0 // no obvious trend
-        }
-    }
-
-    /// handle load level change
-    async fn handle_load_level_change(&self, old_level: LoadLevel, new_level: LoadLevel, start_time: SystemTime) {
-        let duration = SystemTime::now().duration_since(start_time).unwrap_or(Duration::ZERO);
-
-        // update stats
-        {
-            let mut stats = self.load_stats.write().await;
-            match old_level {
-                LoadLevel::Low => stats.low_load_duration += duration.as_secs(),
-                LoadLevel::Medium => stats.medium_load_duration += duration.as_secs(),
-                LoadLevel::High => stats.high_load_duration += duration.as_secs(),
-                LoadLevel::Critical => stats.critical_load_duration += duration.as_secs(),
-            }
-            stats.load_transitions += 1;
-        }
-
-        // update history
-        {
-            let mut history = self.load_level_history.write().await;
-            history.push_back((SystemTime::now(), new_level));
-
-            // keep history record in reasonable range
-            while history.len() > 100 {
-                history.pop_front();
-            }
-        }
-
-        info!("load level changed: {:?} -> {:?}, duration: {:?}", old_level, new_level, duration);
-
-        // if enter critical load state, record warning
-        if new_level == LoadLevel::Critical {
-            warn!("system entered critical load state, Scanner will pause running");
-        }
-    }
-
-    /// get current load level
-    pub async fn get_business_load_level(&self) -> LoadLevel {
-        *self.current_load_level.read().await
-    }
-
-    /// get current metrics
-    pub async fn get_current_metrics(&self) -> IOMetrics {
-        self.current_metrics.read().await.clone()
-    }
-
-    /// get history metrics
-    pub async fn get_history_metrics(&self) -> Vec<IOMetrics> {
-        self.history_metrics.read().await.iter().cloned().collect()
-    }
-
-    /// get load stats
-    pub async fn get_load_stats(&self) -> LoadLevelStats {
-        self.load_stats.read().await.clone()
-    }
-
-    /// update business IO metrics
-    pub async fn update_business_metrics(&self, latency: u64, qps: u64, error_rate: u64, connections: u64) {
-        self.business_metrics.request_latency.store(latency, Ordering::Relaxed);
-        self.business_metrics.request_qps.store(qps, Ordering::Relaxed);
-        self.business_metrics.error_rate.store(error_rate, Ordering::Relaxed);
-        self.business_metrics.active_connections.store(connections, Ordering::Relaxed);
-
-        *self.business_metrics.last_update.write().await = SystemTime::now();
-
-        debug!(
-            "update business metrics: latency={}ms, QPS={}, error rate={}‰, connections={}",
-            latency, qps, error_rate, connections
-        );
-    }
-
-    /// clone for background task
-    fn clone_for_background(&self) -> Self {
-        Self {
-            config: self.config.clone(),
-            current_metrics: self.current_metrics.clone(),
-            history_metrics: self.history_metrics.clone(),
-            current_load_level: self.current_load_level.clone(),
-            load_level_history: self.load_level_history.clone(),
-            load_stats: self.load_stats.clone(),
-            business_metrics: self.business_metrics.clone(),
-            cancel_token: self.cancel_token.clone(),
-        }
-    }
-
-    /// reset stats
-    pub async fn reset_stats(&self) {
-        *self.load_stats.write().await = LoadLevelStats::default();
-        self.load_level_history.write().await.clear();
-        self.history_metrics.write().await.clear();
-        info!("IO monitor stats reset");
-    }
-
-    /// get load level history
-    pub async fn get_load_level_history(&self) -> Vec<(SystemTime, LoadLevel)> {
-        self.load_level_history.read().await.iter().cloned().collect()
-    }
-}

crates/ahm/src/scanner/io_throttler.rs

@@ -1,499 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::scanner::LoadLevel;
-use std::{
-    sync::{
-        Arc,
-        atomic::{AtomicU8, AtomicU64, Ordering},
-    },
-    time::{Duration, SystemTime},
-};
-use tokio::sync::RwLock;
-use tracing::{debug, info, warn};
-
-/// IO throttler config
-#[derive(Debug, Clone)]
-pub struct IOThrottlerConfig {
-    /// max IOPS limit
-    pub max_iops: u64,
-    /// business priority baseline (percentage)
-    pub base_business_priority: u8,
-    /// scanner minimum delay (milliseconds)
-    pub min_scan_delay: u64,
-    /// scanner maximum delay (milliseconds)
-    pub max_scan_delay: u64,
-    /// whether enable dynamic adjustment
-    pub enable_dynamic_adjustment: bool,
-    /// adjustment response time (seconds)
-    pub adjustment_response_time: u64,
-}
-
-impl Default for IOThrottlerConfig {
-    fn default() -> Self {
-        Self {
-            max_iops: 1000,             // default max 1000 IOPS
-            base_business_priority: 95, // business priority 95%
-            min_scan_delay: 5000,       // minimum 5s delay
-            max_scan_delay: 60000,      // maximum 60s delay
-            enable_dynamic_adjustment: true,
-            adjustment_response_time: 5, // 5 seconds response time
-        }
-    }
-}
-
-/// resource allocation strategy
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ResourceAllocationStrategy {
-    /// business priority strategy
-    BusinessFirst,
-    /// balanced strategy
-    Balanced,
-    /// maintenance priority strategy (only used in special cases)
-    MaintenanceFirst,
-}
-
-/// throttle decision
-#[derive(Debug, Clone)]
-pub struct ThrottleDecision {
-    /// whether should pause scanning
-    pub should_pause: bool,
-    /// suggested scanning delay
-    pub suggested_delay: Duration,
-    /// resource allocation suggestion
-    pub resource_allocation: ResourceAllocation,
-    /// decision reason
-    pub reason: String,
-}
-
-/// resource allocation
-#[derive(Debug, Clone)]
-pub struct ResourceAllocation {
-    /// business IO allocation percentage (0-100)
-    pub business_percentage: u8,
-    /// scanner IO allocation percentage (0-100)
-    pub scanner_percentage: u8,
-    /// allocation strategy
-    pub strategy: ResourceAllocationStrategy,
-}
-
-/// enhanced IO throttler
-///
-/// dynamically adjust the resource usage of the scanner based on real-time system load and business demand,
-/// ensure business IO gets priority protection.
-pub struct AdvancedIOThrottler {
-    /// config
-    config: Arc<RwLock<IOThrottlerConfig>>,
-    /// current IOPS usage (reserved field)
-    #[allow(dead_code)]
-    current_iops: Arc<AtomicU64>,
-    /// business priority weight (0-100)
-    business_priority: Arc<AtomicU8>,
-    /// scanning operation delay (milliseconds)
-    scan_delay: Arc<AtomicU64>,
-    /// resource allocation strategy
-    allocation_strategy: Arc<RwLock<ResourceAllocationStrategy>>,
-    /// throttle history record
-    throttle_history: Arc<RwLock<Vec<ThrottleRecord>>>,
-    /// last adjustment time (reserved field)
-    #[allow(dead_code)]
-    last_adjustment: Arc<RwLock<SystemTime>>,
-}
-
-/// throttle record
-#[derive(Debug, Clone)]
-pub struct ThrottleRecord {
-    /// timestamp
-    pub timestamp: SystemTime,
-    /// load level
-    pub load_level: LoadLevel,
-    /// decision
-    pub decision: ThrottleDecision,
-    /// system metrics snapshot
-    pub metrics_snapshot: MetricsSnapshot,
-}
-
-/// metrics snapshot
-#[derive(Debug, Clone)]
-pub struct MetricsSnapshot {
-    /// IOPS
-    pub iops: u64,
-    /// latency
-    pub latency: u64,
-    /// CPU usage
-    pub cpu_usage: u8,
-    /// memory usage
-    pub memory_usage: u8,
-}
-
-impl AdvancedIOThrottler {
-    /// create new advanced IO throttler
-    pub fn new(config: IOThrottlerConfig) -> Self {
-        Self {
-            config: Arc::new(RwLock::new(config)),
-            current_iops: Arc::new(AtomicU64::new(0)),
-            business_priority: Arc::new(AtomicU8::new(95)),
-            scan_delay: Arc::new(AtomicU64::new(5000)),
-            allocation_strategy: Arc::new(RwLock::new(ResourceAllocationStrategy::BusinessFirst)),
-            throttle_history: Arc::new(RwLock::new(Vec::new())),
-            last_adjustment: Arc::new(RwLock::new(SystemTime::UNIX_EPOCH)),
-        }
-    }
-
-    /// adjust scanning delay based on load level
-    pub async fn adjust_for_load_level(&self, load_level: LoadLevel) -> Duration {
-        let config = self.config.read().await;
-
-        let delay_ms = match load_level {
-            LoadLevel::Low => {
-                // low load: use minimum delay
-                self.scan_delay.store(config.min_scan_delay, Ordering::Relaxed);
-                self.business_priority
-                    .store(config.base_business_priority.saturating_sub(5), Ordering::Relaxed);
-                config.min_scan_delay
-            }
-            LoadLevel::Medium => {
-                // medium load: increase delay moderately
-                let delay = config.min_scan_delay * 5; // 500ms
-                self.scan_delay.store(delay, Ordering::Relaxed);
-                self.business_priority.store(config.base_business_priority, Ordering::Relaxed);
-                delay
-            }
-            LoadLevel::High => {
-                // high load: increase delay significantly
-                let delay = config.min_scan_delay * 10; // 50s
-                self.scan_delay.store(delay, Ordering::Relaxed);
-                self.business_priority
-                    .store(config.base_business_priority.saturating_add(3), Ordering::Relaxed);
-                delay
-            }
-            LoadLevel::Critical => {
-                // critical load: maximum delay or pause
-                let delay = config.max_scan_delay; // 60s
-                self.scan_delay.store(delay, Ordering::Relaxed);
-                self.business_priority.store(99, Ordering::Relaxed);
-                delay
-            }
-        };
-
-        let duration = Duration::from_millis(delay_ms);
-
-        debug!("Adjust scanning delay based on load level {:?}: {:?}", load_level, duration);
-
-        duration
-    }
-
-    /// create throttle decision
-    pub async fn make_throttle_decision(&self, load_level: LoadLevel, metrics: Option<MetricsSnapshot>) -> ThrottleDecision {
-        let _config = self.config.read().await;
-
-        let should_pause = matches!(load_level, LoadLevel::Critical);
-
-        let suggested_delay = self.adjust_for_load_level(load_level).await;
-
-        let resource_allocation = self.calculate_resource_allocation(load_level).await;
-
-        let reason = match load_level {
-            LoadLevel::Low => "system load is low, scanner can run normally".to_string(),
-            LoadLevel::Medium => "system load is moderate, scanner is running at reduced speed".to_string(),
-            LoadLevel::High => "system load is high, scanner is running at significantly reduced speed".to_string(),
-            LoadLevel::Critical => "system load is too high, scanner is paused".to_string(),
-        };
-
-        let decision = ThrottleDecision {
-            should_pause,
-            suggested_delay,
-            resource_allocation,
-            reason,
-        };
-
-        // record decision history
-        if let Some(snapshot) = metrics {
-            self.record_throttle_decision(load_level, decision.clone(), snapshot).await;
-        }
-
-        decision
-    }
-
-    /// calculate resource allocation
-    async fn calculate_resource_allocation(&self, load_level: LoadLevel) -> ResourceAllocation {
-        let strategy = *self.allocation_strategy.read().await;
-
-        let (business_pct, scanner_pct) = match (strategy, load_level) {
-            (ResourceAllocationStrategy::BusinessFirst, LoadLevel::Low) => (90, 10),
-            (ResourceAllocationStrategy::BusinessFirst, LoadLevel::Medium) => (95, 5),
-            (ResourceAllocationStrategy::BusinessFirst, LoadLevel::High) => (98, 2),
-            (ResourceAllocationStrategy::BusinessFirst, LoadLevel::Critical) => (99, 1),
-
-            (ResourceAllocationStrategy::Balanced, LoadLevel::Low) => (80, 20),
-            (ResourceAllocationStrategy::Balanced, LoadLevel::Medium) => (85, 15),
-            (ResourceAllocationStrategy::Balanced, LoadLevel::High) => (90, 10),
-            (ResourceAllocationStrategy::Balanced, LoadLevel::Critical) => (95, 5),
-
-            (ResourceAllocationStrategy::MaintenanceFirst, _) => (70, 30), // special maintenance mode
-        };
-
-        ResourceAllocation {
-            business_percentage: business_pct,
-            scanner_percentage: scanner_pct,
-            strategy,
-        }
-    }
-
-    /// check whether should pause scanning
-    pub async fn should_pause_scanning(&self, load_level: LoadLevel) -> bool {
-        match load_level {
-            LoadLevel::Critical => {
-                warn!("System load reached critical level, pausing scanner");
-                true
-            }
-            _ => false,
-        }
-    }
-
-    /// record throttle decision
-    async fn record_throttle_decision(&self, load_level: LoadLevel, decision: ThrottleDecision, metrics: MetricsSnapshot) {
-        let record = ThrottleRecord {
-            timestamp: SystemTime::now(),
-            load_level,
-            decision,
-            metrics_snapshot: metrics,
-        };
-
-        let mut history = self.throttle_history.write().await;
-        history.push(record);
-
-        // keep history record in reasonable range (last 1000 records)
-        while history.len() > 1000 {
-            history.remove(0);
-        }
-    }
-
-    /// set resource allocation strategy
-    pub async fn set_allocation_strategy(&self, strategy: ResourceAllocationStrategy) {
-        *self.allocation_strategy.write().await = strategy;
-        info!("Set resource allocation strategy: {:?}", strategy);
-    }
-
-    /// get current resource allocation
-    pub async fn get_current_allocation(&self) -> ResourceAllocation {
-        let current_load = LoadLevel::Low; // need to get from external
-        self.calculate_resource_allocation(current_load).await
-    }
-
-    /// get throttle history
-    pub async fn get_throttle_history(&self) -> Vec<ThrottleRecord> {
-        self.throttle_history.read().await.clone()
-    }
-
-    /// get throttle stats
-    pub async fn get_throttle_stats(&self) -> ThrottleStats {
-        let history = self.throttle_history.read().await;
-
-        let total_decisions = history.len();
-        let pause_decisions = history.iter().filter(|r| r.decision.should_pause).count();
-
-        let mut delay_sum = Duration::ZERO;
-        for record in history.iter() {
-            delay_sum += record.decision.suggested_delay;
-        }
-
-        let avg_delay = if total_decisions > 0 {
-            delay_sum / total_decisions as u32
-        } else {
-            Duration::ZERO
-        };
-
-        // count by load level
-        let low_count = history.iter().filter(|r| r.load_level == LoadLevel::Low).count();
-        let medium_count = history.iter().filter(|r| r.load_level == LoadLevel::Medium).count();
-        let high_count = history.iter().filter(|r| r.load_level == LoadLevel::High).count();
-        let critical_count = history.iter().filter(|r| r.load_level == LoadLevel::Critical).count();
-
-        ThrottleStats {
-            total_decisions,
-            pause_decisions,
-            average_delay: avg_delay,
-            load_level_distribution: LoadLevelDistribution {
-                low_count,
-                medium_count,
-                high_count,
-                critical_count,
-            },
-        }
-    }
-
-    /// reset throttle history
-    pub async fn reset_history(&self) {
-        self.throttle_history.write().await.clear();
-        info!("Reset throttle history");
-    }
-
-    /// update config
-    pub async fn update_config(&self, new_config: IOThrottlerConfig) {
-        *self.config.write().await = new_config;
-        info!("Updated IO throttler configuration");
-    }
-
-    /// get current scanning delay
-    pub fn get_current_scan_delay(&self) -> Duration {
-        let delay_ms = self.scan_delay.load(Ordering::Relaxed);
-        Duration::from_millis(delay_ms)
-    }
-
-    /// get current business priority
-    pub fn get_current_business_priority(&self) -> u8 {
-        self.business_priority.load(Ordering::Relaxed)
-    }
-
-    /// simulate business load pressure test
-    pub async fn simulate_business_pressure(&self, duration: Duration) -> SimulationResult {
-        info!("Start simulating business load pressure test, duration: {:?}", duration);
-
-        let start_time = SystemTime::now();
-        let mut simulation_records = Vec::new();
-
-        // simulate different load level changes
-        let load_levels = [
-            LoadLevel::Low,
-            LoadLevel::Medium,
-            LoadLevel::High,
-            LoadLevel::Critical,
-            LoadLevel::High,
-            LoadLevel::Medium,
-            LoadLevel::Low,
-        ];
-
-        let step_duration = duration / load_levels.len() as u32;
-
-        for (i, &load_level) in load_levels.iter().enumerate() {
-            let _step_start = SystemTime::now();
-
-            // simulate metrics for this load level
-            let metrics = MetricsSnapshot {
-                iops: match load_level {
-                    LoadLevel::Low => 200,
-                    LoadLevel::Medium => 500,
-                    LoadLevel::High => 800,
-                    LoadLevel::Critical => 1200,
-                },
-                latency: match load_level {
-                    LoadLevel::Low => 10,
-                    LoadLevel::Medium => 25,
-                    LoadLevel::High => 60,
-                    LoadLevel::Critical => 150,
-                },
-                cpu_usage: match load_level {
-                    LoadLevel::Low => 30,
-                    LoadLevel::Medium => 50,
-                    LoadLevel::High => 75,
-                    LoadLevel::Critical => 95,
-                },
-                memory_usage: match load_level {
-                    LoadLevel::Low => 40,
-                    LoadLevel::Medium => 60,
-                    LoadLevel::High => 80,
-                    LoadLevel::Critical => 90,
-                },
-            };
-
-            let decision = self.make_throttle_decision(load_level, Some(metrics.clone())).await;
-
-            simulation_records.push(SimulationRecord {
-                step: i + 1,
-                load_level,
-                metrics,
-                decision: decision.clone(),
-                step_duration,
-            });
-
-            info!(
-                "simulate step {}: load={:?}, delay={:?}, pause={}",
-                i + 1,
-                load_level,
-                decision.suggested_delay,
-                decision.should_pause
-            );
-
-            // wait for step duration
-            tokio::time::sleep(step_duration).await;
-        }
-
-        let total_duration = SystemTime::now().duration_since(start_time).unwrap_or(Duration::ZERO);
-
-        SimulationResult {
-            total_duration,
-            simulation_records,
-            final_stats: self.get_throttle_stats().await,
-        }
-    }
-}
-
-/// throttle stats
-#[derive(Debug, Clone)]
-pub struct ThrottleStats {
-    /// total decisions
-    pub total_decisions: usize,
-    /// pause decisions
-    pub pause_decisions: usize,
-    /// average delay
-    pub average_delay: Duration,
-    /// load level distribution
-    pub load_level_distribution: LoadLevelDistribution,
-}
-
-/// load level distribution
-#[derive(Debug, Clone)]
-pub struct LoadLevelDistribution {
-    /// low load count
-    pub low_count: usize,
-    /// medium load count
-    pub medium_count: usize,
-    /// high load count
-    pub high_count: usize,
-    /// critical load count
-    pub critical_count: usize,
-}
-
-/// simulation result
-#[derive(Debug, Clone)]
-pub struct SimulationResult {
-    /// total duration
-    pub total_duration: Duration,
-    /// simulation records
-    pub simulation_records: Vec<SimulationRecord>,
-    /// final stats
-    pub final_stats: ThrottleStats,
-}
-
-/// simulation record
-#[derive(Debug, Clone)]
-pub struct SimulationRecord {
-    /// step number
-    pub step: usize,
-    /// load level
-    pub load_level: LoadLevel,
-    /// metrics snapshot
-    pub metrics: MetricsSnapshot,
-    /// throttle decision
-    pub decision: ThrottleDecision,
-    /// step duration
-    pub step_duration: Duration,
-}
-
-impl Default for AdvancedIOThrottler {
-    fn default() -> Self {
-        Self::new(IOThrottlerConfig::default())
-    }
-}

crates/ahm/src/scanner/lifecycle.rs

@@ -1,269 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::Result;
-use rustfs_common::data_usage::SizeSummary;
-use rustfs_common::metrics::IlmAction;
-use rustfs_ecstore::bucket::{
-    lifecycle::{
-        bucket_lifecycle_audit::LcEventSrc,
-        bucket_lifecycle_ops::{GLOBAL_ExpiryState, apply_lifecycle_action, eval_action_from_lifecycle},
-        lifecycle,
-        lifecycle::Lifecycle,
-    },
-    metadata_sys::get_object_lock_config,
-    object_lock::objectlock_sys::{BucketObjectLockSys, enforce_retention_for_deletion},
-    versioning::VersioningApi,
-    versioning_sys::BucketVersioningSys,
-};
-use rustfs_ecstore::store_api::{ObjectInfo, ObjectToDelete};
-use rustfs_filemeta::FileInfo;
-use s3s::dto::{BucketLifecycleConfiguration as LifecycleConfig, VersioningConfiguration};
-use std::sync::{
-    Arc,
-    atomic::{AtomicU64, Ordering},
-};
-use time::OffsetDateTime;
-use tracing::info;
-
-static SCANNER_EXCESS_OBJECT_VERSIONS: AtomicU64 = AtomicU64::new(100);
-static SCANNER_EXCESS_OBJECT_VERSIONS_TOTAL_SIZE: AtomicU64 = AtomicU64::new(1024 * 1024 * 1024 * 1024); // 1 TB
-
-#[derive(Clone)]
-pub struct ScannerItem {
-    pub bucket: String,
-    pub object_name: String,
-    pub lifecycle: Option<Arc<LifecycleConfig>>,
-    pub versioning: Option<Arc<VersioningConfiguration>>,
-}
-
-impl ScannerItem {
-    pub fn new(
-        bucket: String,
-        lifecycle: Option<Arc<LifecycleConfig>>,
-        versioning: Option<Arc<VersioningConfiguration>>,
-    ) -> Self {
-        Self {
-            bucket,
-            object_name: "".to_string(),
-            lifecycle,
-            versioning,
-        }
-    }
-
-    pub async fn apply_versions_actions(&self, fivs: &[FileInfo]) -> Result<Vec<ObjectInfo>> {
-        let obj_infos = self.apply_newer_noncurrent_version_limit(fivs).await?;
-        if obj_infos.len() >= SCANNER_EXCESS_OBJECT_VERSIONS.load(Ordering::SeqCst) as usize {
-            // todo
-        }
-
-        let mut cumulative_size = 0;
-        for obj_info in obj_infos.iter() {
-            cumulative_size += obj_info.size;
-        }
-
-        if cumulative_size >= SCANNER_EXCESS_OBJECT_VERSIONS_TOTAL_SIZE.load(Ordering::SeqCst) as i64 {
-            //todo
-        }
-
-        Ok(obj_infos)
-    }
-
-    pub async fn apply_newer_noncurrent_version_limit(&self, fivs: &[FileInfo]) -> Result<Vec<ObjectInfo>> {
-        let lock_enabled = if let Some(rcfg) = BucketObjectLockSys::get(&self.bucket).await {
-            rcfg.mode.is_some()
-        } else {
-            false
-        };
-        let _vcfg = BucketVersioningSys::get(&self.bucket).await?;
-
-        let versioned = match BucketVersioningSys::get(&self.bucket).await {
-            Ok(vcfg) => vcfg.versioned(&self.object_name),
-            Err(_) => false,
-        };
-        let mut object_infos = Vec::with_capacity(fivs.len());
-
-        if self.lifecycle.is_none() {
-            for info in fivs.iter() {
-                object_infos.push(ObjectInfo::from_file_info(info, &self.bucket, &self.object_name, versioned));
-            }
-            return Ok(object_infos);
-        }
-
-        let event = self
-            .lifecycle
-            .as_ref()
-            .expect("lifecycle err.")
-            .clone()
-            .noncurrent_versions_expiration_limit(&lifecycle::ObjectOpts {
-                name: self.object_name.clone(),
-                ..Default::default()
-            })
-            .await;
-        let lim = event.newer_noncurrent_versions;
-        if lim == 0 || fivs.len() <= lim + 1 {
-            for fi in fivs.iter() {
-                object_infos.push(ObjectInfo::from_file_info(fi, &self.bucket, &self.object_name, versioned));
-            }
-            return Ok(object_infos);
-        }
-
-        let overflow_versions = &fivs[lim + 1..];
-        for fi in fivs[..lim + 1].iter() {
-            object_infos.push(ObjectInfo::from_file_info(fi, &self.bucket, &self.object_name, versioned));
-        }
-
-        let mut to_del = Vec::<ObjectToDelete>::with_capacity(overflow_versions.len());
-        for fi in overflow_versions.iter() {
-            let obj = ObjectInfo::from_file_info(fi, &self.bucket, &self.object_name, versioned);
-            if lock_enabled && enforce_retention_for_deletion(&obj) {
-                //if enforce_retention_for_deletion(&obj) {
-                /*if self.debug {
-                    if obj.version_id.is_some() {
-                        info!("lifecycle: {} v({}) is locked, not deleting\n", obj.name, obj.version_id.expect("err"));
-                    } else {
-                        info!("lifecycle: {} is locked, not deleting\n", obj.name);
-                    }
-                }*/
-                object_infos.push(obj);
-                continue;
-            }
-
-            if OffsetDateTime::now_utc().unix_timestamp()
-                < lifecycle::expected_expiry_time(obj.successor_mod_time.expect("err"), event.noncurrent_days as i32)
-                    .unix_timestamp()
-            {
-                object_infos.push(obj);
-                continue;
-            }
-
-            to_del.push(ObjectToDelete {
-                object_name: obj.name,
-                version_id: obj.version_id,
-                ..Default::default()
-            });
-        }
-
-        if !to_del.is_empty() {
-            let mut expiry_state = GLOBAL_ExpiryState.write().await;
-            expiry_state.enqueue_by_newer_noncurrent(&self.bucket, to_del, event).await;
-        }
-
-        Ok(object_infos)
-    }
-
-    pub async fn apply_actions(&mut self, oi: &ObjectInfo, _size_s: &mut SizeSummary) -> (bool, i64) {
-        let (action, _size) = self.apply_lifecycle(oi).await;
-
-        info!(
-            "apply_actions {} {} {:?} {:?}",
-            oi.bucket.clone(),
-            oi.name.clone(),
-            oi.version_id.clone(),
-            oi.user_defined.clone()
-        );
-
-        // Create a mutable clone if you need to modify fields
-        /*let mut oi = oi.clone();
-        oi.replication_status = ReplicationStatusType::from(
-            oi.user_defined
-                .get("x-amz-bucket-replication-status")
-                .unwrap_or(&"PENDING".to_string()),
-        );
-        info!("apply status is: {:?}", oi.replication_status);
-        self.heal_replication(&oi, _size_s).await;*/
-
-        if action.delete_all() {
-            return (true, 0);
-        }
-
-        (false, oi.size)
-    }
-
-    async fn apply_lifecycle(&mut self, oi: &ObjectInfo) -> (IlmAction, i64) {
-        let size = oi.size;
-        if self.lifecycle.is_none() {
-            info!("apply_lifecycle: No lifecycle config for object: {}", oi.name);
-            return (IlmAction::NoneAction, size);
-        }
-
-        info!("apply_lifecycle: Lifecycle config exists for object: {}", oi.name);
-
-        let (olcfg, rcfg) = if self.bucket != ".minio.sys" {
-            (
-                get_object_lock_config(&self.bucket).await.ok(),
-                None, // FIXME: replication config
-            )
-        } else {
-            (None, None)
-        };
-
-        info!("apply_lifecycle: Evaluating lifecycle for object: {}", oi.name);
-
-        let lifecycle = match self.lifecycle.as_ref() {
-            Some(lc) => lc,
-            None => {
-                info!("No lifecycle configuration found for object: {}", oi.name);
-                return (IlmAction::NoneAction, 0);
-            }
-        };
-
-        let lc_evt = eval_action_from_lifecycle(
-            lifecycle,
-            olcfg
-                .as_ref()
-                .and_then(|(c, _)| c.rule.as_ref().and_then(|r| r.default_retention.clone())),
-            rcfg.clone(),
-            oi, // Pass oi directly
-        )
-        .await;
-
-        info!("lifecycle: {} Initial scan: {} (action: {:?})", oi.name, lc_evt.action, lc_evt.action);
-
-        let mut new_size = size;
-        match lc_evt.action {
-            IlmAction::DeleteVersionAction | IlmAction::DeleteAllVersionsAction | IlmAction::DelMarkerDeleteAllVersionsAction => {
-                info!("apply_lifecycle: Object {} marked for version deletion, new_size=0", oi.name);
-                new_size = 0;
-            }
-            IlmAction::DeleteAction => {
-                info!("apply_lifecycle: Object {} marked for deletion", oi.name);
-                if let Some(vcfg) = &self.versioning {
-                    if !vcfg.enabled() {
-                        info!("apply_lifecycle: Versioning disabled, setting new_size=0");
-                        new_size = 0;
-                    }
-                } else {
-                    info!("apply_lifecycle: No versioning config, setting new_size=0");
-                    new_size = 0;
-                }
-            }
-            IlmAction::NoneAction => {
-                info!("apply_lifecycle: No action for object {}", oi.name);
-            }
-            _ => {
-                info!("apply_lifecycle: Other action {:?} for object {}", lc_evt.action, oi.name);
-            }
-        }
-
-        if lc_evt.action != IlmAction::NoneAction {
-            info!("apply_lifecycle: Applying lifecycle action {:?} for object {}", lc_evt.action, oi.name);
-            apply_lifecycle_action(&lc_evt, &LcEventSrc::Scanner, oi).await;
-        } else {
-            info!("apply_lifecycle: Skipping lifecycle action for object {} as no action is needed", oi.name);
-        }
-
-        (lc_evt.action, new_size)
-    }
-}

crates/ahm/src/scanner/local_scan/mod.rs

@@ -1,684 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::{Error, Result};
-use rustfs_common::data_usage::DiskUsageStatus;
-use rustfs_ecstore::data_usage::{
-    LocalUsageSnapshot, LocalUsageSnapshotMeta, data_usage_state_dir, ensure_data_usage_layout, snapshot_file_name,
-    write_local_snapshot,
-};
-use rustfs_ecstore::disk::DiskAPI;
-use rustfs_ecstore::store::ECStore;
-use rustfs_ecstore::store_api::ObjectInfo;
-use rustfs_filemeta::{FileInfo, FileMeta, FileMetaVersion, VersionType};
-use serde::{Deserialize, Serialize};
-use serde_json::{from_slice, to_vec};
-use std::collections::{HashMap, HashSet};
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use std::time::{SystemTime, UNIX_EPOCH};
-use tokio::{fs, task};
-use tracing::warn;
-use walkdir::WalkDir;
-
-const STATE_FILE_EXTENSION: &str = "";
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct LocalObjectUsage {
-    pub bucket: String,
-    pub object: String,
-    pub last_modified_ns: Option<i128>,
-    pub versions_count: u64,
-    pub delete_markers_count: u64,
-    pub total_size: u64,
-    pub has_live_object: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-struct IncrementalScanState {
-    last_scan_ns: Option<i128>,
-    objects: HashMap<String, LocalObjectUsage>,
-}
-
-struct DiskScanResult {
-    snapshot: LocalUsageSnapshot,
-    state: IncrementalScanState,
-    objects_by_bucket: HashMap<String, Vec<LocalObjectRecord>>,
-    status: DiskUsageStatus,
-}
-
-#[derive(Debug, Clone)]
-pub struct LocalObjectRecord {
-    pub usage: LocalObjectUsage,
-    pub object_info: Option<rustfs_ecstore::store_api::ObjectInfo>,
-}
-
-#[derive(Debug, Default)]
-pub struct LocalScanOutcome {
-    pub snapshots: Vec<LocalUsageSnapshot>,
-    pub bucket_objects: HashMap<String, Vec<LocalObjectRecord>>,
-    pub disk_status: Vec<DiskUsageStatus>,
-}
-
-/// Scan all local primary disks and persist refreshed usage snapshots.
-pub async fn scan_and_persist_local_usage(store: Arc<ECStore>) -> Result<LocalScanOutcome> {
-    let mut snapshots = Vec::new();
-    let mut bucket_objects: HashMap<String, Vec<LocalObjectRecord>> = HashMap::new();
-    let mut disk_status = Vec::new();
-
-    for (pool_idx, pool) in store.pools.iter().enumerate() {
-        for set_disks in pool.disk_set.iter() {
-            let disks = {
-                let guard = set_disks.disks.read().await;
-                guard.clone()
-            };
-
-            // Use the first local online disk in the set to avoid missing stats when disk 0 is down
-            let mut picked = false;
-
-            for (disk_index, disk_opt) in disks.into_iter().enumerate() {
-                let Some(disk) = disk_opt else {
-                    continue;
-                };
-
-                if !disk.is_local() {
-                    continue;
-                }
-
-                if picked {
-                    continue;
-                }
-
-                // Skip offline disks; keep looking for an online candidate
-                if !disk.is_online().await {
-                    continue;
-                }
-
-                picked = true;
-
-                let disk_id = match disk.get_disk_id().await.map_err(Error::from)? {
-                    Some(id) => id.to_string(),
-                    None => {
-                        warn!("Skipping disk without ID: {}", disk.to_string());
-                        continue;
-                    }
-                };
-
-                let root = disk.path();
-                ensure_data_usage_layout(root.as_path()).await.map_err(Error::from)?;
-
-                let meta = LocalUsageSnapshotMeta {
-                    disk_id: disk_id.clone(),
-                    pool_index: Some(pool_idx),
-                    set_index: Some(set_disks.set_index),
-                    disk_index: Some(disk_index),
-                };
-
-                let state_path = state_file_path(root.as_path(), &disk_id);
-                let state = read_scan_state(&state_path).await?;
-
-                let root_clone = root.clone();
-                let meta_clone = meta.clone();
-
-                let handle = task::spawn_blocking(move || scan_disk_blocking(root_clone, meta_clone, state));
-
-                match handle.await {
-                    Ok(Ok(result)) => {
-                        write_local_snapshot(root.as_path(), &disk_id, &result.snapshot)
-                            .await
-                            .map_err(Error::from)?;
-                        write_scan_state(&state_path, &result.state).await?;
-                        snapshots.push(result.snapshot);
-                        for (bucket, records) in result.objects_by_bucket {
-                            bucket_objects.entry(bucket).or_default().extend(records.into_iter());
-                        }
-                        disk_status.push(result.status);
-                    }
-                    Ok(Err(err)) => {
-                        warn!("Failed to scan disk {}: {}", disk.to_string(), err);
-                    }
-                    Err(join_err) => {
-                        warn!("Disk scan task panicked for disk {}: {}", disk.to_string(), join_err);
-                    }
-                }
-            }
-        }
-    }
-
-    Ok(LocalScanOutcome {
-        snapshots,
-        bucket_objects,
-        disk_status,
-    })
-}
-
-fn scan_disk_blocking(root: PathBuf, meta: LocalUsageSnapshotMeta, mut state: IncrementalScanState) -> Result<DiskScanResult> {
-    let now = SystemTime::now();
-    let now_ns = system_time_to_ns(now);
-    let mut visited: HashSet<String> = HashSet::new();
-    let mut emitted: HashSet<String> = HashSet::new();
-    let mut objects_by_bucket: HashMap<String, Vec<LocalObjectRecord>> = HashMap::new();
-    let mut status = DiskUsageStatus {
-        disk_id: meta.disk_id.clone(),
-        pool_index: meta.pool_index,
-        set_index: meta.set_index,
-        disk_index: meta.disk_index,
-        last_update: None,
-        snapshot_exists: false,
-    };
-
-    for entry in WalkDir::new(&root).follow_links(false).into_iter().filter_map(|res| res.ok()) {
-        if !entry.file_type().is_file() {
-            continue;
-        }
-
-        if entry.file_name() != "xl.meta" {
-            continue;
-        }
-
-        let xl_path = entry.path().to_path_buf();
-        let Some(object_dir) = xl_path.parent() else {
-            continue;
-        };
-
-        let Some(rel_path) = object_dir.strip_prefix(&root).ok().map(normalize_path) else {
-            continue;
-        };
-
-        let mut components = rel_path.split('/');
-        let Some(bucket_name) = components.next() else {
-            continue;
-        };
-
-        if bucket_name.starts_with('.') {
-            continue;
-        }
-
-        let object_key = components.collect::<Vec<_>>().join("/");
-
-        visited.insert(rel_path.clone());
-
-        let metadata = match std::fs::metadata(&xl_path) {
-            Ok(meta) => meta,
-            Err(err) => {
-                warn!("Failed to read metadata for {xl_path:?}: {err}");
-                continue;
-            }
-        };
-
-        let mtime_ns = metadata.modified().ok().map(system_time_to_ns);
-
-        let should_parse = match state.objects.get(&rel_path) {
-            Some(existing) => existing.last_modified_ns != mtime_ns,
-            None => true,
-        };
-
-        if should_parse {
-            match std::fs::read(&xl_path) {
-                Ok(buf) => match FileMeta::load(&buf) {
-                    Ok(file_meta) => match compute_object_usage(bucket_name, object_key.as_str(), &file_meta) {
-                        Ok(Some(mut record)) => {
-                            record.usage.last_modified_ns = mtime_ns;
-                            state.objects.insert(rel_path.clone(), record.usage.clone());
-                            emitted.insert(rel_path.clone());
-                            objects_by_bucket.entry(record.usage.bucket.clone()).or_default().push(record);
-                        }
-                        Ok(None) => {
-                            state.objects.remove(&rel_path);
-                        }
-                        Err(err) => {
-                            warn!("Failed to parse usage from {:?}: {}", xl_path, err);
-                        }
-                    },
-                    Err(err) => {
-                        warn!("Failed to decode xl.meta {:?}: {}", xl_path, err);
-                    }
-                },
-                Err(err) => {
-                    warn!("Failed to read xl.meta {:?}: {}", xl_path, err);
-                }
-            }
-        }
-    }
-
-    state.objects.retain(|key, _| visited.contains(key));
-    state.last_scan_ns = Some(now_ns);
-
-    for (key, usage) in &state.objects {
-        if emitted.contains(key) {
-            continue;
-        }
-        objects_by_bucket
-            .entry(usage.bucket.clone())
-            .or_default()
-            .push(LocalObjectRecord {
-                usage: usage.clone(),
-                object_info: None,
-            });
-    }
-
-    let snapshot = build_snapshot(meta, &state.objects, now);
-    status.snapshot_exists = true;
-    status.last_update = Some(now);
-
-    Ok(DiskScanResult {
-        snapshot,
-        state,
-        objects_by_bucket,
-        status,
-    })
-}
-
-fn compute_object_usage(bucket: &str, object: &str, file_meta: &FileMeta) -> Result<Option<LocalObjectRecord>> {
-    let mut versions_count = 0u64;
-    let mut delete_markers_count = 0u64;
-    let mut total_size = 0u64;
-    let mut has_live_object = false;
-
-    let mut latest_file_info: Option<FileInfo> = None;
-
-    for shallow in &file_meta.versions {
-        match shallow.header.version_type {
-            VersionType::Object => {
-                let version = match FileMetaVersion::try_from(shallow.meta.as_slice()) {
-                    Ok(version) => version,
-                    Err(err) => {
-                        warn!("Failed to parse file meta version: {}", err);
-                        continue;
-                    }
-                };
-                if let Some(obj) = version.object {
-                    if !has_live_object {
-                        total_size = obj.size.max(0) as u64;
-                    }
-                    has_live_object = true;
-                    versions_count = versions_count.saturating_add(1);
-
-                    if latest_file_info.is_none()
-                        && let Ok(info) = file_meta.into_fileinfo(bucket, object, "", false, false, false)
-                    {
-                        latest_file_info = Some(info);
-                    }
-                }
-            }
-            VersionType::Delete => {
-                delete_markers_count = delete_markers_count.saturating_add(1);
-                versions_count = versions_count.saturating_add(1);
-            }
-            _ => {}
-        }
-    }
-
-    if !has_live_object && delete_markers_count == 0 {
-        return Ok(None);
-    }
-
-    let object_info = latest_file_info.as_ref().map(|fi| {
-        let versioned = fi.version_id.is_some();
-        ObjectInfo::from_file_info(fi, bucket, object, versioned)
-    });
-
-    Ok(Some(LocalObjectRecord {
-        usage: LocalObjectUsage {
-            bucket: bucket.to_string(),
-            object: object.to_string(),
-            last_modified_ns: None,
-            versions_count,
-            delete_markers_count,
-            total_size,
-            has_live_object,
-        },
-        object_info,
-    }))
-}
-
-fn build_snapshot(
-    meta: LocalUsageSnapshotMeta,
-    objects: &HashMap<String, LocalObjectUsage>,
-    now: SystemTime,
-) -> LocalUsageSnapshot {
-    let mut snapshot = LocalUsageSnapshot::new(meta);
-
-    for usage in objects.values() {
-        let bucket_entry = snapshot.buckets_usage.entry(usage.bucket.clone()).or_default();
-
-        if usage.has_live_object {
-            bucket_entry.objects_count = bucket_entry.objects_count.saturating_add(1);
-        }
-        bucket_entry.versions_count = bucket_entry.versions_count.saturating_add(usage.versions_count);
-        bucket_entry.delete_markers_count = bucket_entry.delete_markers_count.saturating_add(usage.delete_markers_count);
-        bucket_entry.size = bucket_entry.size.saturating_add(usage.total_size);
-    }
-
-    snapshot.last_update = Some(now);
-    snapshot.recompute_totals();
-    snapshot
-}
-
-fn normalize_path(path: &Path) -> String {
-    path.iter()
-        .map(|component| component.to_string_lossy())
-        .collect::<Vec<_>>()
-        .join("/")
-}
-
-fn system_time_to_ns(time: SystemTime) -> i128 {
-    match time.duration_since(UNIX_EPOCH) {
-        Ok(duration) => {
-            let secs = duration.as_secs() as i128;
-            let nanos = duration.subsec_nanos() as i128;
-            secs * 1_000_000_000 + nanos
-        }
-        Err(err) => {
-            let duration = err.duration();
-            let secs = duration.as_secs() as i128;
-            let nanos = duration.subsec_nanos() as i128;
-            -(secs * 1_000_000_000 + nanos)
-        }
-    }
-}
-
-fn state_file_path(root: &Path, disk_id: &str) -> PathBuf {
-    let mut path = data_usage_state_dir(root);
-    path.push(format!("{}{}", snapshot_file_name(disk_id), STATE_FILE_EXTENSION));
-    path
-}
-
-async fn read_scan_state(path: &Path) -> Result<IncrementalScanState> {
-    match fs::read(path).await {
-        Ok(bytes) => from_slice(&bytes).map_err(|err| Error::Serialization(err.to_string())),
-        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(IncrementalScanState::default()),
-        Err(err) => Err(err.into()),
-    }
-}
-
-async fn write_scan_state(path: &Path, state: &IncrementalScanState) -> Result<()> {
-    if let Some(parent) = path.parent() {
-        fs::create_dir_all(parent).await?;
-    }
-    let data = to_vec(state).map_err(|err| Error::Serialization(err.to_string()))?;
-    fs::write(path, data).await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rustfs_filemeta::{ChecksumAlgo, ErasureAlgo, FileMetaShallowVersion, MetaDeleteMarker, MetaObject};
-    use std::collections::HashMap;
-    use std::fs;
-    use tempfile::TempDir;
-    use time::OffsetDateTime;
-    use uuid::Uuid;
-
-    fn build_file_meta_with_object(erasure_index: usize, size: i64) -> FileMeta {
-        let mut file_meta = FileMeta::default();
-
-        let meta_object = MetaObject {
-            version_id: Some(Uuid::new_v4()),
-            data_dir: Some(Uuid::new_v4()),
-            erasure_algorithm: ErasureAlgo::ReedSolomon,
-            erasure_m: 2,
-            erasure_n: 2,
-            erasure_block_size: 4096,
-            erasure_index,
-            erasure_dist: vec![0_u8, 1, 2, 3],
-            bitrot_checksum_algo: ChecksumAlgo::HighwayHash,
-            part_numbers: vec![1],
-            part_etags: vec!["etag".to_string()],
-            part_sizes: vec![size as usize],
-            part_actual_sizes: vec![size],
-            part_indices: Vec::new(),
-            size,
-            mod_time: Some(OffsetDateTime::now_utc()),
-            meta_sys: HashMap::new(),
-            meta_user: HashMap::new(),
-        };
-
-        let version = FileMetaVersion {
-            version_type: VersionType::Object,
-            object: Some(meta_object),
-            delete_marker: None,
-            write_version: 1,
-        };
-
-        let shallow = FileMetaShallowVersion::try_from(version).expect("convert version");
-        file_meta.versions.push(shallow);
-        file_meta
-    }
-
-    fn build_file_meta_with_delete_marker() -> FileMeta {
-        let mut file_meta = FileMeta::default();
-
-        let delete_marker = MetaDeleteMarker {
-            version_id: Some(Uuid::new_v4()),
-            mod_time: Some(OffsetDateTime::now_utc()),
-            meta_sys: HashMap::new(),
-        };
-
-        let version = FileMetaVersion {
-            version_type: VersionType::Delete,
-            object: None,
-            delete_marker: Some(delete_marker),
-            write_version: 2,
-        };
-
-        let shallow = FileMetaShallowVersion::try_from(version).expect("convert delete marker");
-        file_meta.versions.push(shallow);
-        file_meta
-    }
-
-    #[test]
-    fn compute_object_usage_primary_disk() {
-        let file_meta = build_file_meta_with_object(0, 1024);
-        let record = compute_object_usage("bucket", "foo/bar", &file_meta)
-            .expect("compute usage")
-            .expect("record should exist");
-
-        assert!(record.usage.has_live_object);
-        assert_eq!(record.usage.bucket, "bucket");
-        assert_eq!(record.usage.object, "foo/bar");
-        assert_eq!(record.usage.total_size, 1024);
-        assert!(record.object_info.is_some(), "object info should be synthesized");
-    }
-
-    #[test]
-    fn compute_object_usage_handles_non_primary_disk() {
-        let file_meta = build_file_meta_with_object(1, 2048);
-        let record = compute_object_usage("bucket", "obj", &file_meta)
-            .expect("compute usage")
-            .expect("record should exist for non-primary shard");
-        assert!(record.usage.has_live_object);
-    }
-
-    #[test]
-    fn compute_object_usage_reports_delete_marker() {
-        let file_meta = build_file_meta_with_delete_marker();
-        let record = compute_object_usage("bucket", "obj", &file_meta)
-            .expect("compute usage")
-            .expect("delete marker record");
-
-        assert!(!record.usage.has_live_object);
-        assert_eq!(record.usage.delete_markers_count, 1);
-        assert_eq!(record.usage.versions_count, 1);
-    }
-
-    #[test]
-    fn build_snapshot_accumulates_usage() {
-        let mut objects = HashMap::new();
-        objects.insert(
-            "bucket/a".to_string(),
-            LocalObjectUsage {
-                bucket: "bucket".to_string(),
-                object: "a".to_string(),
-                last_modified_ns: None,
-                versions_count: 2,
-                delete_markers_count: 1,
-                total_size: 512,
-                has_live_object: true,
-            },
-        );
-
-        let snapshot = build_snapshot(LocalUsageSnapshotMeta::default(), &objects, SystemTime::now());
-        let usage = snapshot.buckets_usage.get("bucket").expect("bucket entry should exist");
-        assert_eq!(usage.objects_count, 1);
-        assert_eq!(usage.versions_count, 2);
-        assert_eq!(usage.delete_markers_count, 1);
-        assert_eq!(usage.size, 512);
-    }
-
-    #[test]
-    fn scan_disk_blocking_handles_incremental_updates() {
-        let temp_dir = TempDir::new().expect("create temp dir");
-        let root = temp_dir.path();
-
-        let bucket_dir = root.join("bench");
-        let object1_dir = bucket_dir.join("obj1");
-        fs::create_dir_all(&object1_dir).expect("create first object directory");
-
-        let file_meta = build_file_meta_with_object(0, 1024);
-        let bytes = file_meta.marshal_msg().expect("serialize first object");
-        fs::write(object1_dir.join("xl.meta"), bytes).expect("write first xl.meta");
-
-        let meta = LocalUsageSnapshotMeta {
-            disk_id: "disk-test".to_string(),
-            ..Default::default()
-        };
-
-        let DiskScanResult {
-            snapshot: snapshot1,
-            state,
-            ..
-        } = scan_disk_blocking(root.to_path_buf(), meta.clone(), IncrementalScanState::default()).expect("initial scan succeeds");
-
-        let usage1 = snapshot1.buckets_usage.get("bench").expect("bucket stats recorded");
-        assert_eq!(usage1.objects_count, 1);
-        assert_eq!(usage1.size, 1024);
-        assert_eq!(state.objects.len(), 1);
-
-        let object2_dir = bucket_dir.join("nested").join("obj2");
-        fs::create_dir_all(&object2_dir).expect("create second object directory");
-        let second_meta = build_file_meta_with_object(0, 2048);
-        let bytes = second_meta.marshal_msg().expect("serialize second object");
-        fs::write(object2_dir.join("xl.meta"), bytes).expect("write second xl.meta");
-
-        let DiskScanResult {
-            snapshot: snapshot2,
-            state: state_next,
-            ..
-        } = scan_disk_blocking(root.to_path_buf(), meta.clone(), state).expect("incremental scan succeeds");
-
-        let usage2 = snapshot2
-            .buckets_usage
-            .get("bench")
-            .expect("bucket stats recorded after addition");
-        assert_eq!(usage2.objects_count, 2);
-        assert_eq!(usage2.size, 1024 + 2048);
-        assert_eq!(state_next.objects.len(), 2);
-
-        fs::remove_dir_all(&object1_dir).expect("remove first object");
-
-        let DiskScanResult {
-            snapshot: snapshot3,
-            state: state_final,
-            ..
-        } = scan_disk_blocking(root.to_path_buf(), meta, state_next).expect("scan after deletion succeeds");
-
-        let usage3 = snapshot3
-            .buckets_usage
-            .get("bench")
-            .expect("bucket stats recorded after deletion");
-        assert_eq!(usage3.objects_count, 1);
-        assert_eq!(usage3.size, 2048);
-        assert_eq!(state_final.objects.len(), 1);
-        assert!(
-            state_final.objects.keys().all(|path| path.contains("nested")),
-            "state should only keep surviving object"
-        );
-    }
-
-    #[test]
-    fn scan_disk_blocking_recovers_from_stale_state_entries() {
-        let temp_dir = TempDir::new().expect("create temp dir");
-        let root = temp_dir.path();
-
-        let mut stale_state = IncrementalScanState::default();
-        stale_state.objects.insert(
-            "bench/stale".to_string(),
-            LocalObjectUsage {
-                bucket: "bench".to_string(),
-                object: "stale".to_string(),
-                last_modified_ns: Some(42),
-                versions_count: 1,
-                delete_markers_count: 0,
-                total_size: 512,
-                has_live_object: true,
-            },
-        );
-        stale_state.last_scan_ns = Some(99);
-
-        let meta = LocalUsageSnapshotMeta {
-            disk_id: "disk-test".to_string(),
-            ..Default::default()
-        };
-
-        let DiskScanResult {
-            snapshot, state, status, ..
-        } = scan_disk_blocking(root.to_path_buf(), meta, stale_state).expect("scan succeeds");
-
-        assert!(state.objects.is_empty(), "stale entries should be cleared when files disappear");
-        assert!(
-            snapshot.buckets_usage.is_empty(),
-            "no real xl.meta files means bucket usage should stay empty"
-        );
-        assert!(status.snapshot_exists, "snapshot status should indicate a refresh");
-    }
-
-    #[test]
-    fn scan_disk_blocking_handles_large_volume() {
-        const OBJECTS: usize = 256;
-
-        let temp_dir = TempDir::new().expect("create temp dir");
-        let root = temp_dir.path();
-        let bucket_dir = root.join("bulk");
-
-        for idx in 0..OBJECTS {
-            let object_dir = bucket_dir.join(format!("obj-{idx:03}"));
-            fs::create_dir_all(&object_dir).expect("create object directory");
-            let size = 1024 + idx as i64;
-            let file_meta = build_file_meta_with_object(0, size);
-            let bytes = file_meta.marshal_msg().expect("serialize file meta");
-            fs::write(object_dir.join("xl.meta"), bytes).expect("write xl.meta");
-        }
-
-        let meta = LocalUsageSnapshotMeta {
-            disk_id: "disk-test".to_string(),
-            ..Default::default()
-        };
-
-        let DiskScanResult { snapshot, state, .. } =
-            scan_disk_blocking(root.to_path_buf(), meta, IncrementalScanState::default()).expect("bulk scan succeeds");
-
-        let bucket_usage = snapshot
-            .buckets_usage
-            .get("bulk")
-            .expect("bucket usage present for bulk scan");
-        assert_eq!(bucket_usage.objects_count as usize, OBJECTS, "should count all objects once");
-        assert!(
-            bucket_usage.size >= (1024 * OBJECTS) as u64,
-            "aggregated size should grow with object count"
-        );
-        assert_eq!(state.objects.len(), OBJECTS, "incremental state tracks every object");
-    }
-}

crates/ahm/src/scanner/local_stats.rs

@@ -1,430 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::scanner::node_scanner::{BucketStats, DiskStats, LocalScanStats};
-use crate::{Error, Result};
-use rustfs_common::data_usage::DataUsageInfo;
-use serde::{Deserialize, Serialize};
-use std::{
-    path::{Path, PathBuf},
-    sync::Arc,
-    sync::atomic::{AtomicU64, Ordering},
-    time::{Duration, SystemTime},
-};
-use tokio::sync::RwLock;
-use tracing::{debug, error, info, warn};
-
-/// local stats manager
-pub struct LocalStatsManager {
-    /// node id
-    node_id: String,
-    /// stats file path
-    stats_file: PathBuf,
-    /// backup file path
-    backup_file: PathBuf,
-    /// temp file path
-    temp_file: PathBuf,
-    /// local stats data
-    stats: Arc<RwLock<LocalScanStats>>,
-    /// save interval
-    save_interval: Duration,
-    /// last save time
-    last_save: Arc<RwLock<SystemTime>>,
-    /// stats counters
-    counters: Arc<StatsCounters>,
-}
-
-/// stats counters
-pub struct StatsCounters {
-    /// total scanned objects
-    pub total_objects_scanned: AtomicU64,
-    /// total healthy objects
-    pub total_healthy_objects: AtomicU64,
-    /// total corrupted objects  
-    pub total_corrupted_objects: AtomicU64,
-    /// total scanned bytes
-    pub total_bytes_scanned: AtomicU64,
-    /// total scan errors
-    pub total_scan_errors: AtomicU64,
-    /// total heal triggered
-    pub total_heal_triggered: AtomicU64,
-}
-
-impl Default for StatsCounters {
-    fn default() -> Self {
-        Self {
-            total_objects_scanned: AtomicU64::new(0),
-            total_healthy_objects: AtomicU64::new(0),
-            total_corrupted_objects: AtomicU64::new(0),
-            total_bytes_scanned: AtomicU64::new(0),
-            total_scan_errors: AtomicU64::new(0),
-            total_heal_triggered: AtomicU64::new(0),
-        }
-    }
-}
-
-/// scan result entry
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ScanResultEntry {
-    /// object path
-    pub object_path: String,
-    /// bucket name
-    pub bucket_name: String,
-    /// object size
-    pub object_size: u64,
-    /// is healthy
-    pub is_healthy: bool,
-    /// error message (if any)
-    pub error_message: Option<String>,
-    /// scan time
-    pub scan_time: SystemTime,
-    /// disk id
-    pub disk_id: String,
-}
-
-/// batch scan result
-#[derive(Debug, Clone)]
-pub struct BatchScanResult {
-    /// disk id
-    pub disk_id: String,
-    /// scan result entries
-    pub entries: Vec<ScanResultEntry>,
-    /// scan start time
-    pub scan_start: SystemTime,
-    /// scan end time
-    pub scan_end: SystemTime,
-    /// scan duration
-    pub scan_duration: Duration,
-}
-
-impl LocalStatsManager {
-    /// create new local stats manager
-    pub fn new(node_id: &str, data_dir: &Path) -> Self {
-        // ensure data directory exists
-        if !data_dir.exists()
-            && let Err(e) = std::fs::create_dir_all(data_dir)
-        {
-            error!("create stats data directory failed {:?}: {}", data_dir, e);
-        }
-
-        let stats_file = data_dir.join(format!("scanner_stats_{node_id}.json"));
-        let backup_file = data_dir.join(format!("scanner_stats_{node_id}.backup"));
-        let temp_file = data_dir.join(format!("scanner_stats_{node_id}.tmp"));
-
-        Self {
-            node_id: node_id.to_string(),
-            stats_file,
-            backup_file,
-            temp_file,
-            stats: Arc::new(RwLock::new(LocalScanStats::default())),
-            save_interval: Duration::from_secs(60), // 60 seconds save once
-            last_save: Arc::new(RwLock::new(SystemTime::UNIX_EPOCH)),
-            counters: Arc::new(StatsCounters::default()),
-        }
-    }
-
-    /// load local stats data
-    pub async fn load_stats(&self) -> Result<()> {
-        if !self.stats_file.exists() {
-            info!("stats data file not exists, will create new stats data");
-            return Ok(());
-        }
-
-        match self.load_stats_from_file(&self.stats_file).await {
-            Ok(stats) => {
-                *self.stats.write().await = stats;
-                info!("success load local stats data");
-                Ok(())
-            }
-            Err(e) => {
-                warn!("load main stats file failed: {}, try backup file", e);
-
-                match self.load_stats_from_file(&self.backup_file).await {
-                    Ok(stats) => {
-                        *self.stats.write().await = stats;
-                        warn!("restore stats data from backup file");
-                        Ok(())
-                    }
-                    Err(backup_e) => {
-                        warn!("backup file also cannot load: {}, will use default stats data", backup_e);
-                        Ok(())
-                    }
-                }
-            }
-        }
-    }
-
-    /// load stats data from file
-    async fn load_stats_from_file(&self, file_path: &Path) -> Result<LocalScanStats> {
-        let content = tokio::fs::read_to_string(file_path)
-            .await
-            .map_err(|e| Error::IO(format!("read stats file failed: {e}")))?;
-
-        let stats: LocalScanStats =
-            serde_json::from_str(&content).map_err(|e| Error::Serialization(format!("deserialize stats data failed: {e}")))?;
-
-        Ok(stats)
-    }
-
-    /// save stats data to disk
-    pub async fn save_stats(&self) -> Result<()> {
-        let now = SystemTime::now();
-        let last_save = *self.last_save.read().await;
-
-        // frequency control
-        if now.duration_since(last_save).unwrap_or(Duration::ZERO) < self.save_interval {
-            return Ok(());
-        }
-
-        let stats = self.stats.read().await.clone();
-
-        // serialize
-        let json_data = serde_json::to_string_pretty(&stats)
-            .map_err(|e| Error::Serialization(format!("serialize stats data failed: {e}")))?;
-
-        // atomic write
-        tokio::fs::write(&self.temp_file, json_data)
-            .await
-            .map_err(|e| Error::IO(format!("write temp stats file failed: {e}")))?;
-
-        // backup existing file
-        if self.stats_file.exists() {
-            tokio::fs::copy(&self.stats_file, &self.backup_file)
-                .await
-                .map_err(|e| Error::IO(format!("backup stats file failed: {e}")))?;
-        }
-
-        // atomic replace
-        tokio::fs::rename(&self.temp_file, &self.stats_file)
-            .await
-            .map_err(|e| Error::IO(format!("replace stats file failed: {e}")))?;
-
-        *self.last_save.write().await = now;
-
-        debug!("save local stats data to {:?}", self.stats_file);
-        Ok(())
-    }
-
-    /// force save stats data
-    pub async fn force_save_stats(&self) -> Result<()> {
-        *self.last_save.write().await = SystemTime::UNIX_EPOCH;
-        self.save_stats().await
-    }
-
-    /// update disk scan result
-    pub async fn update_disk_scan_result(&self, result: &BatchScanResult) -> Result<()> {
-        let mut stats = self.stats.write().await;
-
-        // update disk stats
-        let disk_stat = stats.disks_stats.entry(result.disk_id.clone()).or_insert_with(|| DiskStats {
-            disk_id: result.disk_id.clone(),
-            ..Default::default()
-        });
-
-        let healthy_count = result.entries.iter().filter(|e| e.is_healthy).count() as u64;
-        let error_count = result.entries.iter().filter(|e| !e.is_healthy).count() as u64;
-
-        disk_stat.objects_scanned += result.entries.len() as u64;
-        disk_stat.errors_count += error_count;
-        disk_stat.last_scan_time = result.scan_end;
-        disk_stat.scan_duration = result.scan_duration;
-        disk_stat.scan_completed = true;
-
-        // update overall stats
-        stats.objects_scanned += result.entries.len() as u64;
-        stats.healthy_objects += healthy_count;
-        stats.corrupted_objects += error_count;
-        stats.last_update = SystemTime::now();
-
-        // update bucket stats
-        for entry in &result.entries {
-            let _bucket_stat = stats
-                .buckets_stats
-                .entry(entry.bucket_name.clone())
-                .or_insert_with(BucketStats::default);
-
-            // TODO: update BucketStats
-        }
-
-        // update atomic counters
-        self.counters
-            .total_objects_scanned
-            .fetch_add(result.entries.len() as u64, Ordering::Relaxed);
-        self.counters
-            .total_healthy_objects
-            .fetch_add(healthy_count, Ordering::Relaxed);
-        self.counters
-            .total_corrupted_objects
-            .fetch_add(error_count, Ordering::Relaxed);
-
-        let total_bytes: u64 = result.entries.iter().map(|e| e.object_size).sum();
-        self.counters.total_bytes_scanned.fetch_add(total_bytes, Ordering::Relaxed);
-
-        if error_count > 0 {
-            self.counters.total_scan_errors.fetch_add(error_count, Ordering::Relaxed);
-        }
-
-        drop(stats);
-
-        debug!(
-            "update disk {} scan result: objects {}, healthy {}, error {}",
-            result.disk_id,
-            result.entries.len(),
-            healthy_count,
-            error_count
-        );
-
-        Ok(())
-    }
-
-    /// record single object scan result
-    pub async fn record_object_scan(&self, entry: ScanResultEntry) -> Result<()> {
-        let result = BatchScanResult {
-            disk_id: entry.disk_id.clone(),
-            entries: vec![entry],
-            scan_start: SystemTime::now(),
-            scan_end: SystemTime::now(),
-            scan_duration: Duration::from_millis(0),
-        };
-
-        self.update_disk_scan_result(&result).await
-    }
-
-    /// get local stats data copy
-    pub async fn get_stats(&self) -> LocalScanStats {
-        self.stats.read().await.clone()
-    }
-
-    /// get real-time counters
-    pub fn get_counters(&self) -> Arc<StatsCounters> {
-        self.counters.clone()
-    }
-
-    /// reset stats data
-    pub async fn reset_stats(&self) -> Result<()> {
-        {
-            let mut stats = self.stats.write().await;
-            *stats = LocalScanStats::default();
-        }
-
-        // reset counters
-        self.counters.total_objects_scanned.store(0, Ordering::Relaxed);
-        self.counters.total_healthy_objects.store(0, Ordering::Relaxed);
-        self.counters.total_corrupted_objects.store(0, Ordering::Relaxed);
-        self.counters.total_bytes_scanned.store(0, Ordering::Relaxed);
-        self.counters.total_scan_errors.store(0, Ordering::Relaxed);
-        self.counters.total_heal_triggered.store(0, Ordering::Relaxed);
-
-        info!("reset local stats data");
-        Ok(())
-    }
-
-    /// get stats summary
-    pub async fn get_stats_summary(&self) -> StatsSummary {
-        let stats = self.stats.read().await;
-
-        StatsSummary {
-            node_id: self.node_id.clone(),
-            total_objects_scanned: self.counters.total_objects_scanned.load(Ordering::Relaxed),
-            total_healthy_objects: self.counters.total_healthy_objects.load(Ordering::Relaxed),
-            total_corrupted_objects: self.counters.total_corrupted_objects.load(Ordering::Relaxed),
-            total_bytes_scanned: self.counters.total_bytes_scanned.load(Ordering::Relaxed),
-            total_scan_errors: self.counters.total_scan_errors.load(Ordering::Relaxed),
-            total_heal_triggered: self.counters.total_heal_triggered.load(Ordering::Relaxed),
-            total_disks: stats.disks_stats.len(),
-            total_buckets: stats.buckets_stats.len(),
-            last_update: stats.last_update,
-            scan_progress: stats.scan_progress.clone(),
-            data_usage: stats.data_usage.clone(),
-        }
-    }
-
-    /// record heal triggered
-    pub async fn record_heal_triggered(&self, object_path: &str, error_message: &str) {
-        self.counters.total_heal_triggered.fetch_add(1, Ordering::Relaxed);
-
-        info!("record heal triggered: object={}, error={}", object_path, error_message);
-    }
-
-    /// update data usage stats
-    pub async fn update_data_usage(&self, data_usage: DataUsageInfo) {
-        let mut stats = self.stats.write().await;
-        stats.data_usage = data_usage;
-        stats.last_update = SystemTime::now();
-
-        debug!("update data usage stats");
-    }
-
-    /// cleanup stats files
-    pub async fn cleanup_stats_files(&self) -> Result<()> {
-        // delete main file
-        if self.stats_file.exists() {
-            tokio::fs::remove_file(&self.stats_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete stats file failed: {e}")))?;
-        }
-
-        // delete backup file
-        if self.backup_file.exists() {
-            tokio::fs::remove_file(&self.backup_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete backup stats file failed: {e}")))?;
-        }
-
-        // delete temp file
-        if self.temp_file.exists() {
-            tokio::fs::remove_file(&self.temp_file)
-                .await
-                .map_err(|e| Error::IO(format!("delete temp stats file failed: {e}")))?;
-        }
-
-        info!("cleanup all stats files");
-        Ok(())
-    }
-
-    /// set save interval
-    pub fn set_save_interval(&mut self, interval: Duration) {
-        self.save_interval = interval;
-        info!("set stats data save interval to {:?}", interval);
-    }
-}
-
-/// stats summary
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct StatsSummary {
-    /// node id
-    pub node_id: String,
-    /// total scanned objects
-    pub total_objects_scanned: u64,
-    /// total healthy objects
-    pub total_healthy_objects: u64,
-    /// total corrupted objects
-    pub total_corrupted_objects: u64,
-    /// total scanned bytes
-    pub total_bytes_scanned: u64,
-    /// total scan errors
-    pub total_scan_errors: u64,
-    /// total heal triggered
-    pub total_heal_triggered: u64,
-    /// total disks
-    pub total_disks: usize,
-    /// total buckets
-    pub total_buckets: usize,
-    /// last update time
-    pub last_update: SystemTime,
-    /// scan progress
-    pub scan_progress: super::node_scanner::ScanProgress,
-    /// data usage snapshot for the node
-    pub data_usage: DataUsageInfo,
-}

crates/ahm/src/scanner/metrics.rs

@@ -1,305 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use serde::{Deserialize, Serialize};
-use std::{
-    collections::HashMap,
-    sync::atomic::{AtomicU64, Ordering},
-    time::{Duration, SystemTime},
-};
-use tracing::info;
-
-/// Scanner metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ScannerMetrics {
-    /// Total objects scanned since server start
-    pub objects_scanned: u64,
-    /// Total object versions scanned since server start
-    pub versions_scanned: u64,
-    /// Total directories scanned since server start
-    pub directories_scanned: u64,
-    /// Total bucket scans started since server start
-    pub bucket_scans_started: u64,
-    /// Total bucket scans finished since server start
-    pub bucket_scans_finished: u64,
-    /// Total objects with health issues found
-    pub objects_with_issues: u64,
-    /// Total heal tasks queued
-    pub heal_tasks_queued: u64,
-    /// Total heal tasks completed
-    pub heal_tasks_completed: u64,
-    /// Total heal tasks failed
-    pub heal_tasks_failed: u64,
-    /// Total healthy objects found
-    pub healthy_objects: u64,
-    /// Total corrupted objects found
-    pub corrupted_objects: u64,
-    /// Last scan activity time
-    pub last_activity: Option<SystemTime>,
-    /// Current scan cycle
-    pub current_cycle: u64,
-    /// Total scan cycles completed
-    pub total_cycles: u64,
-    /// Current scan duration
-    pub current_scan_duration: Option<Duration>,
-    /// Average scan duration
-    pub avg_scan_duration: Duration,
-    /// Objects scanned per second
-    pub objects_per_second: f64,
-    /// Buckets scanned per second
-    pub buckets_per_second: f64,
-    /// Storage metrics by bucket
-    pub bucket_metrics: HashMap<String, BucketMetrics>,
-    /// Disk metrics
-    pub disk_metrics: HashMap<String, DiskMetrics>,
-}
-
-/// Bucket-specific metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct BucketMetrics {
-    /// Bucket name
-    pub bucket: String,
-    /// Total objects in bucket
-    pub total_objects: u64,
-    /// Total size of objects in bucket (bytes)
-    pub total_size: u64,
-    /// Objects with health issues
-    pub objects_with_issues: u64,
-    /// Last scan time
-    pub last_scan_time: Option<SystemTime>,
-    /// Scan duration
-    pub scan_duration: Option<Duration>,
-    /// Heal tasks queued for this bucket
-    pub heal_tasks_queued: u64,
-    /// Heal tasks completed for this bucket
-    pub heal_tasks_completed: u64,
-    /// Heal tasks failed for this bucket
-    pub heal_tasks_failed: u64,
-}
-
-/// Disk-specific metrics
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct DiskMetrics {
-    /// Disk path
-    pub disk_path: String,
-    /// Total disk space (bytes)
-    pub total_space: u64,
-    /// Used disk space (bytes)
-    pub used_space: u64,
-    /// Free disk space (bytes)
-    pub free_space: u64,
-    /// Objects scanned on this disk
-    pub objects_scanned: u64,
-    /// Objects with issues on this disk
-    pub objects_with_issues: u64,
-    /// Last scan time
-    pub last_scan_time: Option<SystemTime>,
-    /// Whether disk is online
-    pub is_online: bool,
-    /// Whether disk is being scanned
-    pub is_scanning: bool,
-}
-
-/// Thread-safe metrics collector
-pub struct MetricsCollector {
-    /// Atomic counters for real-time metrics
-    objects_scanned: AtomicU64,
-    versions_scanned: AtomicU64,
-    directories_scanned: AtomicU64,
-    bucket_scans_started: AtomicU64,
-    bucket_scans_finished: AtomicU64,
-    objects_with_issues: AtomicU64,
-    heal_tasks_queued: AtomicU64,
-    heal_tasks_completed: AtomicU64,
-    heal_tasks_failed: AtomicU64,
-    current_cycle: AtomicU64,
-    total_cycles: AtomicU64,
-    healthy_objects: AtomicU64,
-    corrupted_objects: AtomicU64,
-}
-
-impl MetricsCollector {
-    /// Create a new metrics collector
-    pub fn new() -> Self {
-        Self {
-            objects_scanned: AtomicU64::new(0),
-            versions_scanned: AtomicU64::new(0),
-            directories_scanned: AtomicU64::new(0),
-            bucket_scans_started: AtomicU64::new(0),
-            bucket_scans_finished: AtomicU64::new(0),
-            objects_with_issues: AtomicU64::new(0),
-            heal_tasks_queued: AtomicU64::new(0),
-            heal_tasks_completed: AtomicU64::new(0),
-            heal_tasks_failed: AtomicU64::new(0),
-            current_cycle: AtomicU64::new(0),
-            total_cycles: AtomicU64::new(0),
-            healthy_objects: AtomicU64::new(0),
-            corrupted_objects: AtomicU64::new(0),
-        }
-    }
-
-    /// Increment objects scanned count
-    pub fn increment_objects_scanned(&self, count: u64) {
-        self.objects_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment versions scanned count
-    pub fn increment_versions_scanned(&self, count: u64) {
-        self.versions_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment directories scanned count
-    pub fn increment_directories_scanned(&self, count: u64) {
-        self.directories_scanned.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment bucket scans started count
-    pub fn increment_bucket_scans_started(&self, count: u64) {
-        self.bucket_scans_started.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment bucket scans finished count
-    pub fn increment_bucket_scans_finished(&self, count: u64) {
-        self.bucket_scans_finished.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment objects with issues count
-    pub fn increment_objects_with_issues(&self, count: u64) {
-        self.objects_with_issues.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks queued count
-    pub fn increment_heal_tasks_queued(&self, count: u64) {
-        self.heal_tasks_queued.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks completed count
-    pub fn increment_heal_tasks_completed(&self, count: u64) {
-        self.heal_tasks_completed.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Increment heal tasks failed count
-    pub fn increment_heal_tasks_failed(&self, count: u64) {
-        self.heal_tasks_failed.fetch_add(count, Ordering::Relaxed);
-    }
-
-    /// Set current cycle
-    pub fn set_current_cycle(&self, cycle: u64) {
-        self.current_cycle.store(cycle, Ordering::Relaxed);
-    }
-
-    /// Increment total cycles
-    pub fn increment_total_cycles(&self) {
-        self.total_cycles.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Increment healthy objects count
-    pub fn increment_healthy_objects(&self) {
-        self.healthy_objects.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Increment corrupted objects count
-    pub fn increment_corrupted_objects(&self) {
-        self.corrupted_objects.fetch_add(1, Ordering::Relaxed);
-    }
-
-    /// Get current metrics snapshot
-    pub fn get_metrics(&self) -> ScannerMetrics {
-        ScannerMetrics {
-            objects_scanned: self.objects_scanned.load(Ordering::Relaxed),
-            versions_scanned: self.versions_scanned.load(Ordering::Relaxed),
-            directories_scanned: self.directories_scanned.load(Ordering::Relaxed),
-            bucket_scans_started: self.bucket_scans_started.load(Ordering::Relaxed),
-            bucket_scans_finished: self.bucket_scans_finished.load(Ordering::Relaxed),
-            objects_with_issues: self.objects_with_issues.load(Ordering::Relaxed),
-            heal_tasks_queued: self.heal_tasks_queued.load(Ordering::Relaxed),
-            heal_tasks_completed: self.heal_tasks_completed.load(Ordering::Relaxed),
-            heal_tasks_failed: self.heal_tasks_failed.load(Ordering::Relaxed),
-            healthy_objects: self.healthy_objects.load(Ordering::Relaxed),
-            corrupted_objects: self.corrupted_objects.load(Ordering::Relaxed),
-            last_activity: Some(SystemTime::now()),
-            current_cycle: self.current_cycle.load(Ordering::Relaxed),
-            total_cycles: self.total_cycles.load(Ordering::Relaxed),
-            current_scan_duration: None,       // Will be set by scanner
-            avg_scan_duration: Duration::ZERO, // Will be calculated
-            objects_per_second: 0.0,           // Will be calculated
-            buckets_per_second: 0.0,           // Will be calculated
-            bucket_metrics: HashMap::new(),    // Will be populated by scanner
-            disk_metrics: HashMap::new(),      // Will be populated by scanner
-        }
-    }
-
-    /// Reset all metrics
-    pub fn reset(&self) {
-        self.objects_scanned.store(0, Ordering::Relaxed);
-        self.versions_scanned.store(0, Ordering::Relaxed);
-        self.directories_scanned.store(0, Ordering::Relaxed);
-        self.bucket_scans_started.store(0, Ordering::Relaxed);
-        self.bucket_scans_finished.store(0, Ordering::Relaxed);
-        self.objects_with_issues.store(0, Ordering::Relaxed);
-        self.heal_tasks_queued.store(0, Ordering::Relaxed);
-        self.heal_tasks_completed.store(0, Ordering::Relaxed);
-        self.heal_tasks_failed.store(0, Ordering::Relaxed);
-        self.current_cycle.store(0, Ordering::Relaxed);
-        self.total_cycles.store(0, Ordering::Relaxed);
-        self.healthy_objects.store(0, Ordering::Relaxed);
-        self.corrupted_objects.store(0, Ordering::Relaxed);
-
-        info!("Scanner metrics reset");
-    }
-}
-
-impl Default for MetricsCollector {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_metrics_collector_creation() {
-        let collector = MetricsCollector::new();
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 0);
-        assert_eq!(metrics.versions_scanned, 0);
-    }
-
-    #[test]
-    fn test_metrics_increment() {
-        let collector = MetricsCollector::new();
-
-        collector.increment_objects_scanned(10);
-        collector.increment_versions_scanned(5);
-        collector.increment_objects_with_issues(2);
-
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 10);
-        assert_eq!(metrics.versions_scanned, 5);
-        assert_eq!(metrics.objects_with_issues, 2);
-    }
-
-    #[test]
-    fn test_metrics_reset() {
-        let collector = MetricsCollector::new();
-
-        collector.increment_objects_scanned(10);
-        collector.reset();
-
-        let metrics = collector.get_metrics();
-        assert_eq!(metrics.objects_scanned, 0);
-    }
-}

crates/ahm/src/scanner/mod.rs

@@ -1,36 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-pub mod checkpoint;
-pub mod data_scanner;
-pub mod histogram;
-pub mod io_monitor;
-pub mod io_throttler;
-pub mod lifecycle;
-pub mod local_scan;
-pub mod local_stats;
-pub mod metrics;
-pub mod node_scanner;
-pub mod stats_aggregator;
-
-pub use checkpoint::{CheckpointData, CheckpointInfo, CheckpointManager};
-pub use data_scanner::{ScanMode, Scanner, ScannerConfig, ScannerState};
-pub use io_monitor::{AdvancedIOMonitor, IOMetrics, IOMonitorConfig};
-pub use io_throttler::{AdvancedIOThrottler, IOThrottlerConfig, MetricsSnapshot, ResourceAllocation, ThrottleDecision};
-pub use local_stats::{BatchScanResult, LocalStatsManager, ScanResultEntry, StatsSummary};
-pub use metrics::{BucketMetrics, DiskMetrics, MetricsCollector, ScannerMetrics};
-pub use node_scanner::{IOMonitor, IOThrottler, LoadLevel, LocalScanStats, NodeScanner, NodeScannerConfig};
-pub use stats_aggregator::{
-    AggregatedStats, DecentralizedStatsAggregator, DecentralizedStatsAggregatorConfig, NodeClient, NodeInfo,
-};

crates/ahm/src/scanner/stats_aggregator.rs

@@ -1,771 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::scanner::{
-    local_stats::StatsSummary,
-    node_scanner::{BucketStats, LoadLevel, ScanProgress},
-};
-use crate::{Error, Result};
-use rustfs_common::data_usage::DataUsageInfo;
-use serde::{Deserialize, Serialize};
-use std::{
-    collections::HashMap,
-    sync::Arc,
-    time::{Duration, SystemTime},
-};
-use tokio::sync::RwLock;
-use tracing::{debug, info, warn};
-
-/// node client config
-#[derive(Debug, Clone)]
-pub struct NodeClientConfig {
-    /// connect timeout
-    pub connect_timeout: Duration,
-    /// request timeout
-    pub request_timeout: Duration,
-    /// retry times
-    pub max_retries: u32,
-    /// retry interval
-    pub retry_interval: Duration,
-}
-
-impl Default for NodeClientConfig {
-    fn default() -> Self {
-        Self {
-            connect_timeout: Duration::from_secs(5),
-            request_timeout: Duration::from_secs(10),
-            max_retries: 3,
-            retry_interval: Duration::from_secs(1),
-        }
-    }
-}
-
-/// node info
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct NodeInfo {
-    /// node id
-    pub node_id: String,
-    /// node address
-    pub address: String,
-    /// node port
-    pub port: u16,
-    /// is online
-    pub is_online: bool,
-    /// last heartbeat time
-    pub last_heartbeat: SystemTime,
-    /// node version
-    pub version: String,
-}
-
-/// aggregated stats
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AggregatedStats {
-    /// aggregation timestamp
-    pub aggregation_timestamp: SystemTime,
-    /// number of nodes participating in aggregation
-    pub node_count: usize,
-    /// number of online nodes
-    pub online_node_count: usize,
-    /// total scanned objects
-    pub total_objects_scanned: u64,
-    /// total healthy objects
-    pub total_healthy_objects: u64,
-    /// total corrupted objects
-    pub total_corrupted_objects: u64,
-    /// total scanned bytes
-    pub total_bytes_scanned: u64,
-    /// total scan errors
-    pub total_scan_errors: u64,
-    /// total heal triggered
-    pub total_heal_triggered: u64,
-    /// total disks
-    pub total_disks: usize,
-    /// total buckets
-    pub total_buckets: usize,
-    /// aggregated data usage
-    pub aggregated_data_usage: DataUsageInfo,
-    /// node summaries
-    pub node_summaries: HashMap<String, StatsSummary>,
-    /// aggregated bucket stats
-    pub aggregated_bucket_stats: HashMap<String, BucketStats>,
-    /// aggregated scan progress
-    pub scan_progress_summary: ScanProgressSummary,
-    /// load level distribution
-    pub load_level_distribution: HashMap<LoadLevel, usize>,
-}
-
-impl Default for AggregatedStats {
-    fn default() -> Self {
-        Self {
-            aggregation_timestamp: SystemTime::now(),
-            node_count: 0,
-            online_node_count: 0,
-            total_objects_scanned: 0,
-            total_healthy_objects: 0,
-            total_corrupted_objects: 0,
-            total_bytes_scanned: 0,
-            total_scan_errors: 0,
-            total_heal_triggered: 0,
-            total_disks: 0,
-            total_buckets: 0,
-            aggregated_data_usage: DataUsageInfo::default(),
-            node_summaries: HashMap::new(),
-            aggregated_bucket_stats: HashMap::new(),
-            scan_progress_summary: ScanProgressSummary::default(),
-            load_level_distribution: HashMap::new(),
-        }
-    }
-}
-
-/// scan progress summary
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ScanProgressSummary {
-    /// average current cycle
-    pub average_current_cycle: f64,
-    /// total completed disks
-    pub total_completed_disks: usize,
-    /// total completed buckets
-    pub total_completed_buckets: usize,
-    /// latest scan start time
-    pub earliest_scan_start: Option<SystemTime>,
-    /// estimated completion time
-    pub estimated_completion: Option<SystemTime>,
-    /// node progress
-    pub node_progress: HashMap<String, ScanProgress>,
-}
-
-/// node client
-///
-/// responsible for communicating with other nodes, getting stats data
-pub struct NodeClient {
-    /// node info
-    node_info: NodeInfo,
-    /// config
-    config: NodeClientConfig,
-    /// HTTP client
-    http_client: reqwest::Client,
-}
-
-impl NodeClient {
-    /// create new node client
-    pub fn new(node_info: NodeInfo, config: NodeClientConfig) -> Self {
-        let http_client = reqwest::Client::builder()
-            .timeout(config.request_timeout)
-            .connect_timeout(config.connect_timeout)
-            .build()
-            .expect("Failed to create HTTP client");
-
-        Self {
-            node_info,
-            config,
-            http_client,
-        }
-    }
-
-    /// get node stats summary
-    pub async fn get_stats_summary(&self) -> Result<StatsSummary> {
-        let url = format!("http://{}:{}/internal/scanner/stats", self.node_info.address, self.node_info.port);
-
-        for attempt in 1..=self.config.max_retries {
-            match self.try_get_stats_summary(&url).await {
-                Ok(summary) => return Ok(summary),
-                Err(e) => {
-                    warn!("try to get node {} stats failed: {}", self.node_info.node_id, e);
-
-                    if attempt < self.config.max_retries {
-                        tokio::time::sleep(self.config.retry_interval).await;
-                    }
-                }
-            }
-        }
-
-        Err(Error::Other(format!("cannot get stats data from node {}", self.node_info.node_id)))
-    }
-
-    /// try to get stats summary
-    async fn try_get_stats_summary(&self, url: &str) -> Result<StatsSummary> {
-        let response = self
-            .http_client
-            .get(url)
-            .send()
-            .await
-            .map_err(|e| Error::Other(format!("HTTP request failed: {e}")))?;
-
-        if !response.status().is_success() {
-            return Err(Error::Other(format!("HTTP status error: {}", response.status())));
-        }
-
-        let summary = response
-            .json::<StatsSummary>()
-            .await
-            .map_err(|e| Error::Serialization(format!("deserialize stats data failed: {e}")))?;
-
-        Ok(summary)
-    }
-
-    /// check node health status
-    pub async fn check_health(&self) -> bool {
-        let url = format!("http://{}:{}/internal/health", self.node_info.address, self.node_info.port);
-
-        match self.http_client.get(&url).send().await {
-            Ok(response) => response.status().is_success(),
-            Err(_) => false,
-        }
-    }
-
-    /// get node info
-    pub fn get_node_info(&self) -> &NodeInfo {
-        &self.node_info
-    }
-
-    /// update node online status
-    pub fn update_online_status(&mut self, is_online: bool) {
-        self.node_info.is_online = is_online;
-        if is_online {
-            self.node_info.last_heartbeat = SystemTime::now();
-        }
-    }
-}
-
-/// decentralized stats aggregator config
-#[derive(Debug, Clone)]
-pub struct DecentralizedStatsAggregatorConfig {
-    /// aggregation interval
-    pub aggregation_interval: Duration,
-    /// cache ttl
-    pub cache_ttl: Duration,
-    /// node timeout
-    pub node_timeout: Duration,
-    /// max concurrent aggregations
-    pub max_concurrent_aggregations: usize,
-}
-
-impl Default for DecentralizedStatsAggregatorConfig {
-    fn default() -> Self {
-        Self {
-            aggregation_interval: Duration::from_secs(30), // 30 seconds to aggregate
-            cache_ttl: Duration::from_secs(3),             // 3 seconds to cache
-            node_timeout: Duration::from_secs(5),          // 5 seconds to node timeout
-            max_concurrent_aggregations: 10,               // max 10 nodes to aggregate concurrently
-        }
-    }
-}
-
-/// decentralized stats aggregator
-///
-/// real-time aggregate stats data from all nodes, provide global view
-pub struct DecentralizedStatsAggregator {
-    /// config
-    config: Arc<RwLock<DecentralizedStatsAggregatorConfig>>,
-    /// node clients
-    node_clients: Arc<RwLock<HashMap<String, Arc<NodeClient>>>>,
-    /// cached aggregated stats
-    cached_stats: Arc<RwLock<Option<AggregatedStats>>>,
-    /// cache timestamp
-    cache_timestamp: Arc<RwLock<SystemTime>>,
-    /// local node stats summary
-    local_stats_summary: Arc<RwLock<Option<StatsSummary>>>,
-}
-
-impl DecentralizedStatsAggregator {
-    /// create new decentralized stats aggregator
-    pub fn new(config: DecentralizedStatsAggregatorConfig) -> Self {
-        Self {
-            config: Arc::new(RwLock::new(config)),
-            node_clients: Arc::new(RwLock::new(HashMap::new())),
-            cached_stats: Arc::new(RwLock::new(None)),
-            cache_timestamp: Arc::new(RwLock::new(SystemTime::UNIX_EPOCH)),
-            local_stats_summary: Arc::new(RwLock::new(None)),
-        }
-    }
-
-    /// add node client
-    pub async fn add_node(&self, node_info: NodeInfo) {
-        let client_config = NodeClientConfig::default();
-        let client = Arc::new(NodeClient::new(node_info.clone(), client_config));
-
-        self.node_clients.write().await.insert(node_info.node_id.clone(), client);
-
-        info!("add node to aggregator: {}", node_info.node_id);
-    }
-
-    /// remove node client
-    pub async fn remove_node(&self, node_id: &str) {
-        self.node_clients.write().await.remove(node_id);
-        info!("remove node from aggregator: {}", node_id);
-    }
-
-    /// set local node stats summary
-    pub async fn set_local_stats(&self, stats: StatsSummary) {
-        *self.local_stats_summary.write().await = Some(stats);
-    }
-
-    /// get aggregated stats data (with cache)
-    pub async fn get_aggregated_stats(&self) -> Result<AggregatedStats> {
-        let config = self.config.read().await;
-        let cache_ttl = config.cache_ttl;
-        drop(config);
-
-        // check cache validity
-        let cache_timestamp = *self.cache_timestamp.read().await;
-        let now = SystemTime::now();
-
-        debug!(
-            "cache check: cache_timestamp={:?}, now={:?}, cache_ttl={:?}",
-            cache_timestamp, now, cache_ttl
-        );
-
-        // Check cache validity if timestamp is not initial value (UNIX_EPOCH)
-        if cache_timestamp != SystemTime::UNIX_EPOCH
-            && let Ok(elapsed) = now.duration_since(cache_timestamp)
-        {
-            if elapsed < cache_ttl {
-                if let Some(cached) = self.cached_stats.read().await.as_ref() {
-                    debug!("Returning cached aggregated stats, remaining TTL: {:?}", cache_ttl - elapsed);
-                    return Ok(cached.clone());
-                }
-            } else {
-                debug!("Cache expired: elapsed={:?} >= ttl={:?}", elapsed, cache_ttl);
-            }
-        }
-
-        // cache expired, re-aggregate
-        info!("cache expired, start re-aggregating stats data");
-        let aggregation_timestamp = now;
-        let aggregated = self.aggregate_stats_from_all_nodes(aggregation_timestamp).await?;
-
-        // update cache
-        *self.cached_stats.write().await = Some(aggregated.clone());
-        // Use the time when aggregation completes as cache timestamp to avoid premature expiry during long runs
-        *self.cache_timestamp.write().await = SystemTime::now();
-
-        Ok(aggregated)
-    }
-
-    /// force refresh aggregated stats (ignore cache)
-    pub async fn force_refresh_aggregated_stats(&self) -> Result<AggregatedStats> {
-        let now = SystemTime::now();
-        let aggregated = self.aggregate_stats_from_all_nodes(now).await?;
-
-        // update cache
-        *self.cached_stats.write().await = Some(aggregated.clone());
-        // Cache timestamp should reflect completion time rather than aggregation start
-        *self.cache_timestamp.write().await = SystemTime::now();
-
-        Ok(aggregated)
-    }
-
-    /// aggregate stats data from all nodes
-    async fn aggregate_stats_from_all_nodes(&self, aggregation_timestamp: SystemTime) -> Result<AggregatedStats> {
-        let node_clients = self.node_clients.read().await;
-        let config = self.config.read().await;
-
-        // concurrent get stats data from all nodes
-        let mut tasks = Vec::new();
-        let semaphore = Arc::new(tokio::sync::Semaphore::new(config.max_concurrent_aggregations));
-
-        // add local node stats
-        let mut node_summaries = HashMap::new();
-        if let Some(local_stats) = self.local_stats_summary.read().await.as_ref() {
-            node_summaries.insert(local_stats.node_id.clone(), local_stats.clone());
-        }
-
-        // get remote node stats
-        for (node_id, client) in node_clients.iter() {
-            let client = client.clone();
-            let semaphore = semaphore.clone();
-            let node_id = node_id.clone();
-
-            let task = tokio::spawn(async move {
-                let _permit = match semaphore.acquire().await {
-                    Ok(permit) => permit,
-                    Err(e) => {
-                        warn!("Failed to acquire semaphore for node {}: {}", node_id, e);
-                        return None;
-                    }
-                };
-
-                match client.get_stats_summary().await {
-                    Ok(summary) => {
-                        debug!("successfully get node {} stats data", node_id);
-                        Some((node_id, summary))
-                    }
-                    Err(e) => {
-                        warn!("get node {} stats data failed: {}", node_id, e);
-                        None
-                    }
-                }
-            });
-
-            tasks.push(task);
-        }
-
-        // wait for all tasks to complete
-        for task in tasks {
-            if let Ok(Some((node_id, summary))) = task.await {
-                node_summaries.insert(node_id, summary);
-            }
-        }
-
-        drop(node_clients);
-        drop(config);
-
-        // aggregate stats data
-        let aggregated = self.aggregate_node_summaries(node_summaries, aggregation_timestamp).await;
-
-        info!(
-            "aggregate stats completed: {} nodes, {} online",
-            aggregated.node_count, aggregated.online_node_count
-        );
-
-        Ok(aggregated)
-    }
-
-    /// aggregate node summaries
-    async fn aggregate_node_summaries(
-        &self,
-        node_summaries: HashMap<String, StatsSummary>,
-        aggregation_timestamp: SystemTime,
-    ) -> AggregatedStats {
-        let mut aggregated = AggregatedStats {
-            aggregation_timestamp,
-            node_count: node_summaries.len(),
-            online_node_count: node_summaries.len(), // assume all nodes with data are online
-            node_summaries: node_summaries.clone(),
-            ..Default::default()
-        };
-
-        // aggregate numeric stats
-        for (node_id, summary) in &node_summaries {
-            aggregated.total_objects_scanned += summary.total_objects_scanned;
-            aggregated.total_healthy_objects += summary.total_healthy_objects;
-            aggregated.total_corrupted_objects += summary.total_corrupted_objects;
-            aggregated.total_bytes_scanned += summary.total_bytes_scanned;
-            aggregated.total_scan_errors += summary.total_scan_errors;
-            aggregated.total_heal_triggered += summary.total_heal_triggered;
-            aggregated.total_disks += summary.total_disks;
-            aggregated.total_buckets += summary.total_buckets;
-            aggregated.aggregated_data_usage.merge(&summary.data_usage);
-
-            // aggregate scan progress
-            aggregated
-                .scan_progress_summary
-                .node_progress
-                .insert(node_id.clone(), summary.scan_progress.clone());
-
-            aggregated.scan_progress_summary.total_completed_disks += summary.scan_progress.completed_disks.len();
-            aggregated.scan_progress_summary.total_completed_buckets += summary.scan_progress.completed_buckets.len();
-        }
-
-        // calculate average scan cycle
-        if !node_summaries.is_empty() {
-            let total_cycles: u64 = node_summaries.values().map(|s| s.scan_progress.current_cycle).sum();
-            aggregated.scan_progress_summary.average_current_cycle = total_cycles as f64 / node_summaries.len() as f64;
-        }
-
-        // find earliest scan start time
-        aggregated.scan_progress_summary.earliest_scan_start =
-            node_summaries.values().map(|s| s.scan_progress.scan_start_time).min();
-
-        // TODO: aggregate bucket stats and data usage
-        // here we need to implement it based on the specific BucketStats and DataUsageInfo structure
-
-        aggregated
-    }
-
-    /// get nodes health status
-    pub async fn get_nodes_health(&self) -> HashMap<String, bool> {
-        let node_clients = self.node_clients.read().await;
-        let mut health_status = HashMap::new();
-
-        // concurrent check all nodes health status
-        let mut tasks = Vec::new();
-
-        for (node_id, client) in node_clients.iter() {
-            let client = client.clone();
-            let node_id = node_id.clone();
-
-            let task = tokio::spawn(async move {
-                let is_healthy = client.check_health().await;
-                (node_id, is_healthy)
-            });
-
-            tasks.push(task);
-        }
-
-        // collect results
-        for task in tasks {
-            if let Ok((node_id, is_healthy)) = task.await {
-                health_status.insert(node_id, is_healthy);
-            }
-        }
-
-        health_status
-    }
-
-    /// get online nodes list
-    pub async fn get_online_nodes(&self) -> Vec<String> {
-        let health_status = self.get_nodes_health().await;
-
-        health_status
-            .into_iter()
-            .filter_map(|(node_id, is_healthy)| if is_healthy { Some(node_id) } else { None })
-            .collect()
-    }
-
-    /// clear cache
-    pub async fn clear_cache(&self) {
-        *self.cached_stats.write().await = None;
-        *self.cache_timestamp.write().await = SystemTime::UNIX_EPOCH;
-        info!("clear aggregated stats cache");
-    }
-
-    /// get cache status
-    pub async fn get_cache_status(&self) -> CacheStatus {
-        let cached_stats = self.cached_stats.read().await;
-        let cache_timestamp = *self.cache_timestamp.read().await;
-        let config = self.config.read().await;
-
-        let is_valid = if let Ok(elapsed) = SystemTime::now().duration_since(cache_timestamp) {
-            elapsed < config.cache_ttl
-        } else {
-            false
-        };
-
-        CacheStatus {
-            has_cached_data: cached_stats.is_some(),
-            cache_timestamp,
-            is_valid,
-            ttl: config.cache_ttl,
-        }
-    }
-
-    /// update config
-    pub async fn update_config(&self, new_config: DecentralizedStatsAggregatorConfig) {
-        *self.config.write().await = new_config;
-        info!("update aggregator config");
-    }
-}
-
-/// cache status
-#[derive(Debug, Clone)]
-pub struct CacheStatus {
-    /// has cached data
-    pub has_cached_data: bool,
-    /// cache timestamp
-    pub cache_timestamp: SystemTime,
-    /// cache is valid
-    pub is_valid: bool,
-    /// cache ttl
-    pub ttl: Duration,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::scanner::node_scanner::{BucketScanState, ScanProgress};
-    use rustfs_common::data_usage::{BucketUsageInfo, DataUsageInfo};
-    use std::collections::{HashMap, HashSet};
-    use std::time::Duration;
-
-    #[tokio::test]
-    async fn aggregated_stats_merge_data_usage() {
-        let aggregator = DecentralizedStatsAggregator::new(DecentralizedStatsAggregatorConfig::default());
-
-        let mut data_usage = DataUsageInfo::default();
-        let bucket_usage = BucketUsageInfo {
-            objects_count: 5,
-            size: 1024,
-            ..Default::default()
-        };
-        data_usage.buckets_usage.insert("bucket".to_string(), bucket_usage);
-        data_usage.objects_total_count = 5;
-        data_usage.objects_total_size = 1024;
-
-        let summary = StatsSummary {
-            node_id: "local-node".to_string(),
-            total_objects_scanned: 10,
-            total_healthy_objects: 9,
-            total_corrupted_objects: 1,
-            total_bytes_scanned: 2048,
-            total_scan_errors: 0,
-            total_heal_triggered: 0,
-            total_disks: 2,
-            total_buckets: 1,
-            last_update: SystemTime::now(),
-            scan_progress: ScanProgress::default(),
-            data_usage: data_usage.clone(),
-        };
-
-        aggregator.set_local_stats(summary).await;
-
-        // Wait briefly to ensure async cache writes settle in high-concurrency environments
-        tokio::time::sleep(Duration::from_millis(10)).await;
-
-        let aggregated = aggregator.get_aggregated_stats().await.expect("aggregated stats");
-
-        assert_eq!(aggregated.node_count, 1);
-        assert!(aggregated.node_summaries.contains_key("local-node"));
-        assert_eq!(aggregated.aggregated_data_usage.objects_total_count, 5);
-        assert_eq!(
-            aggregated
-                .aggregated_data_usage
-                .buckets_usage
-                .get("bucket")
-                .expect("bucket usage present")
-                .objects_count,
-            5
-        );
-    }
-
-    #[tokio::test]
-    async fn aggregated_stats_merge_multiple_nodes() {
-        let aggregator = DecentralizedStatsAggregator::new(DecentralizedStatsAggregatorConfig::default());
-
-        let mut local_usage = DataUsageInfo::default();
-        let local_bucket = BucketUsageInfo {
-            objects_count: 3,
-            versions_count: 3,
-            size: 150,
-            ..Default::default()
-        };
-        local_usage.buckets_usage.insert("local-bucket".to_string(), local_bucket);
-        local_usage.calculate_totals();
-        local_usage.buckets_count = local_usage.buckets_usage.len() as u64;
-        local_usage.last_update = Some(SystemTime::now());
-
-        let local_progress = ScanProgress {
-            current_cycle: 1,
-            completed_disks: {
-                let mut set = std::collections::HashSet::new();
-                set.insert("disk-local".to_string());
-                set
-            },
-            completed_buckets: {
-                let mut map = std::collections::HashMap::new();
-                map.insert(
-                    "local-bucket".to_string(),
-                    BucketScanState {
-                        completed: true,
-                        last_object_key: Some("obj1".to_string()),
-                        objects_scanned: 3,
-                        scan_timestamp: SystemTime::now(),
-                    },
-                );
-                map
-            },
-            ..Default::default()
-        };
-
-        let local_summary = StatsSummary {
-            node_id: "node-local".to_string(),
-            total_objects_scanned: 30,
-            total_healthy_objects: 30,
-            total_corrupted_objects: 0,
-            total_bytes_scanned: 1500,
-            total_scan_errors: 0,
-            total_heal_triggered: 0,
-            total_disks: 1,
-            total_buckets: 1,
-            last_update: SystemTime::now(),
-            scan_progress: local_progress,
-            data_usage: local_usage.clone(),
-        };
-
-        let mut remote_usage = DataUsageInfo::default();
-        let remote_bucket = BucketUsageInfo {
-            objects_count: 5,
-            versions_count: 5,
-            size: 250,
-            ..Default::default()
-        };
-        remote_usage.buckets_usage.insert("remote-bucket".to_string(), remote_bucket);
-        remote_usage.calculate_totals();
-        remote_usage.buckets_count = remote_usage.buckets_usage.len() as u64;
-        remote_usage.last_update = Some(SystemTime::now());
-
-        let remote_progress = ScanProgress {
-            current_cycle: 2,
-            completed_disks: {
-                let mut set = std::collections::HashSet::new();
-                set.insert("disk-remote".to_string());
-                set
-            },
-            completed_buckets: {
-                let mut map = std::collections::HashMap::new();
-                map.insert(
-                    "remote-bucket".to_string(),
-                    BucketScanState {
-                        completed: true,
-                        last_object_key: Some("remote-obj".to_string()),
-                        objects_scanned: 5,
-                        scan_timestamp: SystemTime::now(),
-                    },
-                );
-                map
-            },
-            ..Default::default()
-        };
-
-        let remote_summary = StatsSummary {
-            node_id: "node-remote".to_string(),
-            total_objects_scanned: 50,
-            total_healthy_objects: 48,
-            total_corrupted_objects: 2,
-            total_bytes_scanned: 2048,
-            total_scan_errors: 1,
-            total_heal_triggered: 1,
-            total_disks: 2,
-            total_buckets: 1,
-            last_update: SystemTime::now(),
-            scan_progress: remote_progress,
-            data_usage: remote_usage.clone(),
-        };
-        let node_summaries: HashMap<_, _> = [
-            (local_summary.node_id.clone(), local_summary.clone()),
-            (remote_summary.node_id.clone(), remote_summary.clone()),
-        ]
-        .into_iter()
-        .collect();
-
-        let aggregated = aggregator.aggregate_node_summaries(node_summaries, SystemTime::now()).await;
-
-        assert_eq!(aggregated.node_count, 2);
-        assert_eq!(aggregated.total_objects_scanned, 80);
-        assert_eq!(aggregated.total_corrupted_objects, 2);
-        assert_eq!(aggregated.total_disks, 3);
-        assert!(aggregated.node_summaries.contains_key("node-local"));
-        assert!(aggregated.node_summaries.contains_key("node-remote"));
-
-        assert_eq!(
-            aggregated.aggregated_data_usage.objects_total_count,
-            local_usage.objects_total_count + remote_usage.objects_total_count
-        );
-        assert_eq!(
-            aggregated.aggregated_data_usage.objects_total_size,
-            local_usage.objects_total_size + remote_usage.objects_total_size
-        );
-
-        let mut expected_buckets: HashSet<&str> = HashSet::new();
-        expected_buckets.insert("local-bucket");
-        expected_buckets.insert("remote-bucket");
-        let actual_buckets: HashSet<&str> = aggregated
-            .aggregated_data_usage
-            .buckets_usage
-            .keys()
-            .map(|s| s.as_str())
-            .collect();
-        assert_eq!(expected_buckets, actual_buckets);
-    }
-}

crates/ahm/tests/data_usage_fallback_test.rs

@@ -1,112 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#![cfg(test)]
-
-use rustfs_ahm::scanner::data_scanner::Scanner;
-use rustfs_common::data_usage::DataUsageInfo;
-use rustfs_ecstore::GLOBAL_Endpoints;
-use rustfs_ecstore::bucket::metadata_sys::{BucketMetadataSys, GLOBAL_BucketMetadataSys};
-use rustfs_ecstore::endpoints::EndpointServerPools;
-use rustfs_ecstore::store::ECStore;
-use rustfs_ecstore::store_api::{ObjectIO, PutObjReader, StorageAPI};
-use std::sync::{Arc, Once};
-use tempfile::TempDir;
-use tokio::sync::RwLock;
-use tokio_util::sync::CancellationToken;
-use tracing::Level;
-
-/// Build a minimal single-node ECStore over a temp directory and populate objects.
-async fn create_store_with_objects(count: usize) -> (TempDir, std::sync::Arc<ECStore>) {
-    let temp_dir = TempDir::new().expect("temp dir");
-    let root = temp_dir.path().to_string_lossy().to_string();
-
-    // Create endpoints from the temp dir
-    let (endpoint_pools, _setup) = EndpointServerPools::from_volumes("127.0.0.1:0", vec![root])
-        .await
-        .expect("endpoint pools");
-
-    // Seed globals required by metadata sys if not already set
-    if GLOBAL_Endpoints.get().is_none() {
-        let _ = GLOBAL_Endpoints.set(endpoint_pools.clone());
-    }
-
-    let store = ECStore::new("127.0.0.1:0".parse().unwrap(), endpoint_pools, CancellationToken::new())
-        .await
-        .expect("create store");
-
-    if rustfs_ecstore::global::new_object_layer_fn().is_none() {
-        rustfs_ecstore::global::set_object_layer(store.clone()).await;
-    }
-
-    // Initialize metadata system before bucket operations
-    if GLOBAL_BucketMetadataSys.get().is_none() {
-        let mut sys = BucketMetadataSys::new(store.clone());
-        sys.init(Vec::new()).await;
-        let _ = GLOBAL_BucketMetadataSys.set(Arc::new(RwLock::new(sys)));
-    }
-
-    store
-        .make_bucket("fallback-bucket", &rustfs_ecstore::store_api::MakeBucketOptions::default())
-        .await
-        .expect("make bucket");
-
-    for i in 0..count {
-        let key = format!("obj-{i:04}");
-        let data = format!("payload-{i}");
-        let mut reader = PutObjReader::from_vec(data.into_bytes());
-        store
-            .put_object("fallback-bucket", &key, &mut reader, &rustfs_ecstore::store_api::ObjectOptions::default())
-            .await
-            .expect("put object");
-    }
-
-    (temp_dir, store)
-}
-
-static INIT: Once = Once::new();
-
-fn init_tracing(filter_level: Level) {
-    INIT.call_once(|| {
-        let _ = tracing_subscriber::fmt()
-            .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
-            .with_max_level(filter_level)
-            .with_timer(tracing_subscriber::fmt::time::UtcTime::rfc_3339())
-            .with_thread_names(true)
-            .try_init();
-    });
-}
-
-#[tokio::test]
-async fn fallback_builds_full_counts_over_100_objects() {
-    init_tracing(Level::ERROR);
-    let (_tmp, store) = create_store_with_objects(1000).await;
-    let scanner = Scanner::new(None, None);
-
-    // Directly call the fallback builder to ensure pagination works.
-    let usage: DataUsageInfo = scanner.build_data_usage_from_ecstore(&store).await.expect("fallback usage");
-
-    let bucket = usage.buckets_usage.get("fallback-bucket").expect("bucket usage present");
-
-    assert!(
-        usage.objects_total_count >= 1000,
-        "total objects should be >=1000, got {}",
-        usage.objects_total_count
-    );
-    assert!(
-        bucket.objects_count >= 1000,
-        "bucket objects should be >=1000, got {}",
-        bucket.objects_count
-    );
-}

crates/ahm/tests/integration_tests.rs

@@ -1,411 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use rustfs_ahm::scanner::{
-    io_throttler::MetricsSnapshot,
-    local_stats::StatsSummary,
-    node_scanner::{LoadLevel, NodeScanner, NodeScannerConfig},
-    stats_aggregator::{DecentralizedStatsAggregator, DecentralizedStatsAggregatorConfig, NodeInfo},
-};
-use scanner_optimization_tests::{PerformanceBenchmark, create_test_scanner};
-use std::{sync::Arc, time::Duration};
-use tempfile::TempDir;
-mod scanner_optimization_tests;
-#[tokio::test]
-async fn test_end_to_end_scanner_lifecycle() {
-    let temp_dir = TempDir::new().unwrap();
-    let scanner = create_test_scanner(&temp_dir).await;
-
-    scanner.initialize_stats().await.expect("Failed to initialize stats");
-
-    let initial_progress = scanner.get_scan_progress().await;
-    assert_eq!(initial_progress.current_cycle, 0);
-
-    scanner.force_save_checkpoint().await.expect("Failed to save checkpoint");
-
-    let checkpoint_info = scanner.get_checkpoint_info().await.unwrap();
-    assert!(checkpoint_info.is_some());
-}
-
-#[tokio::test]
-async fn test_load_balancing_and_throttling_integration() {
-    let temp_dir = TempDir::new().unwrap();
-    let scanner = create_test_scanner(&temp_dir).await;
-
-    let io_monitor = scanner.get_io_monitor();
-    let throttler = scanner.get_io_throttler();
-
-    // Start IO monitoring
-    io_monitor.start().await.expect("Failed to start IO monitor");
-
-    // Simulate load variation scenarios
-    let load_scenarios = vec![
-        (LoadLevel::Low, 10, 100, 0, 5), // (load level, latency, QPS, error rate, connections)
-        (LoadLevel::Medium, 30, 300, 10, 20),
-        (LoadLevel::High, 80, 800, 50, 50),
-        (LoadLevel::Critical, 200, 1200, 100, 100),
-    ];
-
-    for (expected_level, latency, qps, error_rate, connections) in load_scenarios {
-        // Update business metrics
-        scanner.update_business_metrics(latency, qps, error_rate, connections).await;
-
-        // Wait for monitoring system response
-        tokio::time::sleep(Duration::from_millis(1200)).await;
-
-        // Get current load level
-        let current_level = io_monitor.get_business_load_level().await;
-
-        // Get throttling decision
-        let metrics_snapshot = MetricsSnapshot {
-            iops: 100 + qps / 10,
-            latency,
-            cpu_usage: std::cmp::min(50 + (qps / 20) as u8, 100),
-            memory_usage: 40,
-        };
-
-        let decision = throttler.make_throttle_decision(current_level, Some(metrics_snapshot)).await;
-
-        println!(
-            "Load scenario test: Expected={:?}, Actual={:?}, Should_pause={}, Delay={:?}",
-            expected_level, current_level, decision.should_pause, decision.suggested_delay
-        );
-
-        // Verify throttling effect under high load
-        if matches!(current_level, LoadLevel::High | LoadLevel::Critical) {
-            assert!(decision.suggested_delay > Duration::from_millis(1000));
-        }
-
-        if matches!(current_level, LoadLevel::Critical) {
-            assert!(decision.should_pause);
-        }
-    }
-
-    io_monitor.stop().await;
-}
-
-#[tokio::test]
-async fn test_checkpoint_resume_functionality() {
-    let temp_dir = TempDir::new().unwrap();
-
-    // Create first scanner instance
-    let scanner1 = {
-        let config = NodeScannerConfig {
-            data_dir: temp_dir.path().to_path_buf(),
-            ..Default::default()
-        };
-        NodeScanner::new("checkpoint-test-node".to_string(), config)
-    };
-
-    // Initialize and simulate some scan progress
-    scanner1.initialize_stats().await.unwrap();
-
-    // Simulate scan progress
-    scanner1
-        .update_scan_progress_for_test(3, 1, Some("checkpoint-test-key".to_string()))
-        .await;
-
-    // Save checkpoint
-    scanner1.force_save_checkpoint().await.unwrap();
-
-    // Stop first scanner
-    scanner1.stop().await.unwrap();
-
-    // Create second scanner instance (simulate restart)
-    let scanner2 = {
-        let config = NodeScannerConfig {
-            data_dir: temp_dir.path().to_path_buf(),
-            ..Default::default()
-        };
-        NodeScanner::new("checkpoint-test-node".to_string(), config)
-    };
-
-    // Try to recover from checkpoint
-    scanner2.start_with_resume().await.unwrap();
-
-    // Verify recovered progress
-    let recovered_progress = scanner2.get_scan_progress().await;
-    assert_eq!(recovered_progress.current_cycle, 3);
-    assert_eq!(recovered_progress.current_disk_index, 1);
-    assert_eq!(recovered_progress.last_scan_key, Some("checkpoint-test-key".to_string()));
-
-    // Cleanup
-    scanner2.cleanup_checkpoint().await.unwrap();
-}
-
-#[tokio::test]
-async fn test_distributed_stats_aggregation() {
-    // Create decentralized stats aggregator
-    let config = DecentralizedStatsAggregatorConfig {
-        cache_ttl: Duration::from_secs(10), // Increase cache TTL to ensure cache is valid during test
-        node_timeout: Duration::from_millis(500), // Reduce timeout
-        ..Default::default()
-    };
-    let aggregator = DecentralizedStatsAggregator::new(config);
-
-    // Simulate multiple nodes (these nodes don't exist in test environment, will cause connection failures)
-    let node_infos = vec![
-        NodeInfo {
-            node_id: "node-1".to_string(),
-            address: "127.0.0.1".to_string(),
-            port: 9001,
-            is_online: true,
-            last_heartbeat: std::time::SystemTime::now(),
-            version: "1.0.0".to_string(),
-        },
-        NodeInfo {
-            node_id: "node-2".to_string(),
-            address: "127.0.0.1".to_string(),
-            port: 9002,
-            is_online: true,
-            last_heartbeat: std::time::SystemTime::now(),
-            version: "1.0.0".to_string(),
-        },
-    ];
-
-    // Add nodes to aggregator
-    for node_info in node_infos {
-        aggregator.add_node(node_info).await;
-    }
-
-    // Set local statistics (simulate local node)
-    let local_stats = StatsSummary {
-        node_id: "local-node".to_string(),
-        total_objects_scanned: 1000,
-        total_healthy_objects: 950,
-        total_corrupted_objects: 50,
-        total_bytes_scanned: 1024 * 1024 * 100, // 100MB
-        total_scan_errors: 5,
-        total_heal_triggered: 10,
-        total_disks: 4,
-        total_buckets: 5,
-        last_update: std::time::SystemTime::now(),
-        scan_progress: Default::default(),
-        data_usage: rustfs_common::data_usage::DataUsageInfo::default(),
-    };
-
-    aggregator.set_local_stats(local_stats).await;
-
-    // Get aggregated statistics (remote nodes will fail, but local node should succeed)
-    let aggregated = aggregator.get_aggregated_stats().await.unwrap();
-
-    // Verify local node statistics are included
-    assert!(aggregated.node_summaries.contains_key("local-node"));
-    assert!(aggregated.total_objects_scanned >= 1000);
-
-    // Only local node data due to remote node connection failures
-    assert_eq!(aggregated.node_summaries.len(), 1);
-
-    // Test caching mechanism
-    let original_timestamp = aggregated.aggregation_timestamp;
-
-    let start_time = std::time::Instant::now();
-    let cached_result = aggregator.get_aggregated_stats().await.unwrap();
-    let cached_duration = start_time.elapsed();
-
-    // Verify cache is effective: timestamps should be the same
-    assert_eq!(original_timestamp, cached_result.aggregation_timestamp);
-
-    // Cached calls should be fast (relaxed to 200ms for test environment)
-    assert!(cached_duration < Duration::from_millis(200));
-
-    // Force refresh
-    let _refreshed = aggregator.force_refresh_aggregated_stats().await.unwrap();
-
-    // Clear cache
-    aggregator.clear_cache().await;
-
-    // Verify cache status
-    let cache_status = aggregator.get_cache_status().await;
-    assert!(!cache_status.has_cached_data);
-}
-
-#[tokio::test]
-async fn test_performance_impact_measurement() {
-    let temp_dir = TempDir::new().unwrap();
-    let scanner = create_test_scanner(&temp_dir).await;
-
-    // Start performance monitoring
-    let io_monitor = scanner.get_io_monitor();
-    let _throttler = scanner.get_io_throttler();
-
-    io_monitor.start().await.unwrap();
-
-    // Baseline test: no scanner load - measure multiple times for stability
-    const MEASUREMENT_COUNT: usize = 5;
-    let mut baseline_measurements = Vec::new();
-    for _ in 0..MEASUREMENT_COUNT {
-        let duration = measure_workload(10_000, Duration::ZERO).await;
-        baseline_measurements.push(duration);
-    }
-    // Use median to reduce impact of outliers
-    baseline_measurements.sort();
-    let median_idx = baseline_measurements.len() / 2;
-    let baseline_duration = baseline_measurements[median_idx].max(Duration::from_millis(20));
-
-    // Simulate scanner activity
-    scanner.update_business_metrics(50, 500, 0, 25).await;
-
-    tokio::time::sleep(Duration::from_millis(200)).await;
-
-    // Performance test: with scanner load - measure multiple times for stability
-    let mut scanner_measurements = Vec::new();
-    for _ in 0..MEASUREMENT_COUNT {
-        let duration = measure_workload(10_000, Duration::ZERO).await;
-        scanner_measurements.push(duration);
-    }
-    scanner_measurements.sort();
-    let median_idx = scanner_measurements.len() / 2;
-    let with_scanner_duration = scanner_measurements[median_idx].max(baseline_duration);
-
-    // Calculate performance impact
-    let baseline_ns = baseline_duration.as_nanos().max(1) as f64;
-    let overhead_duration = with_scanner_duration.saturating_sub(baseline_duration);
-    let overhead_ns = overhead_duration.as_nanos() as f64;
-    let overhead_ms = (overhead_ns / 1_000_000.0).round() as u64;
-    let impact_percentage = (overhead_ns / baseline_ns) * 100.0;
-
-    let benchmark = PerformanceBenchmark {
-        _scanner_overhead_ms: overhead_ms,
-        business_impact_percentage: impact_percentage,
-        _throttle_effectiveness: 95.0, // Simulated value
-    };
-
-    println!("Performance impact measurement:");
-    println!("  Baseline duration: {baseline_duration:?}");
-    println!("  With scanner duration: {with_scanner_duration:?}");
-    println!("  Overhead: {overhead_ms} ms");
-    println!("  Impact percentage: {impact_percentage:.2}%");
-    println!("  Meets optimization goals: {}", benchmark.meets_optimization_goals());
-
-    // Verify optimization target (business impact < 50%)
-    // Note: In test environment, allow higher threshold due to system load variability
-    // In production, the actual impact should be much lower (< 10%)
-    assert!(impact_percentage < 50.0, "Performance impact too high: {impact_percentage:.2}%");
-
-    io_monitor.stop().await;
-}
-
-#[tokio::test]
-async fn test_concurrent_scanner_operations() {
-    let temp_dir = TempDir::new().unwrap();
-    let scanner = Arc::new(create_test_scanner(&temp_dir).await);
-
-    scanner.initialize_stats().await.unwrap();
-
-    // Execute multiple scanner operations concurrently
-    let tasks = vec![
-        // Task 1: Periodically update business metrics
-        {
-            let scanner = scanner.clone();
-            tokio::spawn(async move {
-                for i in 0..10 {
-                    scanner.update_business_metrics(10 + i * 5, 100 + i * 10, i, 5 + i).await;
-                    tokio::time::sleep(Duration::from_millis(50)).await;
-                }
-            })
-        },
-        // Task 2: Periodically save checkpoints
-        {
-            let scanner = scanner.clone();
-            tokio::spawn(async move {
-                for _i in 0..5 {
-                    if let Err(e) = scanner.force_save_checkpoint().await {
-                        eprintln!("Checkpoint save failed: {e}");
-                    }
-                    tokio::time::sleep(Duration::from_millis(100)).await;
-                }
-            })
-        },
-        // Task 3: Periodically get statistics
-        {
-            let scanner = scanner.clone();
-            tokio::spawn(async move {
-                for _i in 0..8 {
-                    let _summary = scanner.get_stats_summary().await;
-                    let _progress = scanner.get_scan_progress().await;
-                    tokio::time::sleep(Duration::from_millis(75)).await;
-                }
-            })
-        },
-    ];
-
-    // Wait for all tasks to complete
-    for task in tasks {
-        task.await.unwrap();
-    }
-
-    // Verify final state
-    let final_stats = scanner.get_stats_summary().await;
-    let _final_progress = scanner.get_scan_progress().await;
-
-    assert_eq!(final_stats.node_id, "integration-test-node");
-    assert!(final_stats.last_update > std::time::SystemTime::UNIX_EPOCH);
-
-    // Cleanup
-    scanner.cleanup_checkpoint().await.unwrap();
-}
-
-// Helper function to simulate business workload
-async fn simulate_business_workload(operations: usize) {
-    for _i in 0..operations {
-        // Simulate some CPU-intensive operations
-        let _result: u64 = (0..100).map(|x| x * x).sum();
-
-        // Small delay to simulate IO operations
-        if _i % 100 == 0 {
-            tokio::task::yield_now().await;
-        }
-    }
-}
-
-async fn measure_workload(operations: usize, extra_delay: Duration) -> Duration {
-    let start = std::time::Instant::now();
-    simulate_business_workload(operations).await;
-    if !extra_delay.is_zero() {
-        tokio::time::sleep(extra_delay).await;
-    }
-    start.elapsed()
-}
-
-#[tokio::test]
-async fn test_error_recovery_and_resilience() {
-    let temp_dir = TempDir::new().unwrap();
-    let scanner = create_test_scanner(&temp_dir).await;
-
-    // Test recovery from stats initialization failure
-    scanner.initialize_stats().await.unwrap();
-
-    // Test recovery from checkpoint corruption
-    scanner.force_save_checkpoint().await.unwrap();
-
-    // Artificially corrupt checkpoint file (by writing invalid data)
-    let checkpoint_file = temp_dir.path().join("scanner_checkpoint_integration-test-node.json");
-    if checkpoint_file.exists() {
-        tokio::fs::write(&checkpoint_file, "invalid json data").await.unwrap();
-    }
-
-    // Verify system can gracefully handle corrupted checkpoint
-    let checkpoint_info = scanner.get_checkpoint_info().await;
-    // Should return error or null value, not crash
-    assert!(checkpoint_info.is_err() || checkpoint_info.unwrap().is_none());
-
-    // Clean up corrupted checkpoint
-    scanner.cleanup_checkpoint().await.unwrap();
-
-    // Verify ability to recreate valid checkpoint
-    scanner.force_save_checkpoint().await.unwrap();
-    let new_checkpoint_info = scanner.get_checkpoint_info().await.unwrap();
-    assert!(new_checkpoint_info.is_some());
-}

crates/ahm/tests/lifecycle_cache_test.rs

@@ -1,508 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use heed::byteorder::BigEndian;
-use heed::types::*;
-use heed::{BoxedError, BytesDecode, BytesEncode, Database, DatabaseFlags, Env, EnvOpenOptions};
-use rustfs_ahm::scanner::local_scan::{self, LocalObjectRecord, LocalScanOutcome};
-use rustfs_ecstore::{
-    disk::endpoint::Endpoint,
-    endpoints::{EndpointServerPools, Endpoints, PoolEndpoints},
-    store::ECStore,
-    store_api::{MakeBucketOptions, ObjectIO, ObjectInfo, ObjectOptions, PutObjReader, StorageAPI},
-};
-use serial_test::serial;
-use std::{
-    borrow::Cow,
-    path::PathBuf,
-    sync::{Arc, Once, OnceLock},
-};
-//use heed_traits::Comparator;
-use time::OffsetDateTime;
-use tokio::fs;
-use tokio_util::sync::CancellationToken;
-use tracing::{debug, info, warn};
-use uuid::Uuid;
-
-static GLOBAL_ENV: OnceLock<(Vec<PathBuf>, Arc<ECStore>)> = OnceLock::new();
-static INIT: Once = Once::new();
-
-static _LIFECYCLE_EXPIRY_CURRENT_DAYS: i32 = 1;
-static _LIFECYCLE_EXPIRY_NONCURRENT_DAYS: i32 = 1;
-static _LIFECYCLE_TRANSITION_CURRENT_DAYS: i32 = 1;
-static _LIFECYCLE_TRANSITION_NONCURRENT_DAYS: i32 = 1;
-static GLOBAL_LMDB_ENV: OnceLock<Env> = OnceLock::new();
-static GLOBAL_LMDB_DB: OnceLock<Database<I64<BigEndian>, LifecycleContentCodec>> = OnceLock::new();
-
-fn init_tracing() {
-    INIT.call_once(|| {
-        let _ = tracing_subscriber::fmt::try_init();
-    });
-}
-
-/// Test helper: Create test environment with ECStore
-async fn setup_test_env() -> (Vec<PathBuf>, Arc<ECStore>) {
-    init_tracing();
-
-    // Fast path: already initialized, just clone and return
-    if let Some((paths, ecstore)) = GLOBAL_ENV.get() {
-        return (paths.clone(), ecstore.clone());
-    }
-
-    // create temp dir as 4 disks with unique base dir
-    let test_base_dir = format!("/tmp/rustfs_ahm_lifecyclecache_test_{}", uuid::Uuid::new_v4());
-    let temp_dir = std::path::PathBuf::from(&test_base_dir);
-    if temp_dir.exists() {
-        fs::remove_dir_all(&temp_dir).await.ok();
-    }
-    fs::create_dir_all(&temp_dir).await.unwrap();
-
-    // create 4 disk dirs
-    let disk_paths = vec![
-        temp_dir.join("disk1"),
-        temp_dir.join("disk2"),
-        temp_dir.join("disk3"),
-        temp_dir.join("disk4"),
-    ];
-
-    for disk_path in &disk_paths {
-        fs::create_dir_all(disk_path).await.unwrap();
-    }
-
-    // create EndpointServerPools
-    let mut endpoints = Vec::new();
-    for (i, disk_path) in disk_paths.iter().enumerate() {
-        let mut endpoint = Endpoint::try_from(disk_path.to_str().unwrap()).unwrap();
-        // set correct index
-        endpoint.set_pool_index(0);
-        endpoint.set_set_index(0);
-        endpoint.set_disk_index(i);
-        endpoints.push(endpoint);
-    }
-
-    let pool_endpoints = PoolEndpoints {
-        legacy: false,
-        set_count: 1,
-        drives_per_set: 4,
-        endpoints: Endpoints::from(endpoints),
-        cmd_line: "test".to_string(),
-        platform: format!("OS: {} | Arch: {}", std::env::consts::OS, std::env::consts::ARCH),
-    };
-
-    let endpoint_pools = EndpointServerPools(vec![pool_endpoints]);
-
-    // format disks (only first time)
-    rustfs_ecstore::store::init_local_disks(endpoint_pools.clone()).await.unwrap();
-
-    // create ECStore with dynamic port 0 (let OS assign) or fixed 9002 if free
-    let port = 9002; // for simplicity
-    let server_addr: std::net::SocketAddr = format!("127.0.0.1:{port}").parse().unwrap();
-    let ecstore = ECStore::new(server_addr, endpoint_pools, CancellationToken::new())
-        .await
-        .unwrap();
-
-    // init bucket metadata system
-    let buckets_list = ecstore
-        .list_bucket(&rustfs_ecstore::store_api::BucketOptions {
-            no_metadata: true,
-            ..Default::default()
-        })
-        .await
-        .unwrap();
-    let buckets = buckets_list.into_iter().map(|v| v.name).collect();
-    rustfs_ecstore::bucket::metadata_sys::init_bucket_metadata_sys(ecstore.clone(), buckets).await;
-
-    //lmdb env
-    // User home directory
-    /*if let Ok(home_dir) = env::var("HOME").or_else(|_| env::var("USERPROFILE")) {
-        let mut path = PathBuf::from(home_dir);
-        path.push(format!(".{DEFAULT_LOG_FILENAME}"));
-        path.push(DEFAULT_LOG_DIR);
-        if ensure_directory_writable(&path) {
-            //return path;
-        }
-    }*/
-    let test_lmdb_lifecycle_dir = "/tmp/lmdb_lifecycle".to_string();
-    let temp_dir = std::path::PathBuf::from(&test_lmdb_lifecycle_dir);
-    if temp_dir.exists() {
-        fs::remove_dir_all(&temp_dir).await.ok();
-    }
-    fs::create_dir_all(&temp_dir).await.unwrap();
-    let lmdb_env = unsafe { EnvOpenOptions::new().max_dbs(100).open(&test_lmdb_lifecycle_dir).unwrap() };
-    let bucket_name = format!("test-lc-cache-{}", "00000");
-    let mut wtxn = lmdb_env.write_txn().unwrap();
-    let db = match lmdb_env
-        .database_options()
-        .name(&format!("bucket_{bucket_name}"))
-        .types::<I64<BigEndian>, LifecycleContentCodec>()
-        .flags(DatabaseFlags::DUP_SORT)
-        //.dup_sort_comparator::<>()
-        .create(&mut wtxn)
-    {
-        Ok(db) => db,
-        Err(err) => {
-            panic!("lmdb error: {err}");
-        }
-    };
-    let _ = wtxn.commit();
-    let _ = GLOBAL_LMDB_ENV.set(lmdb_env);
-    let _ = GLOBAL_LMDB_DB.set(db);
-
-    // Store in global once lock
-    let _ = GLOBAL_ENV.set((disk_paths.clone(), ecstore.clone()));
-
-    (disk_paths, ecstore)
-}
-
-/// Test helper: Create a test bucket
-#[allow(dead_code)]
-async fn create_test_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
-    (**ecstore)
-        .make_bucket(bucket_name, &Default::default())
-        .await
-        .expect("Failed to create test bucket");
-    info!("Created test bucket: {}", bucket_name);
-}
-
-/// Test helper: Create a test lock bucket
-async fn create_test_lock_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
-    (**ecstore)
-        .make_bucket(
-            bucket_name,
-            &MakeBucketOptions {
-                lock_enabled: true,
-                versioning_enabled: true,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("Failed to create test bucket");
-    info!("Created test bucket: {}", bucket_name);
-}
-
-/// Test helper: Upload test object
-async fn upload_test_object(ecstore: &Arc<ECStore>, bucket: &str, object: &str, data: &[u8]) {
-    let mut reader = PutObjReader::from_vec(data.to_vec());
-    let object_info = (**ecstore)
-        .put_object(bucket, object, &mut reader, &ObjectOptions::default())
-        .await
-        .expect("Failed to upload test object");
-
-    println!("object_info1: {object_info:?}");
-
-    info!("Uploaded test object: {}/{} ({} bytes)", bucket, object, object_info.size);
-}
-
-/// Test helper: Check if object exists
-async fn object_exists(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
-    match (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
-        Ok(info) => !info.delete_marker,
-        Err(_) => false,
-    }
-}
-
-fn ns_to_offset_datetime(ns: i128) -> Option<OffsetDateTime> {
-    OffsetDateTime::from_unix_timestamp_nanos(ns).ok()
-}
-
-fn convert_record_to_object_info(record: &LocalObjectRecord) -> ObjectInfo {
-    let usage = &record.usage;
-
-    ObjectInfo {
-        bucket: usage.bucket.clone(),
-        name: usage.object.clone(),
-        size: usage.total_size as i64,
-        delete_marker: !usage.has_live_object && usage.delete_markers_count > 0,
-        mod_time: usage.last_modified_ns.and_then(ns_to_offset_datetime),
-        ..Default::default()
-    }
-}
-
-#[allow(dead_code)]
-fn to_object_info(
-    bucket: &str,
-    object: &str,
-    total_size: i64,
-    delete_marker: bool,
-    mod_time: OffsetDateTime,
-    version_id: &str,
-) -> ObjectInfo {
-    ObjectInfo {
-        bucket: bucket.to_string(),
-        name: object.to_string(),
-        size: total_size,
-        delete_marker,
-        mod_time: Some(mod_time),
-        version_id: Some(Uuid::parse_str(version_id).unwrap()),
-        ..Default::default()
-    }
-}
-
-#[derive(Debug, PartialEq, Eq)]
-enum LifecycleType {
-    ExpiryCurrent,
-    ExpiryNoncurrent,
-    TransitionCurrent,
-    TransitionNoncurrent,
-}
-
-#[derive(Debug, PartialEq, Eq)]
-pub struct LifecycleContent {
-    ver_no: u8,
-    ver_id: String,
-    mod_time: OffsetDateTime,
-    type_: LifecycleType,
-    object_name: String,
-}
-
-pub struct LifecycleContentCodec;
-
-impl BytesEncode<'_> for LifecycleContentCodec {
-    type EItem = LifecycleContent;
-
-    fn bytes_encode(lcc: &Self::EItem) -> Result<Cow<'_, [u8]>, BoxedError> {
-        let (ver_no_byte, ver_id_bytes, mod_timestamp_bytes, type_byte, object_name_bytes) = match lcc {
-            LifecycleContent {
-                ver_no,
-                ver_id,
-                mod_time,
-                type_: LifecycleType::ExpiryCurrent,
-                object_name,
-            } => (
-                ver_no,
-                ver_id.clone().into_bytes(),
-                mod_time.unix_timestamp().to_be_bytes(),
-                0,
-                object_name.clone().into_bytes(),
-            ),
-            LifecycleContent {
-                ver_no,
-                ver_id,
-                mod_time,
-                type_: LifecycleType::ExpiryNoncurrent,
-                object_name,
-            } => (
-                ver_no,
-                ver_id.clone().into_bytes(),
-                mod_time.unix_timestamp().to_be_bytes(),
-                1,
-                object_name.clone().into_bytes(),
-            ),
-            LifecycleContent {
-                ver_no,
-                ver_id,
-                mod_time,
-                type_: LifecycleType::TransitionCurrent,
-                object_name,
-            } => (
-                ver_no,
-                ver_id.clone().into_bytes(),
-                mod_time.unix_timestamp().to_be_bytes(),
-                2,
-                object_name.clone().into_bytes(),
-            ),
-            LifecycleContent {
-                ver_no,
-                ver_id,
-                mod_time,
-                type_: LifecycleType::TransitionNoncurrent,
-                object_name,
-            } => (
-                ver_no,
-                ver_id.clone().into_bytes(),
-                mod_time.unix_timestamp().to_be_bytes(),
-                3,
-                object_name.clone().into_bytes(),
-            ),
-        };
-
-        let mut output = Vec::<u8>::new();
-        output.push(*ver_no_byte);
-        output.extend_from_slice(&ver_id_bytes);
-        output.extend_from_slice(&mod_timestamp_bytes);
-        output.push(type_byte);
-        output.extend_from_slice(&object_name_bytes);
-        Ok(Cow::Owned(output))
-    }
-}
-
-impl<'a> BytesDecode<'a> for LifecycleContentCodec {
-    type DItem = LifecycleContent;
-
-    fn bytes_decode(bytes: &'a [u8]) -> Result<Self::DItem, BoxedError> {
-        use std::mem::size_of;
-
-        let ver_no = match bytes.get(..size_of::<u8>()) {
-            Some(bytes) => bytes.try_into().map(u8::from_be_bytes).unwrap(),
-            None => return Err("invalid LifecycleContent: cannot extract ver_no".into()),
-        };
-
-        let ver_id = match bytes.get(size_of::<u8>()..(36 + 1)) {
-            Some(bytes) => unsafe { std::str::from_utf8_unchecked(bytes).to_string() },
-            None => return Err("invalid LifecycleContent: cannot extract ver_id".into()),
-        };
-
-        let mod_timestamp = match bytes.get((36 + 1)..(size_of::<i64>() + 36 + 1)) {
-            Some(bytes) => bytes.try_into().map(i64::from_be_bytes).unwrap(),
-            None => return Err("invalid LifecycleContent: cannot extract mod_time timestamp".into()),
-        };
-
-        let type_ = match bytes.get(size_of::<i64>() + 36 + 1) {
-            Some(&0) => LifecycleType::ExpiryCurrent,
-            Some(&1) => LifecycleType::ExpiryNoncurrent,
-            Some(&2) => LifecycleType::TransitionCurrent,
-            Some(&3) => LifecycleType::TransitionNoncurrent,
-            Some(_) => return Err("invalid LifecycleContent: invalid LifecycleType".into()),
-            None => return Err("invalid LifecycleContent: cannot extract LifecycleType".into()),
-        };
-
-        let object_name = match bytes.get((size_of::<i64>() + 36 + 1 + 1)..) {
-            Some(bytes) => unsafe { std::str::from_utf8_unchecked(bytes).to_string() },
-            None => return Err("invalid LifecycleContent: cannot extract object_name".into()),
-        };
-
-        Ok(LifecycleContent {
-            ver_no,
-            ver_id,
-            mod_time: OffsetDateTime::from_unix_timestamp(mod_timestamp).unwrap(),
-            type_,
-            object_name,
-        })
-    }
-}
-
-mod serial_tests {
-    use super::*;
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-    #[serial]
-    //#[ignore]
-    async fn test_lifecycle_chche_build() {
-        let (_disk_paths, ecstore) = setup_test_env().await;
-
-        // Create test bucket and object
-        let suffix = uuid::Uuid::new_v4().simple().to_string();
-        let bucket_name = format!("test-lc-cache-{}", &suffix[..8]);
-        let object_name = "test/object.txt"; // Match the lifecycle rule prefix "test/"
-        let test_data = b"Hello, this is test data for lifecycle expiry!";
-
-        create_test_lock_bucket(&ecstore, bucket_name.as_str()).await;
-        upload_test_object(&ecstore, bucket_name.as_str(), object_name, test_data).await;
-
-        // Verify object exists initially
-        assert!(object_exists(&ecstore, bucket_name.as_str(), object_name).await);
-        println!("✅ Object exists before lifecycle processing");
-
-        let scan_outcome = match local_scan::scan_and_persist_local_usage(ecstore.clone()).await {
-            Ok(outcome) => outcome,
-            Err(err) => {
-                warn!("Local usage scan failed: {}", err);
-                LocalScanOutcome::default()
-            }
-        };
-        let bucket_objects_map = &scan_outcome.bucket_objects;
-
-        let records = match bucket_objects_map.get(&bucket_name) {
-            Some(records) => records,
-            None => {
-                debug!("No local snapshot entries found for bucket {}; skipping lifecycle/integrity", bucket_name);
-                &vec![]
-            }
-        };
-
-        if let Some(lmdb_env) = GLOBAL_LMDB_ENV.get()
-            && let Some(lmdb) = GLOBAL_LMDB_DB.get()
-        {
-            let mut wtxn = lmdb_env.write_txn().unwrap();
-
-            /*if let Ok((lc_config, _)) = rustfs_ecstore::bucket::metadata_sys::get_lifecycle_config(bucket_name.as_str()).await {
-                if let Ok(object_info) = ecstore
-                    .get_object_info(bucket_name.as_str(), object_name, &rustfs_ecstore::store_api::ObjectOptions::default())
-                    .await
-                {
-                    let event = rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_ops::eval_action_from_lifecycle(
-                        &lc_config,
-                        None,
-                        None,
-                        &object_info,
-                    )
-                    .await;
-
-                    rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_ops::apply_expiry_on_non_transitioned_objects(
-                        ecstore.clone(),
-                        &object_info,
-                        &event,
-                        &rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_audit::LcEventSrc::Scanner,
-                    )
-                    .await;
-
-                    expired = wait_for_object_absence(&ecstore, bucket_name.as_str(), object_name, Duration::from_secs(2)).await;
-                }
-            }*/
-
-            for record in records {
-                if !record.usage.has_live_object {
-                    continue;
-                }
-
-                let object_info = convert_record_to_object_info(record);
-                println!("object_info2: {object_info:?}");
-                let mod_time = object_info.mod_time.unwrap_or(OffsetDateTime::now_utc());
-                let expiry_time = rustfs_ecstore::bucket::lifecycle::lifecycle::expected_expiry_time(mod_time, 1);
-
-                let version_id = if let Some(version_id) = object_info.version_id {
-                    version_id.to_string()
-                } else {
-                    "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz".to_string()
-                };
-
-                lmdb.put(
-                    &mut wtxn,
-                    &expiry_time.unix_timestamp(),
-                    &LifecycleContent {
-                        ver_no: 0,
-                        ver_id: version_id,
-                        mod_time,
-                        type_: LifecycleType::TransitionNoncurrent,
-                        object_name: object_info.name,
-                    },
-                )
-                .unwrap();
-            }
-
-            wtxn.commit().unwrap();
-
-            let mut wtxn = lmdb_env.write_txn().unwrap();
-            let iter = lmdb.iter_mut(&mut wtxn).unwrap();
-            //let _ = unsafe { iter.del_current().unwrap() };
-            for row in iter {
-                if let Ok(ref elm) = row {
-                    let LifecycleContent {
-                        ver_no,
-                        ver_id,
-                        mod_time,
-                        type_,
-                        object_name,
-                    } = &elm.1;
-                    println!("cache row:{ver_no} {ver_id} {mod_time} {type_:?} {object_name}");
-                }
-                println!("row:{row:?}");
-            }
-            //drop(iter);
-            wtxn.commit().unwrap();
-        }
-
-        println!("Lifecycle cache test completed");
-    }
-}

crates/ahm/tests/optimized_scanner_tests.rs

@@ -1,817 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use rustfs_ahm::heal::manager::HealConfig;
-use rustfs_ahm::scanner::{
-    Scanner,
-    data_scanner::ScanMode,
-    node_scanner::{LoadLevel, NodeScanner, NodeScannerConfig},
-};
-use rustfs_ecstore::{
-    StorageAPI,
-    disk::endpoint::Endpoint,
-    endpoints::{EndpointServerPools, Endpoints, PoolEndpoints},
-    store::ECStore,
-    store_api::{MakeBucketOptions, ObjectIO, PutObjReader},
-};
-use serial_test::serial;
-use std::{fs, net::SocketAddr, sync::Arc, sync::OnceLock, time::Duration};
-use tempfile::TempDir;
-use tokio_util::sync::CancellationToken;
-
-// Global test environment cache to avoid repeated initialization
-static GLOBAL_TEST_ENV: OnceLock<(Vec<std::path::PathBuf>, Arc<ECStore>)> = OnceLock::new();
-
-async fn prepare_test_env(test_dir: Option<&str>, port: Option<u16>) -> (Vec<std::path::PathBuf>, Arc<ECStore>) {
-    // Check if global environment is already initialized
-    if let Some((disk_paths, ecstore)) = GLOBAL_TEST_ENV.get() {
-        return (disk_paths.clone(), ecstore.clone());
-    }
-
-    // create temp dir as 4 disks
-    let test_base_dir = test_dir.unwrap_or("/tmp/rustfs_ahm_optimized_test");
-    let temp_dir = std::path::PathBuf::from(test_base_dir);
-    if temp_dir.exists() {
-        fs::remove_dir_all(&temp_dir).unwrap();
-    }
-    fs::create_dir_all(&temp_dir).unwrap();
-
-    // create 4 disk dirs
-    let disk_paths = vec![
-        temp_dir.join("disk1"),
-        temp_dir.join("disk2"),
-        temp_dir.join("disk3"),
-        temp_dir.join("disk4"),
-    ];
-
-    for disk_path in &disk_paths {
-        fs::create_dir_all(disk_path).unwrap();
-    }
-
-    // create EndpointServerPools
-    let mut endpoints = Vec::new();
-    for (i, disk_path) in disk_paths.iter().enumerate() {
-        let mut endpoint = Endpoint::try_from(disk_path.to_str().unwrap()).unwrap();
-        // set correct index
-        endpoint.set_pool_index(0);
-        endpoint.set_set_index(0);
-        endpoint.set_disk_index(i);
-        endpoints.push(endpoint);
-    }
-
-    let pool_endpoints = PoolEndpoints {
-        legacy: false,
-        set_count: 1,
-        drives_per_set: 4,
-        endpoints: Endpoints::from(endpoints),
-        cmd_line: "test".to_string(),
-        platform: format!("OS: {} | Arch: {}", std::env::consts::OS, std::env::consts::ARCH),
-    };
-
-    let endpoint_pools = EndpointServerPools(vec![pool_endpoints]);
-
-    // format disks
-    rustfs_ecstore::store::init_local_disks(endpoint_pools.clone()).await.unwrap();
-
-    // create ECStore with dynamic port
-    let port = port.unwrap_or(9000);
-    let server_addr: SocketAddr = format!("127.0.0.1:{port}").parse().unwrap();
-    let ecstore = ECStore::new(server_addr, endpoint_pools, CancellationToken::new())
-        .await
-        .unwrap();
-
-    // init bucket metadata system
-    let buckets_list = ecstore
-        .list_bucket(&rustfs_ecstore::store_api::BucketOptions {
-            no_metadata: true,
-            ..Default::default()
-        })
-        .await
-        .unwrap();
-    let buckets = buckets_list.into_iter().map(|v| v.name).collect();
-    rustfs_ecstore::bucket::metadata_sys::init_bucket_metadata_sys(ecstore.clone(), buckets).await;
-
-    // Store in global cache
-    let _ = GLOBAL_TEST_ENV.set((disk_paths.clone(), ecstore.clone()));
-
-    (disk_paths, ecstore)
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_scanner_basic_functionality() {
-    const TEST_DIR_BASIC: &str = "/tmp/rustfs_ahm_optimized_test_basic";
-    let (disk_paths, ecstore) = prepare_test_env(Some(TEST_DIR_BASIC), Some(9101)).await;
-
-    // create some test data
-    let bucket_name = "test-bucket";
-    let object_name = "test-object";
-    let test_data = b"Hello, Optimized RustFS!";
-
-    // create bucket and verify
-    let bucket_opts = MakeBucketOptions::default();
-    ecstore
-        .make_bucket(bucket_name, &bucket_opts)
-        .await
-        .expect("make_bucket failed");
-
-    // check bucket really exists
-    let buckets = ecstore
-        .list_bucket(&rustfs_ecstore::store_api::BucketOptions::default())
-        .await
-        .unwrap();
-    assert!(buckets.iter().any(|b| b.name == bucket_name), "bucket not found after creation");
-
-    // write object
-    let mut put_reader = PutObjReader::from_vec(test_data.to_vec());
-    let object_opts = rustfs_ecstore::store_api::ObjectOptions::default();
-    ecstore
-        .put_object(bucket_name, object_name, &mut put_reader, &object_opts)
-        .await
-        .expect("put_object failed");
-
-    // create optimized Scanner and test basic functionality
-    let scanner = Scanner::new(None, None);
-
-    // Test 1: Normal scan - verify object is found
-    println!("=== Test 1: Optimized Normal scan ===");
-    let scan_result = scanner.scan_cycle().await;
-    assert!(scan_result.is_ok(), "Optimized normal scan should succeed");
-    let _metrics = scanner.get_metrics().await;
-    // Note: The optimized scanner may not immediately show scanned objects as it works differently
-    println!("Optimized normal scan completed successfully");
-
-    // Test 2: Simulate disk corruption - delete object data from disk1
-    println!("=== Test 2: Optimized corruption handling ===");
-    let disk1_bucket_path = disk_paths[0].join(bucket_name);
-    let disk1_object_path = disk1_bucket_path.join(object_name);
-
-    // Try to delete the object file from disk1 (simulate corruption)
-    // Note: This might fail if ECStore is actively using the file
-    match fs::remove_dir_all(&disk1_object_path) {
-        Ok(_) => {
-            println!("Successfully deleted object from disk1: {disk1_object_path:?}");
-
-            // Verify deletion by checking if the directory still exists
-            if disk1_object_path.exists() {
-                println!("WARNING: Directory still exists after deletion: {disk1_object_path:?}");
-            } else {
-                println!("Confirmed: Directory was successfully deleted");
-            }
-        }
-        Err(e) => {
-            println!("Could not delete object from disk1 (file may be in use): {disk1_object_path:?} - {e}");
-            // This is expected behavior - ECStore might be holding file handles
-        }
-    }
-
-    // Scan again - should still complete (even with missing data)
-    let scan_result_after_corruption = scanner.scan_cycle().await;
-    println!("Optimized scan after corruption result: {scan_result_after_corruption:?}");
-
-    // Scanner should handle missing data gracefully
-    assert!(
-        scan_result_after_corruption.is_ok(),
-        "Optimized scanner should handle missing data gracefully"
-    );
-
-    // Test 3: Test metrics collection
-    println!("=== Test 3: Optimized metrics collection ===");
-    let final_metrics = scanner.get_metrics().await;
-    println!("Optimized final metrics: {final_metrics:?}");
-
-    // Verify metrics are available (even if different from legacy scanner)
-    assert!(final_metrics.last_activity.is_some(), "Should have scan activity");
-
-    // clean up temp dir
-    let temp_dir = std::path::PathBuf::from(TEST_DIR_BASIC);
-    if let Err(e) = fs::remove_dir_all(&temp_dir) {
-        eprintln!("Warning: Failed to clean up temp directory {temp_dir:?}: {e}");
-    }
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_scanner_usage_stats() {
-    const TEST_DIR_USAGE_STATS: &str = "/tmp/rustfs_ahm_optimized_test_usage_stats";
-    let (_, ecstore) = prepare_test_env(Some(TEST_DIR_USAGE_STATS), Some(9102)).await;
-
-    // prepare test bucket and object
-    let bucket = "test-bucket-optimized";
-    ecstore.make_bucket(bucket, &Default::default()).await.unwrap();
-    let mut pr = PutObjReader::from_vec(b"hello optimized".to_vec());
-    ecstore
-        .put_object(bucket, "obj1", &mut pr, &Default::default())
-        .await
-        .unwrap();
-
-    let scanner = Scanner::new(None, None);
-
-    // enable statistics
-    scanner.set_config_enable_data_usage_stats(true).await;
-
-    // first scan and get statistics
-    scanner.scan_cycle().await.unwrap();
-    let du_initial = scanner.get_data_usage_info().await.unwrap();
-    // Note: Optimized scanner may work differently, so we're less strict about counts
-    println!("Initial data usage: {du_initial:?}");
-
-    // write 3 more objects and get statistics again
-    for size in [1024, 2048, 4096] {
-        let name = format!("obj_{size}");
-        let mut pr = PutObjReader::from_vec(vec![b'x'; size]);
-        ecstore.put_object(bucket, &name, &mut pr, &Default::default()).await.unwrap();
-    }
-
-    scanner.scan_cycle().await.unwrap();
-    let du_after = scanner.get_data_usage_info().await.unwrap();
-    println!("Data usage after adding objects: {du_after:?}");
-
-    // The optimized scanner should at least not crash and return valid data
-    // buckets_count is u64, so it's always >= 0
-    assert!(du_after.buckets_count == du_after.buckets_count);
-
-    // clean up temp dir
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_USAGE_STATS));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_volume_healing_functionality() {
-    const TEST_DIR_VOLUME_HEAL: &str = "/tmp/rustfs_ahm_optimized_test_volume_heal";
-    let (disk_paths, ecstore) = prepare_test_env(Some(TEST_DIR_VOLUME_HEAL), Some(9103)).await;
-
-    // Create test buckets
-    let bucket1 = "test-bucket-1-opt";
-    let bucket2 = "test-bucket-2-opt";
-
-    ecstore.make_bucket(bucket1, &Default::default()).await.unwrap();
-    ecstore.make_bucket(bucket2, &Default::default()).await.unwrap();
-
-    // Add some test objects
-    let mut pr1 = PutObjReader::from_vec(b"test data 1 optimized".to_vec());
-    ecstore
-        .put_object(bucket1, "obj1", &mut pr1, &Default::default())
-        .await
-        .unwrap();
-
-    let mut pr2 = PutObjReader::from_vec(b"test data 2 optimized".to_vec());
-    ecstore
-        .put_object(bucket2, "obj2", &mut pr2, &Default::default())
-        .await
-        .unwrap();
-
-    // Simulate missing bucket on one disk by removing bucket directory
-    let disk1_bucket1_path = disk_paths[0].join(bucket1);
-    if disk1_bucket1_path.exists() {
-        println!("Removing bucket directory to simulate missing volume: {disk1_bucket1_path:?}");
-        match fs::remove_dir_all(&disk1_bucket1_path) {
-            Ok(_) => println!("Successfully removed bucket directory from disk 0"),
-            Err(e) => println!("Failed to remove bucket directory: {e}"),
-        }
-    }
-
-    // Create optimized scanner
-    let scanner = Scanner::new(None, None);
-
-    // Enable healing in config
-    scanner.set_config_enable_healing(true).await;
-
-    println!("=== Testing optimized volume healing functionality ===");
-
-    // Run scan cycle which should detect missing volume
-    let scan_result = scanner.scan_cycle().await;
-    assert!(scan_result.is_ok(), "Optimized scan cycle should succeed");
-
-    // Get metrics to verify scan completed
-    let metrics = scanner.get_metrics().await;
-    println!("Optimized volume healing detection test completed successfully");
-    println!("Optimized scan metrics: {metrics:?}");
-
-    // Clean up
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_VOLUME_HEAL));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_performance_characteristics() {
-    const TEST_DIR_PERF: &str = "/tmp/rustfs_ahm_optimized_test_perf";
-    let (_, ecstore) = prepare_test_env(Some(TEST_DIR_PERF), Some(9104)).await;
-
-    // Create test bucket with multiple objects
-    let bucket_name = "performance-test-bucket";
-    ecstore.make_bucket(bucket_name, &Default::default()).await.unwrap();
-
-    // Create several test objects
-    for i in 0..10 {
-        let object_name = format!("perf-object-{i}");
-        let test_data = vec![b'A' + (i % 26) as u8; 1024 * (i + 1)]; // Variable size objects
-        let mut put_reader = PutObjReader::from_vec(test_data);
-        let object_opts = rustfs_ecstore::store_api::ObjectOptions::default();
-        ecstore
-            .put_object(bucket_name, &object_name, &mut put_reader, &object_opts)
-            .await
-            .unwrap_or_else(|_| panic!("Failed to create object {object_name}"));
-    }
-
-    // Create optimized scanner
-    let scanner = Scanner::new(None, None);
-
-    // Test performance characteristics
-    println!("=== Testing optimized scanner performance ===");
-
-    // Measure scan time
-    let start_time = std::time::Instant::now();
-    let scan_result = scanner.scan_cycle().await;
-    let scan_duration = start_time.elapsed();
-
-    println!("Optimized scan completed in: {scan_duration:?}");
-    assert!(scan_result.is_ok(), "Performance scan should succeed");
-
-    // Verify the scan was reasonably fast (should be faster than old concurrent scanner)
-    // Note: This is a rough check - in practice, optimized scanner should be much faster
-    assert!(
-        scan_duration < Duration::from_secs(30),
-        "Optimized scan should complete within 30 seconds"
-    );
-
-    // Test memory usage is reasonable (indirect test through successful completion)
-    let metrics = scanner.get_metrics().await;
-    println!("Performance test metrics: {metrics:?}");
-
-    // Test that multiple scans don't degrade performance significantly
-    let start_time2 = std::time::Instant::now();
-    let _scan_result2 = scanner.scan_cycle().await;
-    let scan_duration2 = start_time2.elapsed();
-
-    println!("Second optimized scan completed in: {scan_duration2:?}");
-
-    // Second scan should be similar or faster due to caching
-    let performance_ratio = scan_duration2.as_millis() as f64 / scan_duration.as_millis() as f64;
-    println!("Performance ratio (second/first): {performance_ratio:.2}");
-
-    // Clean up
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_PERF));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_load_balancing_and_throttling() {
-    let temp_dir = TempDir::new().unwrap();
-
-    // Create a node scanner with optimized configuration
-    let config = NodeScannerConfig {
-        data_dir: temp_dir.path().to_path_buf(),
-        enable_smart_scheduling: true,
-        scan_interval: Duration::from_millis(100), // Fast for testing
-        disk_scan_delay: Duration::from_millis(50),
-        ..Default::default()
-    };
-
-    let node_scanner = NodeScanner::new("test-optimized-node".to_string(), config);
-
-    // Initialize the scanner
-    node_scanner.initialize_stats().await.unwrap();
-
-    let io_monitor = node_scanner.get_io_monitor();
-    let throttler = node_scanner.get_io_throttler();
-
-    // Start IO monitoring
-    io_monitor.start().await.expect("Failed to start IO monitor");
-
-    // Test load balancing scenarios
-    let load_scenarios = vec![
-        (LoadLevel::Low, 10, 100, 0, 5), // (load level, latency, qps, error rate, connections)
-        (LoadLevel::Medium, 30, 300, 10, 20),
-        (LoadLevel::High, 80, 800, 50, 50),
-        (LoadLevel::Critical, 200, 1200, 100, 100),
-    ];
-
-    for (expected_level, latency, qps, error_rate, connections) in load_scenarios {
-        println!("Testing load scenario: {expected_level:?}");
-
-        // Update business metrics to simulate load
-        node_scanner
-            .update_business_metrics(latency, qps, error_rate, connections)
-            .await;
-
-        // Wait for monitoring system to respond
-        tokio::time::sleep(Duration::from_millis(500)).await;
-
-        // Get current load level
-        let current_level = io_monitor.get_business_load_level().await;
-        println!("Detected load level: {current_level:?}");
-
-        // Get throttling decision
-        let _current_metrics = io_monitor.get_current_metrics().await;
-        let metrics_snapshot = rustfs_ahm::scanner::io_throttler::MetricsSnapshot {
-            iops: 100 + qps / 10,
-            latency,
-            cpu_usage: std::cmp::min(50 + (qps / 20) as u8, 100),
-            memory_usage: 40,
-        };
-
-        let decision = throttler.make_throttle_decision(current_level, Some(metrics_snapshot)).await;
-
-        println!(
-            "Throttle decision: should_pause={}, delay={:?}",
-            decision.should_pause, decision.suggested_delay
-        );
-
-        // Verify throttling behavior
-        match current_level {
-            LoadLevel::Critical => {
-                assert!(decision.should_pause, "Critical load should trigger pause");
-            }
-            LoadLevel::High => {
-                assert!(
-                    decision.suggested_delay > Duration::from_millis(1000),
-                    "High load should suggest significant delay"
-                );
-            }
-            _ => {
-                // Lower loads should have reasonable delays
-                assert!(
-                    decision.suggested_delay < Duration::from_secs(5),
-                    "Lower loads should not have excessive delays"
-                );
-            }
-        }
-    }
-
-    io_monitor.stop().await;
-
-    println!("Optimized load balancing and throttling test completed successfully");
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_scanner_detect_missing_data_parts() {
-    const TEST_DIR_MISSING_PARTS: &str = "/tmp/rustfs_ahm_optimized_test_missing_parts";
-    let (disk_paths, ecstore) = prepare_test_env(Some(TEST_DIR_MISSING_PARTS), Some(9105)).await;
-
-    // Create test bucket
-    let bucket_name = "test-bucket-parts-opt";
-    let object_name = "large-object-20mb-opt";
-
-    ecstore.make_bucket(bucket_name, &Default::default()).await.unwrap();
-
-    // Create a 20MB object to ensure it has multiple parts
-    let large_data = vec![b'A'; 20 * 1024 * 1024]; // 20MB of 'A' characters
-    let mut put_reader = PutObjReader::from_vec(large_data);
-    let object_opts = rustfs_ecstore::store_api::ObjectOptions::default();
-
-    println!("=== Creating 20MB object ===");
-    ecstore
-        .put_object(bucket_name, object_name, &mut put_reader, &object_opts)
-        .await
-        .expect("put_object failed for large object");
-
-    // Verify object was created and get its info
-    let obj_info = ecstore
-        .get_object_info(bucket_name, object_name, &object_opts)
-        .await
-        .expect("get_object_info failed");
-
-    println!(
-        "Object info: size={}, parts={}, inlined={}",
-        obj_info.size,
-        obj_info.parts.len(),
-        obj_info.inlined
-    );
-    assert!(!obj_info.inlined, "20MB object should not be inlined");
-    println!("Object has {} parts", obj_info.parts.len());
-
-    // Create HealManager and optimized Scanner
-    let heal_storage = Arc::new(rustfs_ahm::heal::storage::ECStoreHealStorage::new(ecstore.clone()));
-    let heal_config = HealConfig {
-        enable_auto_heal: true,
-        heal_interval: Duration::from_millis(100),
-        max_concurrent_heals: 4,
-        task_timeout: Duration::from_secs(300),
-        queue_size: 1000,
-    };
-    let heal_manager = Arc::new(rustfs_ahm::heal::HealManager::new(heal_storage, Some(heal_config)));
-    heal_manager.start().await.unwrap();
-    let scanner = Scanner::new(None, Some(heal_manager.clone()));
-
-    // Enable healing to detect missing parts
-    scanner.set_config_enable_healing(true).await;
-    scanner.set_config_scan_mode(ScanMode::Deep).await;
-
-    println!("=== Initial scan (all parts present) ===");
-    let initial_scan = scanner.scan_cycle().await;
-    assert!(initial_scan.is_ok(), "Initial scan should succeed");
-
-    let initial_metrics = scanner.get_metrics().await;
-    println!("Initial scan metrics: objects_scanned={}", initial_metrics.objects_scanned);
-
-    // Simulate data part loss by deleting part files from some disks
-    println!("=== Simulating data part loss ===");
-    let mut deleted_parts = 0;
-    let mut deleted_part_paths = Vec::new();
-
-    for (disk_idx, disk_path) in disk_paths.iter().enumerate() {
-        if disk_idx > 0 {
-            // Only delete from first disk
-            break;
-        }
-        let bucket_path = disk_path.join(bucket_name);
-        let object_path = bucket_path.join(object_name);
-
-        if !object_path.exists() {
-            continue;
-        }
-
-        // Find the data directory (UUID)
-        if let Ok(entries) = fs::read_dir(&object_path) {
-            for entry in entries.flatten() {
-                let entry_path = entry.path();
-                if entry_path.is_dir() {
-                    // This is likely the data_dir, look for part files inside
-                    let part_file_path = entry_path.join("part.1");
-                    if part_file_path.exists() {
-                        match fs::remove_file(&part_file_path) {
-                            Ok(_) => {
-                                println!("Deleted part file: {part_file_path:?}");
-                                deleted_part_paths.push(part_file_path);
-                                deleted_parts += 1;
-                            }
-                            Err(e) => {
-                                println!("Failed to delete part file {part_file_path:?}: {e}");
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    println!("Deleted {deleted_parts} part files to simulate data loss");
-
-    // Scan again to detect missing parts
-    println!("=== Scan after data deletion (should detect missing data) ===");
-    let scan_after_deletion = scanner.scan_cycle().await;
-
-    // Wait a bit for the heal manager to process
-    tokio::time::sleep(Duration::from_millis(500)).await;
-
-    // Check heal statistics
-    let heal_stats = heal_manager.get_statistics().await;
-    println!("Heal statistics:");
-    println!("  - total_tasks: {}", heal_stats.total_tasks);
-    println!("  - successful_tasks: {}", heal_stats.successful_tasks);
-    println!("  - failed_tasks: {}", heal_stats.failed_tasks);
-
-    // Get scanner metrics
-    let final_metrics = scanner.get_metrics().await;
-    println!("Scanner metrics after deletion scan:");
-    println!("  - objects_scanned: {}", final_metrics.objects_scanned);
-
-    // The optimized scanner should handle missing data gracefully
-    match scan_after_deletion {
-        Ok(_) => {
-            println!("Optimized scanner completed successfully despite missing data");
-        }
-        Err(e) => {
-            println!("Optimized scanner detected errors (acceptable): {e}");
-        }
-    }
-
-    println!("=== Test completed ===");
-    println!("Optimized scanner successfully handled missing data scenario");
-
-    // Clean up
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_MISSING_PARTS));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_scanner_detect_missing_xl_meta() {
-    const TEST_DIR_MISSING_META: &str = "/tmp/rustfs_ahm_optimized_test_missing_meta";
-    let (disk_paths, ecstore) = prepare_test_env(Some(TEST_DIR_MISSING_META), Some(9106)).await;
-
-    // Create test bucket
-    let bucket_name = "test-bucket-meta-opt";
-    let object_name = "test-object-meta-opt";
-
-    ecstore.make_bucket(bucket_name, &Default::default()).await.unwrap();
-
-    // Create a test object
-    let test_data = vec![b'B'; 5 * 1024 * 1024]; // 5MB of 'B' characters
-    let mut put_reader = PutObjReader::from_vec(test_data);
-    let object_opts = rustfs_ecstore::store_api::ObjectOptions::default();
-
-    println!("=== Creating test object ===");
-    ecstore
-        .put_object(bucket_name, object_name, &mut put_reader, &object_opts)
-        .await
-        .expect("put_object failed");
-
-    // Create HealManager and optimized Scanner
-    let heal_storage = Arc::new(rustfs_ahm::heal::storage::ECStoreHealStorage::new(ecstore.clone()));
-    let heal_config = HealConfig {
-        enable_auto_heal: true,
-        heal_interval: Duration::from_millis(100),
-        max_concurrent_heals: 4,
-        task_timeout: Duration::from_secs(300),
-        queue_size: 1000,
-    };
-    let heal_manager = Arc::new(rustfs_ahm::heal::HealManager::new(heal_storage, Some(heal_config)));
-    heal_manager.start().await.unwrap();
-    let scanner = Scanner::new(None, Some(heal_manager.clone()));
-
-    // Enable healing to detect missing metadata
-    scanner.set_config_enable_healing(true).await;
-    scanner.set_config_scan_mode(ScanMode::Deep).await;
-
-    println!("=== Initial scan (all metadata present) ===");
-    let initial_scan = scanner.scan_cycle().await;
-    assert!(initial_scan.is_ok(), "Initial scan should succeed");
-
-    // Simulate xl.meta file loss by deleting xl.meta files from some disks
-    println!("=== Simulating xl.meta file loss ===");
-    let mut deleted_meta_files = 0;
-    let mut deleted_meta_paths = Vec::new();
-
-    for (disk_idx, disk_path) in disk_paths.iter().enumerate() {
-        if disk_idx >= 2 {
-            // Only delete from first two disks to ensure some copies remain
-            break;
-        }
-        let bucket_path = disk_path.join(bucket_name);
-        let object_path = bucket_path.join(object_name);
-
-        if !object_path.exists() {
-            continue;
-        }
-
-        // Delete xl.meta file
-        let xl_meta_path = object_path.join("xl.meta");
-        if xl_meta_path.exists() {
-            match fs::remove_file(&xl_meta_path) {
-                Ok(_) => {
-                    println!("Deleted xl.meta file: {xl_meta_path:?}");
-                    deleted_meta_paths.push(xl_meta_path);
-                    deleted_meta_files += 1;
-                }
-                Err(e) => {
-                    println!("Failed to delete xl.meta file {xl_meta_path:?}: {e}");
-                }
-            }
-        }
-    }
-
-    println!("Deleted {deleted_meta_files} xl.meta files to simulate metadata loss");
-
-    // Scan again to detect missing metadata
-    println!("=== Scan after xl.meta deletion ===");
-    let scan_after_deletion = scanner.scan_cycle().await;
-
-    // Wait for heal manager to process
-    tokio::time::sleep(Duration::from_millis(1000)).await;
-
-    // Check heal statistics
-    let final_heal_stats = heal_manager.get_statistics().await;
-    println!("Final heal statistics:");
-    println!("  - total_tasks: {}", final_heal_stats.total_tasks);
-    println!("  - successful_tasks: {}", final_heal_stats.successful_tasks);
-    println!("  - failed_tasks: {}", final_heal_stats.failed_tasks);
-    let _ = final_heal_stats; // Use the variable to avoid unused warning
-
-    // The optimized scanner should handle missing metadata gracefully
-    match scan_after_deletion {
-        Ok(_) => {
-            println!("Optimized scanner completed successfully despite missing metadata");
-        }
-        Err(e) => {
-            println!("Optimized scanner detected errors (acceptable): {e}");
-        }
-    }
-
-    println!("=== Test completed ===");
-    println!("Optimized scanner successfully handled missing xl.meta scenario");
-
-    // Clean up
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_MISSING_META));
-}
-
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "Please run it manually."]
-#[serial]
-async fn test_optimized_scanner_healthy_objects_not_marked_corrupted() {
-    const TEST_DIR_HEALTHY: &str = "/tmp/rustfs_ahm_optimized_test_healthy_objects";
-    let (_, ecstore) = prepare_test_env(Some(TEST_DIR_HEALTHY), Some(9107)).await;
-
-    // Create heal manager for this test
-    let heal_config = HealConfig::default();
-    let heal_storage = Arc::new(rustfs_ahm::heal::storage::ECStoreHealStorage::new(ecstore.clone()));
-    let heal_manager = Arc::new(rustfs_ahm::heal::manager::HealManager::new(heal_storage, Some(heal_config)));
-    heal_manager.start().await.unwrap();
-
-    // Create optimized scanner with healing enabled
-    let scanner = Scanner::new(None, Some(heal_manager.clone()));
-    scanner.set_config_enable_healing(true).await;
-    scanner.set_config_scan_mode(ScanMode::Deep).await;
-
-    // Create test bucket and multiple healthy objects
-    let bucket_name = "healthy-test-bucket-opt";
-    let bucket_opts = MakeBucketOptions::default();
-    ecstore.make_bucket(bucket_name, &bucket_opts).await.unwrap();
-
-    // Create multiple test objects with different sizes
-    let test_objects = vec![
-        ("small-object-opt", b"Small test data optimized".to_vec()),
-        ("medium-object-opt", vec![42u8; 1024]),  // 1KB
-        ("large-object-opt", vec![123u8; 10240]), // 10KB
-    ];
-
-    let object_opts = rustfs_ecstore::store_api::ObjectOptions::default();
-
-    // Write all test objects
-    for (object_name, test_data) in &test_objects {
-        let mut put_reader = PutObjReader::from_vec(test_data.clone());
-        ecstore
-            .put_object(bucket_name, object_name, &mut put_reader, &object_opts)
-            .await
-            .expect("Failed to put test object");
-        println!("Created test object: {object_name} (size: {} bytes)", test_data.len());
-    }
-
-    // Wait a moment for objects to be fully written
-    tokio::time::sleep(Duration::from_millis(100)).await;
-
-    // Get initial heal statistics
-    let initial_heal_stats = heal_manager.get_statistics().await;
-    println!("Initial heal statistics:");
-    println!("  - total_tasks: {}", initial_heal_stats.total_tasks);
-
-    // Perform initial scan on healthy objects
-    println!("=== Scanning healthy objects ===");
-    let scan_result = scanner.scan_cycle().await;
-    assert!(scan_result.is_ok(), "Scan of healthy objects should succeed");
-
-    // Wait for any potential heal tasks to be processed
-    tokio::time::sleep(Duration::from_millis(1000)).await;
-
-    // Get scanner metrics after scanning
-    let metrics = scanner.get_metrics().await;
-    println!("Optimized scanner metrics after scanning healthy objects:");
-    println!("  - objects_scanned: {}", metrics.objects_scanned);
-    println!("  - healthy_objects: {}", metrics.healthy_objects);
-    println!("  - corrupted_objects: {}", metrics.corrupted_objects);
-
-    // Get heal statistics after scanning
-    let post_scan_heal_stats = heal_manager.get_statistics().await;
-    println!("Heal statistics after scanning healthy objects:");
-    println!("  - total_tasks: {}", post_scan_heal_stats.total_tasks);
-    println!("  - successful_tasks: {}", post_scan_heal_stats.successful_tasks);
-    println!("  - failed_tasks: {}", post_scan_heal_stats.failed_tasks);
-
-    // Critical assertion: healthy objects should not trigger unnecessary heal tasks
-    let heal_tasks_created = post_scan_heal_stats.total_tasks - initial_heal_stats.total_tasks;
-    if heal_tasks_created > 0 {
-        println!("WARNING: {heal_tasks_created} heal tasks were created for healthy objects");
-        // For optimized scanner, we're more lenient as it may work differently
-        println!("Note: Optimized scanner may have different behavior than legacy scanner");
-    } else {
-        println!("✓ No heal tasks created for healthy objects - optimized scanner working correctly");
-    }
-
-    // Perform a second scan to ensure consistency
-    println!("=== Second scan to verify consistency ===");
-    let second_scan_result = scanner.scan_cycle().await;
-    assert!(second_scan_result.is_ok(), "Second scan should also succeed");
-
-    let second_metrics = scanner.get_metrics().await;
-    let _final_heal_stats = heal_manager.get_statistics().await;
-
-    println!("Second scan metrics:");
-    println!("  - objects_scanned: {}", second_metrics.objects_scanned);
-
-    println!("=== Test completed successfully ===");
-    println!("✓ Optimized scanner handled healthy objects correctly");
-    println!("✓ No false positive corruption detection");
-    println!("✓ Objects remain accessible after scanning");
-
-    // Clean up
-    let _ = std::fs::remove_dir_all(std::path::Path::new(TEST_DIR_HEALTHY));
-}

crates/ahm/tests/scanner_optimization_tests.rs

@@ -1,380 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use rustfs_ahm::scanner::{
-    checkpoint::{CheckpointData, CheckpointManager},
-    io_monitor::{AdvancedIOMonitor, IOMonitorConfig},
-    io_throttler::{AdvancedIOThrottler, IOThrottlerConfig},
-    local_stats::LocalStatsManager,
-    node_scanner::{LoadLevel, NodeScanner, NodeScannerConfig, ScanProgress},
-    stats_aggregator::{DecentralizedStatsAggregator, DecentralizedStatsAggregatorConfig},
-};
-use std::time::Duration;
-use tempfile::TempDir;
-
-#[tokio::test]
-async fn test_checkpoint_manager_save_and_load() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "test-node-1";
-    let checkpoint_manager = CheckpointManager::new(node_id, temp_dir.path());
-
-    // create checkpoint
-    let progress = ScanProgress {
-        current_cycle: 5,
-        current_disk_index: 2,
-        last_scan_key: Some("test-object-key".to_string()),
-        ..Default::default()
-    };
-
-    // save checkpoint
-    checkpoint_manager
-        .force_save_checkpoint(&progress)
-        .await
-        .expect("Failed to save checkpoint");
-
-    // load checkpoint
-    let loaded_progress = checkpoint_manager
-        .load_checkpoint()
-        .await
-        .expect("Failed to load checkpoint")
-        .expect("No checkpoint found");
-
-    // verify data
-    assert_eq!(loaded_progress.current_cycle, 5);
-    assert_eq!(loaded_progress.current_disk_index, 2);
-    assert_eq!(loaded_progress.last_scan_key, Some("test-object-key".to_string()));
-}
-
-#[tokio::test]
-async fn test_checkpoint_data_integrity() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "test-node-integrity";
-    let checkpoint_manager = CheckpointManager::new(node_id, temp_dir.path());
-
-    let progress = ScanProgress::default();
-
-    // create checkpoint data
-    let checkpoint_data = CheckpointData::new(progress.clone(), node_id.to_string());
-
-    // verify integrity
-    assert!(checkpoint_data.verify_integrity());
-
-    // save and load
-    checkpoint_manager
-        .force_save_checkpoint(&progress)
-        .await
-        .expect("Failed to save checkpoint");
-
-    let loaded = checkpoint_manager.load_checkpoint().await.expect("Failed to load checkpoint");
-
-    assert!(loaded.is_some());
-}
-
-#[tokio::test]
-async fn test_local_stats_manager() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "test-stats-node";
-    let stats_manager = LocalStatsManager::new(node_id, temp_dir.path());
-
-    // load stats
-    stats_manager.load_stats().await.expect("Failed to load stats");
-
-    // get stats summary
-    let summary = stats_manager.get_stats_summary().await;
-    assert_eq!(summary.node_id, node_id);
-    assert_eq!(summary.total_objects_scanned, 0);
-
-    // record heal triggered
-    stats_manager
-        .record_heal_triggered("test-object", "corruption detected")
-        .await;
-
-    let counters = stats_manager.get_counters();
-    assert_eq!(counters.total_heal_triggered.load(std::sync::atomic::Ordering::Relaxed), 1);
-}
-
-#[tokio::test]
-async fn test_io_monitor_load_level_calculation() {
-    let config = IOMonitorConfig {
-        enable_system_monitoring: false, // use mock data
-        ..Default::default()
-    };
-
-    let io_monitor = AdvancedIOMonitor::new(config);
-    io_monitor.start().await.expect("Failed to start IO monitor");
-
-    // update business metrics to affect load calculation
-    io_monitor.update_business_metrics(50, 100, 0, 10).await;
-
-    // wait for a monitoring cycle
-    tokio::time::sleep(Duration::from_millis(1500)).await;
-
-    let load_level = io_monitor.get_business_load_level().await;
-
-    // load level should be in a reasonable range
-    assert!(matches!(
-        load_level,
-        LoadLevel::Low | LoadLevel::Medium | LoadLevel::High | LoadLevel::Critical
-    ));
-
-    io_monitor.stop().await;
-}
-
-#[tokio::test]
-async fn test_io_throttler_load_adjustment() {
-    let config = IOThrottlerConfig::default();
-    let throttler = AdvancedIOThrottler::new(config);
-
-    // test adjust for load level
-    let low_delay = throttler.adjust_for_load_level(LoadLevel::Low).await;
-    let medium_delay = throttler.adjust_for_load_level(LoadLevel::Medium).await;
-    let high_delay = throttler.adjust_for_load_level(LoadLevel::High).await;
-    let critical_delay = throttler.adjust_for_load_level(LoadLevel::Critical).await;
-
-    // verify delay increment
-    assert!(low_delay < medium_delay);
-    assert!(medium_delay < high_delay);
-    assert!(high_delay < critical_delay);
-
-    // verify pause logic
-    assert!(!throttler.should_pause_scanning(LoadLevel::Low).await);
-    assert!(!throttler.should_pause_scanning(LoadLevel::Medium).await);
-    assert!(!throttler.should_pause_scanning(LoadLevel::High).await);
-    assert!(throttler.should_pause_scanning(LoadLevel::Critical).await);
-}
-
-#[tokio::test]
-async fn test_throttler_business_pressure_simulation() {
-    let throttler = AdvancedIOThrottler::default();
-
-    // run short time pressure test
-    let simulation_duration = Duration::from_millis(500);
-    let result = throttler.simulate_business_pressure(simulation_duration).await;
-
-    // verify simulation result
-    assert!(!result.simulation_records.is_empty());
-    assert!(result.total_duration >= simulation_duration);
-    assert!(result.final_stats.total_decisions > 0);
-
-    // verify all load levels are tested
-    let load_levels: std::collections::HashSet<_> = result.simulation_records.iter().map(|r| r.load_level).collect();
-
-    assert!(load_levels.contains(&LoadLevel::Low));
-    assert!(load_levels.contains(&LoadLevel::Critical));
-}
-
-#[tokio::test]
-async fn test_node_scanner_creation_and_config() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "test-scanner-node".to_string();
-
-    let config = NodeScannerConfig {
-        scan_interval: Duration::from_secs(30),
-        disk_scan_delay: Duration::from_secs(5),
-        enable_smart_scheduling: true,
-        enable_checkpoint: true,
-        data_dir: temp_dir.path().to_path_buf(),
-        ..Default::default()
-    };
-
-    let scanner = NodeScanner::new(node_id.clone(), config);
-
-    // verify node id
-    assert_eq!(scanner.node_id(), &node_id);
-
-    // initialize stats
-    scanner.initialize_stats().await.expect("Failed to initialize stats");
-
-    // get stats summary
-    let summary = scanner.get_stats_summary().await;
-    assert_eq!(summary.node_id, node_id);
-}
-
-#[tokio::test]
-async fn test_decentralized_stats_aggregator() {
-    let config = DecentralizedStatsAggregatorConfig {
-        cache_ttl: Duration::from_millis(100), // short cache ttl for testing
-        ..Default::default()
-    };
-
-    let aggregator = DecentralizedStatsAggregator::new(config);
-
-    // test cache mechanism
-    let _start_time = std::time::Instant::now();
-
-    // first get stats (should trigger aggregation)
-    let stats1 = aggregator
-        .get_aggregated_stats()
-        .await
-        .expect("Failed to get aggregated stats");
-
-    let first_call_duration = _start_time.elapsed();
-
-    // second get stats (should use cache)
-    let cache_start = std::time::Instant::now();
-    let stats2 = aggregator.get_aggregated_stats().await.expect("Failed to get cached stats");
-
-    let cache_call_duration = cache_start.elapsed();
-
-    // cache call should be faster
-    assert!(cache_call_duration < first_call_duration);
-
-    // data should be same
-    assert_eq!(stats1.aggregation_timestamp, stats2.aggregation_timestamp);
-
-    // wait for cache expiration
-    tokio::time::sleep(Duration::from_millis(150)).await;
-
-    // third get should refresh data
-    let stats3 = aggregator
-        .get_aggregated_stats()
-        .await
-        .expect("Failed to get refreshed stats");
-
-    // timestamp should be different
-    assert!(stats3.aggregation_timestamp > stats1.aggregation_timestamp);
-}
-
-#[tokio::test]
-async fn test_scanner_performance_impact() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "performance-test-node".to_string();
-
-    let config = NodeScannerConfig {
-        scan_interval: Duration::from_millis(100), // fast scan for testing
-        disk_scan_delay: Duration::from_millis(10),
-        data_dir: temp_dir.path().to_path_buf(),
-        ..Default::default()
-    };
-
-    let scanner = NodeScanner::new(node_id, config);
-
-    // simulate business workload
-    let _start_time = std::time::Instant::now();
-
-    // update business metrics for high load
-    scanner.update_business_metrics(1500, 3000, 500, 800).await;
-
-    // get io monitor and throttler
-    let io_monitor = scanner.get_io_monitor();
-    let throttler = scanner.get_io_throttler();
-
-    // start io monitor
-    io_monitor.start().await.expect("Failed to start IO monitor");
-
-    // wait for monitor system to stabilize and trigger throttling - increase wait time
-    tokio::time::sleep(Duration::from_millis(1000)).await;
-
-    // simulate some io operations to trigger throttling mechanism
-    for _ in 0..10 {
-        let _current_metrics = io_monitor.get_current_metrics().await;
-        let metrics_snapshot = rustfs_ahm::scanner::io_throttler::MetricsSnapshot {
-            iops: 1000,
-            latency: 100,
-            cpu_usage: 80,
-            memory_usage: 70,
-        };
-        let load_level = io_monitor.get_business_load_level().await;
-        let _decision = throttler.make_throttle_decision(load_level, Some(metrics_snapshot)).await;
-        tokio::time::sleep(Duration::from_millis(50)).await;
-    }
-
-    // check if load level is correctly responded
-    let load_level = io_monitor.get_business_load_level().await;
-
-    // in high load, scanner should automatically adjust
-    let throttle_stats = throttler.get_throttle_stats().await;
-
-    println!("Performance test results:");
-    println!("  Load level: {load_level:?}");
-    println!("  Throttle decisions: {}", throttle_stats.total_decisions);
-    println!("  Average delay: {:?}", throttle_stats.average_delay);
-
-    // verify performance impact control - if load is high enough, there should be throttling delay
-    if load_level != LoadLevel::Low {
-        assert!(throttle_stats.average_delay > Duration::from_millis(0));
-    } else {
-        // in low load, there should be no throttling delay
-        assert!(throttle_stats.average_delay >= Duration::from_millis(0));
-    }
-
-    io_monitor.stop().await;
-}
-
-#[tokio::test]
-async fn test_checkpoint_recovery_resilience() {
-    let temp_dir = TempDir::new().unwrap();
-    let node_id = "resilience-test-node";
-    let checkpoint_manager = CheckpointManager::new(node_id, temp_dir.path());
-
-    // verify checkpoint manager
-    let result = checkpoint_manager.load_checkpoint().await.unwrap();
-    assert!(result.is_none());
-
-    // create and save checkpoint
-    let progress = ScanProgress {
-        current_cycle: 10,
-        current_disk_index: 3,
-        last_scan_key: Some("recovery-test-key".to_string()),
-        ..Default::default()
-    };
-
-    checkpoint_manager
-        .force_save_checkpoint(&progress)
-        .await
-        .expect("Failed to save checkpoint");
-
-    // verify recovery
-    let recovered = checkpoint_manager
-        .load_checkpoint()
-        .await
-        .expect("Failed to load checkpoint")
-        .expect("No checkpoint recovered");
-
-    assert_eq!(recovered.current_cycle, 10);
-    assert_eq!(recovered.current_disk_index, 3);
-
-    // cleanup checkpoint
-    checkpoint_manager
-        .cleanup_checkpoint()
-        .await
-        .expect("Failed to cleanup checkpoint");
-
-    // verify cleanup
-    let after_cleanup = checkpoint_manager.load_checkpoint().await.unwrap();
-    assert!(after_cleanup.is_none());
-}
-
-pub async fn create_test_scanner(temp_dir: &TempDir) -> NodeScanner {
-    let config = NodeScannerConfig {
-        scan_interval: Duration::from_millis(50),
-        disk_scan_delay: Duration::from_millis(10),
-        data_dir: temp_dir.path().to_path_buf(),
-        ..Default::default()
-    };
-
-    NodeScanner::new("integration-test-node".to_string(), config)
-}
-
-pub struct PerformanceBenchmark {
-    pub _scanner_overhead_ms: u64,
-    pub business_impact_percentage: f64,
-    pub _throttle_effectiveness: f64,
-}
-
-impl PerformanceBenchmark {
-    pub fn meets_optimization_goals(&self) -> bool {
-        self.business_impact_percentage < 10.0
-    }
-}

crates/audit/Cargo.toml

@@ -29,6 +29,7 @@ categories = ["web-programming", "development-tools", "asynchronous", "api-bindi
 rustfs-targets = { workspace = true }
 rustfs-config = { workspace = true, features = ["audit", "constants"] }
 rustfs-ecstore = { workspace = true }
+rustfs-s3-common = { workspace = true }
 async-trait = { workspace = true }
 chrono = { workspace = true }
 const-str = { workspace = true }

crates/audit/src/entity.rs

@@ -14,7 +14,7 @@
 
 use chrono::{DateTime, Utc};
 use hashbrown::HashMap;
-use rustfs_targets::EventName;
+use rustfs_s3_common::EventName;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 

crates/audit/src/factory.rs

@@ -19,8 +19,9 @@ use rumqttc::QoS;
 use rustfs_config::audit::{AUDIT_MQTT_KEYS, AUDIT_WEBHOOK_KEYS, ENV_AUDIT_MQTT_KEYS, ENV_AUDIT_WEBHOOK_KEYS};
 use rustfs_config::{
     AUDIT_DEFAULT_DIR, DEFAULT_LIMIT, MQTT_BROKER, MQTT_KEEP_ALIVE_INTERVAL, MQTT_PASSWORD, MQTT_QOS, MQTT_QUEUE_DIR,
-    MQTT_QUEUE_LIMIT, MQTT_RECONNECT_INTERVAL, MQTT_TOPIC, MQTT_USERNAME, WEBHOOK_AUTH_TOKEN, WEBHOOK_CLIENT_CERT,
-    WEBHOOK_CLIENT_KEY, WEBHOOK_ENDPOINT, WEBHOOK_QUEUE_DIR, WEBHOOK_QUEUE_LIMIT,
+    MQTT_QUEUE_LIMIT, MQTT_RECONNECT_INTERVAL, MQTT_TOPIC, MQTT_USERNAME, RUSTFS_WEBHOOK_SKIP_TLS_VERIFY_DEFAULT,
+    WEBHOOK_AUTH_TOKEN, WEBHOOK_CLIENT_CA, WEBHOOK_CLIENT_CERT, WEBHOOK_CLIENT_KEY, WEBHOOK_ENDPOINT, WEBHOOK_QUEUE_DIR,
+    WEBHOOK_QUEUE_LIMIT, WEBHOOK_SKIP_TLS_VERIFY,
 };
 use rustfs_ecstore::config::KVS;
 use rustfs_targets::{
@@ -75,6 +76,11 @@ impl TargetFactory for WebhookTargetFactory {
                 .unwrap_or(DEFAULT_LIMIT),
             client_cert: config.lookup(WEBHOOK_CLIENT_CERT).unwrap_or_default(),
             client_key: config.lookup(WEBHOOK_CLIENT_KEY).unwrap_or_default(),
+            client_ca: config.lookup(WEBHOOK_CLIENT_CA).unwrap_or_default(),
+            skip_tls_verify: config
+                .lookup(WEBHOOK_SKIP_TLS_VERIFY)
+                .and_then(|v| v.parse::<bool>().ok())
+                .unwrap_or(RUSTFS_WEBHOOK_SKIP_TLS_VERIFY_DEFAULT),
             target_type: rustfs_targets::target::TargetType::AuditLog,
         };
 

crates/common/Cargo.toml

@@ -32,6 +32,7 @@ tokio = { workspace = true }
 tonic = { workspace = true }
 uuid = { workspace = true }
 chrono = { workspace = true }
+metrics = { workspace = true }
 rustfs-madmin = { workspace = true }
 rustfs-filemeta = { workspace = true }
 serde = { workspace = true }
@@ -39,4 +40,4 @@ path-clean = { workspace = true }
 rmp-serde = { workspace = true }
 async-trait = { workspace = true }
 s3s = { workspace = true }
-tracing = { workspace = true }
+tracing = { workspace = true }

crates/common/src/data_usage.rs

@@ -436,20 +436,12 @@ impl DataUsageEntry {
         self.obj_sizes.add(summary.total_size as u64);
         self.obj_versions.add(summary.versions as u64);
 
-        let replication_stats = if self.replication_stats.is_none() {
-            self.replication_stats = Some(ReplicationAllStats::default());
-            self.replication_stats.as_mut().unwrap()
-        } else {
-            self.replication_stats.as_mut().unwrap()
-        };
+        let replication_stats = self.replication_stats.get_or_insert_with(ReplicationAllStats::default);
         replication_stats.replica_size += summary.replica_size as u64;
         replication_stats.replica_count += summary.replica_count as u64;
 
         for (arn, st) in &summary.repl_target_stats {
-            let tgt_stat = replication_stats
-                .targets
-                .entry(arn.to_string())
-                .or_insert(ReplicationStats::default());
+            let tgt_stat = replication_stats.targets.entry(arn.to_string()).or_default();
             tgt_stat.pending_size += st.pending_size as u64;
             tgt_stat.failed_size += st.failed_size as u64;
             tgt_stat.replicated_size += st.replicated_size as u64;
@@ -466,10 +458,7 @@ impl DataUsageEntry {
         self.size += other.size;
 
         if let Some(o_rep) = &other.replication_stats {
-            if self.replication_stats.is_none() {
-                self.replication_stats = Some(ReplicationAllStats::default());
-            }
-            let s_rep = self.replication_stats.as_mut().unwrap();
+            let s_rep = self.replication_stats.get_or_insert_with(ReplicationAllStats::default);
             s_rep.targets.clear();
             s_rep.replica_size += o_rep.replica_size;
             s_rep.replica_count += o_rep.replica_count;
@@ -594,7 +583,7 @@ impl DataUsageCache {
                     return Some(root);
                 }
                 let mut flat = self.flatten(&root);
-                if flat.replication_stats.is_some() && flat.replication_stats.as_ref().unwrap().empty() {
+                if flat.replication_stats.as_ref().is_some_and(|stats| stats.empty()) {
                     flat.replication_stats = None;
                 }
                 Some(flat)
@@ -687,7 +676,9 @@ impl DataUsageCache {
         leaves.sort_by(|a, b| a.objects.cmp(&b.objects));
 
         while remove > 0 && !leaves.is_empty() {
-            let e = leaves.first().unwrap();
+            let Some(e) = leaves.first() else {
+                break;
+            };
             let candidate = e.path.clone();
             if candidate == *path && !compact_self {
                 break;
@@ -711,12 +702,9 @@ impl DataUsageCache {
     }
 
     pub fn total_children_rec(&self, path: &str) -> usize {
-        let root = self.find(path);
-
-        if root.is_none() {
+        let Some(root) = self.find(path) else {
             return 0;
-        }
-        let root = root.unwrap();
+        };
         if root.children.is_empty() {
             return 0;
         }
@@ -729,31 +717,36 @@ impl DataUsageCache {
     }
 
     pub fn merge(&mut self, o: &DataUsageCache) {
-        let mut existing_root = self.root();
-        let other_root = o.root();
-        if existing_root.is_none() && other_root.is_none() {
-            return;
-        }
-        if other_root.is_none() {
-            return;
-        }
-        if existing_root.is_none() {
+        let Some(mut existing_root) = self.root() else {
+            if o.root().is_none() {
+                return;
+            }
             *self = o.clone();
             return;
-        }
-        if o.info.last_update.gt(&self.info.last_update) {
+        };
+
+        let Some(other_root) = o.root() else {
+            return;
+        };
+
+        if o.info.last_update > self.info.last_update {
             self.info.last_update = o.info.last_update;
         }
 
-        existing_root.as_mut().unwrap().merge(other_root.as_ref().unwrap());
-        self.cache.insert(hash_path(&self.info.name).key(), existing_root.unwrap());
-        let e_hash = self.root_hash();
-        for key in other_root.as_ref().unwrap().children.iter() {
-            let entry = &o.cache[key];
+        existing_root.merge(&other_root);
+        self.cache.insert(hash_path(&self.info.name).key(), existing_root);
+
+        let root_hash = self.root_hash();
+        for key in other_root.children.iter() {
+            let Some(entry) = o.cache.get(key) else {
+                continue;
+            };
             let flat = o.flatten(entry);
-            let mut existing = self.cache[key].clone();
-            existing.merge(&flat);
-            self.replace_hashed(&DataUsageHash(key.clone()), &Some(e_hash.clone()), &existing);
+            if let Some(existing) = self.cache.get_mut(key) {
+                existing.merge(&flat);
+            } else {
+                self.replace_hashed(&DataUsageHash(key.clone()), &Some(root_hash.clone()), &flat);
+            }
         }
     }
 
@@ -1149,10 +1142,12 @@ impl DataUsageInfo {
         self.buckets_count = self.buckets_usage.len() as u64;
 
         // Update last update time
-        if let Some(other_update) = other.last_update
-            && (self.last_update.is_none() || other_update > self.last_update.unwrap())
-        {
-            self.last_update = Some(other_update);
+        if let Some(other_update) = other.last_update {
+            match self.last_update {
+                None => self.last_update = Some(other_update),
+                Some(self_update) if other_update > self_update => self.last_update = Some(other_update),
+                _ => {}
+            }
         }
     }
 }
@@ -1293,4 +1288,59 @@ mod tests {
         assert_eq!(summary1.total_size, 300);
         assert_eq!(summary1.versions, 15);
     }
+
+    #[test]
+    fn test_data_usage_cache_merge_adds_missing_child() {
+        let mut base = DataUsageCache::default();
+        base.info.name = "bucket".to_string();
+        base.replace("bucket", "", DataUsageEntry::default());
+
+        let mut other = DataUsageCache::default();
+        other.info.name = "bucket".to_string();
+        let child = DataUsageEntry {
+            size: 42,
+            ..Default::default()
+        };
+        other.replace("bucket/child", "bucket", child);
+
+        base.merge(&other);
+
+        let root = base.find("bucket").expect("root bucket should exist");
+        assert_eq!(root.size, 0);
+        let child_entry = base.find("bucket/child").expect("merged child should be added");
+        assert_eq!(child_entry.size, 42);
+    }
+
+    #[test]
+    fn test_data_usage_cache_merge_accumulates_existing_child() {
+        let mut base = DataUsageCache::default();
+        base.info.name = "bucket".to_string();
+        base.replace(
+            "bucket/child",
+            "bucket",
+            DataUsageEntry {
+                size: 10,
+                objects: 1,
+                ..Default::default()
+            },
+        );
+
+        let mut other = DataUsageCache::default();
+        other.info.name = "bucket".to_string();
+        other.replace(
+            "bucket/child",
+            "bucket",
+            DataUsageEntry {
+                size: 20,
+                objects: 2,
+                ..Default::default()
+            },
+        );
+
+        base.merge(&other);
+
+        let child_entry = base.find("bucket/child").expect("child should remain after merge");
+        assert_eq!(child_entry.size, 30);
+        assert_eq!(child_entry.objects, 3);
+    }
 }

crates/common/src/globals.rs

@@ -38,6 +38,14 @@ pub async fn set_global_local_node_name(name: &str) {
     *GLOBAL_LOCAL_NODE_NAME.write().await = name.to_string();
 }
 
+/// Get the global local node name.
+///
+/// # Returns
+/// * `String` - The local node name.
+pub async fn get_global_local_node_name() -> String {
+    GLOBAL_LOCAL_NODE_NAME.read().await.clone()
+}
+
 /// Set the global RustFS initialization time to the current UTC time.
 pub async fn set_global_init_time_now() {
     let now = Utc::now();

crates/common/src/heal_channel.rs

@@ -50,7 +50,7 @@ impl Display for HealItemType {
     }
 }
 
-#[derive(Clone, Copy, Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize)]
 pub enum DriveState {
     Ok,
     Offline,
@@ -59,7 +59,7 @@ pub enum DriveState {
     PermissionDenied,
     Faulty,
     RootMount,
-    Unknown,
+    Unknown(String),
     Unformatted, // only returned by disk
 }
 
@@ -73,12 +73,28 @@ impl DriveState {
             DriveState::PermissionDenied => "permission-denied",
             DriveState::Faulty => "faulty",
             DriveState::RootMount => "root-mount",
-            DriveState::Unknown => "unknown",
+            DriveState::Unknown(reason) => reason,
             DriveState::Unformatted => "unformatted",
         }
     }
 }
 
+impl Clone for DriveState {
+    fn clone(&self) -> Self {
+        match self {
+            DriveState::Unknown(reason) => DriveState::Unknown(reason.clone()),
+            DriveState::Ok => DriveState::Ok,
+            DriveState::Offline => DriveState::Offline,
+            DriveState::Corrupt => DriveState::Corrupt,
+            DriveState::Missing => DriveState::Missing,
+            DriveState::PermissionDenied => DriveState::PermissionDenied,
+            DriveState::Faulty => DriveState::Faulty,
+            DriveState::RootMount => DriveState::RootMount,
+            DriveState::Unformatted => DriveState::Unformatted,
+        }
+    }
+}
+
 impl Display for DriveState {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "{}", self.to_str())
@@ -212,6 +228,8 @@ pub struct HealChannelRequest {
     pub bucket: String,
     /// Object prefix (optional)
     pub object_prefix: Option<String>,
+    /// Object version ID (optional)
+    pub object_version_id: Option<String>,
     /// Force start heal
     pub force_start: bool,
     /// Priority
@@ -278,12 +296,13 @@ type HealResponseSender = broadcast::Sender<HealChannelResponse>;
 static GLOBAL_HEAL_RESPONSE_SENDER: OnceLock<HealResponseSender> = OnceLock::new();
 
 /// Initialize global heal channel
-pub fn init_heal_channel() -> HealChannelReceiver {
+pub fn init_heal_channel() -> Result<HealChannelReceiver, &'static str> {
     let (tx, rx) = mpsc::unbounded_channel();
-    GLOBAL_HEAL_CHANNEL_SENDER
-        .set(tx)
-        .expect("Heal channel sender already initialized");
-    rx
+    if GLOBAL_HEAL_CHANNEL_SENDER.set(tx).is_ok() {
+        Ok(rx)
+    } else {
+        Err("Heal channel sender already initialized")
+    }
 }
 
 /// Get global heal channel sender
@@ -346,6 +365,7 @@ pub fn create_heal_request(
         id: Uuid::new_v4().to_string(),
         bucket,
         object_prefix,
+        object_version_id: None,
         force_start,
         priority: priority.unwrap_or_default(),
         pool_index: None,
@@ -374,6 +394,7 @@ pub fn create_heal_request_with_options(
         id: Uuid::new_v4().to_string(),
         bucket,
         object_prefix,
+        object_version_id: None,
         force_start,
         priority: priority.unwrap_or_default(),
         pool_index,
@@ -501,6 +522,7 @@ pub async fn send_heal_disk(set_disk_id: String, priority: Option<HealChannelPri
         bucket: "".to_string(),
         object_prefix: None,
         disk: Some(set_disk_id),
+        object_version_id: None,
         force_start: false,
         priority: priority.unwrap_or_default(),
         pool_index: None,

crates/common/src/last_minute.rs

@@ -155,10 +155,7 @@ impl LastMinuteLatency {
     }
 
     pub fn add(&mut self, t: &Duration) {
-        let sec = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .expect("Time went backwards")
-            .as_secs();
+        let sec = SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().as_secs();
         self.forward_to(sec);
         let win_idx = sec % 60;
         self.totals[win_idx as usize].add(t);
@@ -174,10 +171,7 @@ impl LastMinuteLatency {
 
     pub fn get_total(&mut self) -> AccElem {
         let mut res = AccElem::default();
-        let sec = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .expect("Time went backwards")
-            .as_secs();
+        let sec = SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().as_secs();
         self.forward_to(sec);
         for elem in self.totals.iter() {
             res.merge(elem);

crates/common/src/metrics.rs

@@ -14,7 +14,8 @@
 
 use crate::last_minute::{AccElem, LastMinuteLatency};
 use chrono::{DateTime, Utc};
-use rustfs_madmin::metrics::ScannerMetrics as M_ScannerMetrics;
+use rustfs_madmin::metrics::{ScannerMetrics as M_ScannerMetrics, TimedAction};
+use serde::{Deserialize, Serialize};
 use std::{
     collections::HashMap,
     fmt::Display,
@@ -64,6 +65,37 @@ impl IlmAction {
             || *self == Self::DeleteAllVersionsAction
             || *self == Self::DelMarkerDeleteAllVersionsAction
     }
+
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::NoneAction => "none",
+            Self::DeleteAction => "delete",
+            Self::DeleteVersionAction => "delete_version",
+            Self::TransitionAction => "transition",
+            Self::TransitionVersionAction => "transition_version",
+            Self::DeleteRestoredAction => "delete_restored",
+            Self::DeleteRestoredVersionAction => "delete_restored_version",
+            Self::DeleteAllVersionsAction => "delete_all_versions",
+            Self::DelMarkerDeleteAllVersionsAction => "del_marker_delete_all_versions",
+            Self::ActionCount => "action_count",
+        }
+    }
+
+    pub fn from_index(i: usize) -> Option<Self> {
+        match i {
+            0 => Some(Self::NoneAction),
+            1 => Some(Self::DeleteAction),
+            2 => Some(Self::DeleteVersionAction),
+            3 => Some(Self::TransitionAction),
+            4 => Some(Self::TransitionVersionAction),
+            5 => Some(Self::DeleteRestoredAction),
+            6 => Some(Self::DeleteRestoredVersionAction),
+            7 => Some(Self::DeleteAllVersionsAction),
+            8 => Some(Self::DelMarkerDeleteAllVersionsAction),
+            9 => Some(Self::ActionCount),
+            _ => None,
+        }
+    }
 }
 
 impl Display for IlmAction {
@@ -96,6 +128,11 @@ pub enum Metric {
     ApplyNonCurrent,
     HealAbandonedVersion,
 
+    // Quota metrics:
+    QuotaCheck,
+    QuotaViolation,
+    QuotaSync,
+
     // START Trace metrics:
     StartTrace,
     ScanObject, // Scan object. All operations included.
@@ -131,6 +168,9 @@ impl Metric {
             Self::CleanAbandoned => "clean_abandoned",
             Self::ApplyNonCurrent => "apply_non_current",
             Self::HealAbandonedVersion => "heal_abandoned_version",
+            Self::QuotaCheck => "quota_check",
+            Self::QuotaViolation => "quota_violation",
+            Self::QuotaSync => "quota_sync",
             Self::StartTrace => "start_trace",
             Self::ScanObject => "scan_object",
             Self::HealAbandonedObject => "heal_abandoned_object",
@@ -163,15 +203,18 @@ impl Metric {
             10 => Some(Self::CleanAbandoned),
             11 => Some(Self::ApplyNonCurrent),
             12 => Some(Self::HealAbandonedVersion),
-            13 => Some(Self::StartTrace),
-            14 => Some(Self::ScanObject),
-            15 => Some(Self::HealAbandonedObject),
-            16 => Some(Self::LastRealtime),
-            17 => Some(Self::ScanFolder),
-            18 => Some(Self::ScanCycle),
-            19 => Some(Self::ScanBucketDrive),
-            20 => Some(Self::CompactFolder),
-            21 => Some(Self::Last),
+            13 => Some(Self::QuotaCheck),
+            14 => Some(Self::QuotaViolation),
+            15 => Some(Self::QuotaSync),
+            16 => Some(Self::StartTrace),
+            17 => Some(Self::ScanObject),
+            18 => Some(Self::HealAbandonedObject),
+            19 => Some(Self::LastRealtime),
+            20 => Some(Self::ScanFolder),
+            21 => Some(Self::ScanCycle),
+            22 => Some(Self::ScanBucketDrive),
+            23 => Some(Self::CompactFolder),
+            24 => Some(Self::Last),
             _ => None,
         }
     }
@@ -261,14 +304,76 @@ pub struct Metrics {
     cycle_info: Arc<RwLock<Option<CurrentCycle>>>,
 }
 
-// This is a placeholder. We'll need to define this struct.
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct CurrentCycle {
     pub current: u64,
+    pub next: u64,
     pub cycle_completed: Vec<DateTime<Utc>>,
     pub started: DateTime<Utc>,
 }
 
+impl CurrentCycle {
+    pub fn unmarshal(&mut self, buf: &[u8]) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        *self = rmp_serde::from_slice(buf)?;
+        Ok(())
+    }
+
+    pub fn marshal(&self) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync>> {
+        Ok(rmp_serde::to_vec(self)?)
+    }
+}
+
+/// OTEL metric name constants for scanner metrics
+const OTEL_SCANNER_OBJECTS_SCANNED: &str = "rustfs_scanner_objects_scanned_total";
+const OTEL_SCANNER_DIRECTORIES_SCANNED: &str = "rustfs_scanner_directories_scanned_total";
+const OTEL_SCANNER_BUCKETS_SCANNED: &str = "rustfs_scanner_buckets_scanned_total";
+const OTEL_SCANNER_CYCLES: &str = "rustfs_scanner_cycles_total";
+const OTEL_SCANNER_CYCLE_DURATION_SECONDS: &str = "rustfs_scanner_cycle_duration_seconds";
+const OTEL_SCANNER_BUCKET_DRIVE_DURATION_SECONDS: &str = "rustfs_scanner_bucket_drive_duration_seconds";
+
+/// Emit an OTEL counter increment for the given scanner metric.
+/// ScanCycle and ScanBucketDrive are handled by dedicated emit functions with labels.
+fn emit_otel_counter(metric: usize, count: u64) {
+    match Metric::from_index(metric) {
+        Some(Metric::ScanObject) => {
+            metrics::counter!(OTEL_SCANNER_OBJECTS_SCANNED).increment(count);
+        }
+        Some(Metric::ScanFolder) => {
+            metrics::counter!(OTEL_SCANNER_DIRECTORIES_SCANNED).increment(count);
+        }
+        _ => {}
+    }
+}
+
+/// Emit OTel metrics for a completed scan cycle.
+/// Counter with result label + gauge for last successful cycle duration.
+pub fn emit_scan_cycle_complete(success: bool, duration: Duration) {
+    let result = if success { "success" } else { "error" };
+    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => result).increment(1);
+    if success {
+        metrics::gauge!(OTEL_SCANNER_CYCLE_DURATION_SECONDS).set(duration.as_secs_f64());
+    }
+}
+
+/// Emit OTel metrics for a completed bucket-drive scan.
+/// Counter with result/bucket/disk labels + histogram for duration.
+pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str, duration: Duration) {
+    let result = if success { "success" } else { "error" };
+    metrics::counter!(
+        OTEL_SCANNER_BUCKETS_SCANNED,
+        "result" => result,
+        "bucket" => bucket.to_owned(),
+        "disk" => disk.to_owned()
+    )
+    .increment(1);
+    metrics::histogram!(
+        OTEL_SCANNER_BUCKET_DRIVE_DURATION_SECONDS,
+        "bucket" => bucket.to_owned(),
+        "disk" => disk.to_owned()
+    )
+    .record(duration.as_secs_f64());
+}
+
 impl Metrics {
     pub fn new() -> Self {
         let operations = (0..Metric::Last as usize).map(|_| AtomicU64::new(0)).collect();
@@ -296,6 +401,7 @@ impl Metrics {
 
             // Update operation count
             global_metrics().operations[metric].fetch_add(1, Ordering::Relaxed);
+            emit_otel_counter(metric, 1);
 
             // Update latency for realtime metrics (spawn async task for this)
             if (metric) < Metric::LastRealtime as usize {
@@ -321,6 +427,7 @@ impl Metrics {
 
             // Update operation count
             global_metrics().operations[metric].fetch_add(1, Ordering::Relaxed);
+            emit_otel_counter(metric, 1);
 
             // Update latency for realtime metrics with size (spawn async task)
             if (metric) < Metric::LastRealtime as usize {
@@ -341,6 +448,7 @@ impl Metrics {
 
             // Update operation count
             global_metrics().operations[metric].fetch_add(1, Ordering::Relaxed);
+            emit_otel_counter(metric, 1);
 
             // Update latency for realtime metrics (spawn async task)
             if (metric) < Metric::LastRealtime as usize {
@@ -362,6 +470,7 @@ impl Metrics {
 
                 // Update operation count
                 global_metrics().operations[metric].fetch_add(count as u64, Ordering::Relaxed);
+                emit_otel_counter(metric, count as u64);
 
                 // Update latency for realtime metrics (spawn async task)
                 if (metric) < Metric::LastRealtime as usize {
@@ -397,6 +506,7 @@ impl Metrics {
         let metric = metric as usize;
         // Update operation count
         global_metrics().operations[metric].fetch_add(1, Ordering::Relaxed);
+        emit_otel_counter(metric, 1);
 
         // Update latency for realtime metrics
         if (metric) < Metric::LastRealtime as usize {
@@ -483,10 +593,43 @@ impl Metrics {
         for i in 0..Metric::LastRealtime as usize {
             let last_min = self.latency[i].total().await;
             if last_min.n > 0
-                && let Some(_metric) = Metric::from_index(i)
+                && let Some(metric) = Metric::from_index(i)
             {
-                // Convert to madmin TimedAction format if needed
-                // This would require implementing the conversion
+                metrics.last_minute.actions.insert(
+                    metric.as_str().to_string(),
+                    TimedAction {
+                        count: last_min.n,
+                        acc_time: last_min.total,
+                        bytes: last_min.size,
+                    },
+                );
+            }
+        }
+
+        // Lifetime ILM operations
+        for i in 0..IlmAction::ActionCount as usize {
+            let count = self.actions[i].load(Ordering::Relaxed);
+            if count > 0
+                && let Some(action) = IlmAction::from_index(i)
+            {
+                metrics.life_time_ilm.insert(action.as_str().to_string(), count);
+            }
+        }
+
+        // Last minute ILM latency
+        for i in 0..IlmAction::ActionCount as usize {
+            let last_min = self.actions_latency[i].total().await;
+            if last_min.n > 0
+                && let Some(action) = IlmAction::from_index(i)
+            {
+                metrics.last_minute.ilm.insert(
+                    action.as_str().to_string(),
+                    TimedAction {
+                        count: last_min.n,
+                        acc_time: last_min.total,
+                        bytes: last_min.size,
+                    },
+                );
             }
         }
 
@@ -539,3 +682,31 @@ impl Default for Metrics {
         Self::new()
     }
 }
+
+pub struct CloseDiskGuard(CloseDiskFn);
+
+impl CloseDiskGuard {
+    pub fn new(close_disk: CloseDiskFn) -> Self {
+        Self(close_disk)
+    }
+
+    pub async fn close(&self) {
+        self.0().await;
+    }
+}
+
+impl Drop for CloseDiskGuard {
+    fn drop(&mut self) {
+        // Drop cannot be async, so we spawn the async cleanup task
+        // The task will run in the background and complete asynchronously
+        if let Ok(handle) = tokio::runtime::Handle::try_current() {
+            let close_fn = self.0.clone();
+            handle.spawn(async move {
+                close_fn().await;
+            });
+        } else {
+            // If we're not in a tokio runtime context, we can't spawn
+            // This is a best-effort cleanup, so we just skip it
+        }
+    }
+}

crates/config/AGENTS.md

@@ -0,0 +1,28 @@
+# Config Crate Instructions
+
+Applies to `crates/config/`.
+
+## Environment Variable Naming
+
+- Global configuration variables must use flat `RUSTFS_*` names.
+- Do not introduce module-segmented names such as `RUSTFS_CONFIG_*`.
+
+Canonical examples:
+
+- `RUSTFS_REGION`
+- `RUSTFS_ADDRESS`
+- `RUSTFS_VOLUMES`
+- `RUSTFS_LICENSE`
+- `RUSTFS_SCANNER_ENABLED`
+- `RUSTFS_HEAL_ENABLED`
+
+## Compatibility
+
+- Deprecated aliases must keep warning behavior.
+- Document aliases in `crates/config/README.md`.
+- Any alias change should include tests for both canonical and deprecated forms.
+
+## Source of Truth
+
+- Constants: `crates/config/src/constants/app.rs`
+- Naming conventions: `crates/config/README.md#environment-variable-naming-conventions`

crates/config/README.md

@@ -32,6 +32,30 @@
 
 For comprehensive documentation, examples, and usage guides, please visit the main [RustFS repository](https://github.com/rustfs/rustfs).
 
+## Environment Variable Naming Conventions
+
+RustFS uses a flat naming style for top-level configuration: environment variables are `RUSTFS_*` without nested module segments.
+
+Examples:
+- `RUSTFS_REGION`
+- `RUSTFS_ADDRESS`
+- `RUSTFS_VOLUMES`
+- `RUSTFS_LICENSE`
+
+Current guidance:
+- Prefer module-specific names only when they are not top-level product configuration.
+- Renamed variables must keep backward-compatible aliases until before beta.
+- Alias usage must emit deprecation warnings and be treated as transitional only.
+- Deprecated example:
+  - `RUSTFS_ENABLE_SCANNER` -> `RUSTFS_SCANNER_ENABLED`
+  - `RUSTFS_ENABLE_HEAL` -> `RUSTFS_HEAL_ENABLED`
+  - `RUSTFS_DATA_SCANNER_START_DELAY_SECS` -> `RUSTFS_SCANNER_START_DELAY_SECS`
+
+## Scanner environment aliases
+
+- `RUSTFS_SCANNER_START_DELAY_SECS` (canonical)
+- `RUSTFS_DATA_SCANNER_START_DELAY_SECS` (deprecated alias for compatibility)
+
 ## 📄 License
 
 This project is licensed under the Apache License 2.0 - see the [LICENSE](../../LICENSE) file for details.

crates/config/src/audit/webhook.rs

@@ -20,9 +20,11 @@ pub const ENV_AUDIT_WEBHOOK_QUEUE_LIMIT: &str = "RUSTFS_AUDIT_WEBHOOK_QUEUE_LIMI
 pub const ENV_AUDIT_WEBHOOK_QUEUE_DIR: &str = "RUSTFS_AUDIT_WEBHOOK_QUEUE_DIR";
 pub const ENV_AUDIT_WEBHOOK_CLIENT_CERT: &str = "RUSTFS_AUDIT_WEBHOOK_CLIENT_CERT";
 pub const ENV_AUDIT_WEBHOOK_CLIENT_KEY: &str = "RUSTFS_AUDIT_WEBHOOK_CLIENT_KEY";
+pub const ENV_AUDIT_WEBHOOK_CLIENT_CA: &str = "RUSTFS_AUDIT_WEBHOOK_CLIENT_CA";
+pub const ENV_AUDIT_WEBHOOK_SKIP_TLS_VERIFY: &str = "RUSTFS_AUDIT_WEBHOOK_SKIP_TLS_VERIFY";
 
 /// List of all environment variable keys for a webhook target.
-pub const ENV_AUDIT_WEBHOOK_KEYS: &[&str; 7] = &[
+pub const ENV_AUDIT_WEBHOOK_KEYS: &[&str; 9] = &[
     ENV_AUDIT_WEBHOOK_ENABLE,
     ENV_AUDIT_WEBHOOK_ENDPOINT,
     ENV_AUDIT_WEBHOOK_AUTH_TOKEN,
@@ -30,6 +32,8 @@ pub const ENV_AUDIT_WEBHOOK_KEYS: &[&str; 7] = &[
     ENV_AUDIT_WEBHOOK_QUEUE_DIR,
     ENV_AUDIT_WEBHOOK_CLIENT_CERT,
     ENV_AUDIT_WEBHOOK_CLIENT_KEY,
+    ENV_AUDIT_WEBHOOK_CLIENT_CA,
+    ENV_AUDIT_WEBHOOK_SKIP_TLS_VERIFY,
 ];
 
 /// A list of all valid configuration keys for a webhook target.
@@ -42,4 +46,6 @@ pub const AUDIT_WEBHOOK_KEYS: &[&str] = &[
     crate::WEBHOOK_CLIENT_CERT,
     crate::WEBHOOK_CLIENT_KEY,
     crate::COMMENT_KEY,
+    crate::WEBHOOK_CLIENT_CA,
+    crate::WEBHOOK_SKIP_TLS_VERIFY,
 ];

crates/config/src/constants/app.rs

@@ -62,8 +62,8 @@ pub const DEFAULT_CONSOLE_ENABLE: bool = true;
 /// Default OBS configuration endpoint
 /// Environment variable: DEFAULT_OBS_ENDPOINT
 /// Command line argument: --obs-endpoint
-/// Example: DEFAULT_OBS_ENDPOINT="http://localost:4317"
-/// Example: --obs-endpoint http://localost:4317
+/// Example: DEFAULT_OBS_ENDPOINT="http://localost:4318"
+/// Example: --obs-endpoint http://localost:4318
 pub const DEFAULT_OBS_ENDPOINT: &str = "";
 
 /// Default TLS key for rustfs
@@ -98,6 +98,45 @@ pub const RUSTFS_HTTP_PREFIX: &str = "http://";
 /// Default value: https://
 pub const RUSTFS_HTTPS_PREFIX: &str = "https://";
 
+/// Default documentation URL for rustfs
+/// This is the default documentation URL for rustfs.
+/// It is used to provide the documentation of the application.
+/// Default value: https://docs.rustfs.com
+pub const RUSTFS_DOCS_URL: &str = "https://docs.rustfs.com";
+
+/// Default GitHub URL for rustfs
+/// This is the default GitHub URL for rustfs.
+/// It is used to provide the source code of the application.
+/// Default value: https://github.com/rustfs/rustfs
+pub const RUSTFS_GITHUB_URL: &str = "https://github.com/rustfs/rustfs";
+
+/// Default license for rustfs
+/// This is the default license for rustfs.
+/// It is used to provide the license of the application.
+/// Default value: Apache-2.0
+pub const RUSTFS_LICENSE: &str = "Apache-2.0";
+
+/// Default license URL for rustfs
+/// This is the default license URL for rustfs.
+/// It is used to provide the license URL of the application.
+/// Default value: https://www.apache.org/licenses/LICENSE-2.0
+pub const RUSTFS_LICENSE_URL: &str = "https://www.apache.org/licenses/LICENSE-2.0";
+
+/// Environment variable for rustfs address
+/// This is the environment variable for rustfs address.
+/// It is used to bind the server to a specific address.
+/// Example: RUSTFS_ADDRESS=":9000"
+pub const ENV_RUSTFS_ADDRESS: &str = "RUSTFS_ADDRESS";
+
+/// Environment variable for server volumes.
+pub const ENV_RUSTFS_VOLUMES: &str = "RUSTFS_VOLUMES";
+
+/// Environment variable for server tls path.
+pub const ENV_RUSTFS_TLS_PATH: &str = "RUSTFS_TLS_PATH";
+
+/// Default value for the server TLS path if `ENV_RUSTFS_TLS_PATH` is not set.
+pub const DEFAULT_RUSTFS_TLS_PATH: &str = "";
+
 /// Default port for rustfs
 /// This is the default port for rustfs.
 /// This is used to bind the server to a specific port.
@@ -113,20 +152,34 @@ pub const DEFAULT_CONSOLE_PORT: u16 = 9001;
 
 /// Default address for rustfs console
 /// This is the default address for rustfs console.
+/// This is used to bind the console server to a specific address.
+/// Default value: :9001
 pub const DEFAULT_CONSOLE_ADDRESS: &str = concat!(":", DEFAULT_CONSOLE_PORT);
 
+/// Default region for rustfs
+/// This is the default region for rustfs.
+/// It is used to identify the region of the application.
+/// Default value: us-east-1
+pub const RUSTFS_REGION: &str = "us-east-1";
+
+/// Environment variable for server region.
+pub const ENV_RUSTFS_REGION: &str = "RUSTFS_REGION";
+
+/// Environment variable for server license.
+pub const ENV_RUSTFS_LICENSE: &str = "RUSTFS_LICENSE";
+
 /// Default log filename for rustfs
 /// This is the default log filename for rustfs.
 /// It is used to store the logs of the application.
 /// Default value: rustfs.log
-/// Environment variable: RUSTFS_OBSERVABILITY_LOG_FILENAME
+/// Environment variable: RUSTFS_OBS_LOG_FILENAME
 pub const DEFAULT_LOG_FILENAME: &str = "rustfs";
 
 /// Default OBS log filename for rustfs
 /// This is the default log filename for OBS.
 /// It is used to store the logs of the application.
 /// Default value: rustfs.log
-pub const DEFAULT_OBS_LOG_FILENAME: &str = concat!(DEFAULT_LOG_FILENAME, "");
+pub const DEFAULT_OBS_LOG_FILENAME: &str = concat!(DEFAULT_LOG_FILENAME, ".log");
 
 /// Default log directory for rustfs
 /// This is the default log directory for rustfs.
@@ -145,9 +198,9 @@ pub const DEFAULT_LOG_ROTATION_SIZE_MB: u64 = 100;
 /// Default log rotation time for rustfs
 /// This is the default log rotation time for rustfs.
 /// It is used to rotate the logs of the application.
-/// Default value: hour, eg: day,hour,minute,second
+/// Default value: hour, eg: daily,hourly,minutely
 /// Environment variable: RUSTFS_OBS_LOG_ROTATION_TIME
-pub const DEFAULT_LOG_ROTATION_TIME: &str = "hour";
+pub const DEFAULT_LOG_ROTATION_TIME: &str = "hourly";
 
 /// Default log keep files for rustfs
 /// This is the default log keep files for rustfs.
@@ -156,11 +209,35 @@ pub const DEFAULT_LOG_ROTATION_TIME: &str = "hour";
 /// Environment variable: RUSTFS_OBS_LOG_KEEP_FILES
 pub const DEFAULT_LOG_KEEP_FILES: usize = 30;
 
+/// Default trace export enabled
+/// It is used to enable or disable exporting traces
+/// Default value: true
+/// Environment variable: RUSTFS_OBS_TRACES_EXPORT_ENABLED
+pub const DEFAULT_OBS_TRACES_EXPORT_ENABLED: bool = true;
+
+/// Default metrics export enabled
+/// It is used to enable or disable exporting metrics
+/// Default value: true
+/// Environment variable: RUSTFS_OBS_METRICS_EXPORT_ENABLED
+pub const DEFAULT_OBS_METRICS_EXPORT_ENABLED: bool = true;
+
+/// Default logs export enabled
+/// It is used to enable or disable exporting logs
+/// Default value: true
+/// Environment variable: RUSTFS_OBS_LOGS_EXPORT_ENABLED
+pub const DEFAULT_OBS_LOGS_EXPORT_ENABLED: bool = true;
+
+/// Default profiling export enabled
+/// It is used to enable or disable exporting profiles
+/// Default value: true
+/// Environment variable: RUSTFS_OBS_PROFILING_EXPORT_ENABLED
+pub const DEFAULT_OBS_PROFILING_EXPORT_ENABLED: bool = true;
+
 /// Default log local logging enabled for rustfs
 /// This is the default log local logging enabled for rustfs.
 /// It is used to enable or disable local logging of the application.
 /// Default value: false
-/// Environment variable: RUSTFS_OBS_LOGL_STDOUT_ENABLED
+/// Environment variable: RUSTFS_OBS_LOG_STDOUT_ENABLED
 pub const DEFAULT_OBS_LOG_STDOUT_ENABLED: bool = false;
 
 /// Constant representing 1 Kibibyte (1024 bytes)
@@ -168,7 +245,7 @@ pub const DEFAULT_OBS_LOG_STDOUT_ENABLED: bool = false;
 pub const KI_B: usize = 1024;
 /// Constant representing 1 Mebibyte (1024 * 1024 bytes)
 /// Default value: 1048576
-pub const MI_B: usize = 1024 * 1024;
+pub const MI_B: usize = 1024 * KI_B;
 
 #[cfg(test)]
 mod tests {

crates/config/src/constants/env.rs

@@ -20,6 +20,8 @@ pub const EVENT_DEFAULT_DIR: &str = "/opt/rustfs/events"; // Default directory f
 pub const AUDIT_DEFAULT_DIR: &str = "/opt/rustfs/audit"; // Default directory for audit store
 pub const DEFAULT_LIMIT: u64 = 100000; // Default store limit
 
+pub const RUSTFS_WEBHOOK_SKIP_TLS_VERIFY_DEFAULT: bool = false;
+
 /// Standard config keys and values.
 pub const ENABLE_KEY: &str = "enable";
 pub const COMMENT_KEY: &str = "comment";

crates/config/src/constants/mod.rs

@@ -19,8 +19,12 @@ pub(crate) mod console;
 pub(crate) mod env;
 pub(crate) mod heal;
 pub(crate) mod object;
+pub(crate) mod oidc;
 pub(crate) mod profiler;
 pub(crate) mod protocols;
+pub(crate) mod proxy;
+pub(crate) mod quota;
 pub(crate) mod runtime;
+pub(crate) mod scanner;
 pub(crate) mod targets;
 pub(crate) mod tls;

crates/config/src/constants/object.rs

@@ -167,3 +167,16 @@ pub const DEFAULT_OBJECT_CACHE_TTI_SECS: u64 = 120;
 ///
 /// Default is set to 5 hits.
 pub const DEFAULT_OBJECT_HOT_MIN_HITS_TO_EXTEND: usize = 5;
+
+/// Skip bitrot hash verification on GetObject reads.
+///
+/// When enabled, GetObject reads skip the per-shard hash
+/// computation and comparison, reducing CPU usage on the read path.
+/// The background scanner still performs full integrity verification.
+/// Does not affect writes, heals, or scanner operations.
+///
+/// Default is false (verify on every read, matching pre-existing behavior).
+pub const ENV_OBJECT_GET_SKIP_BITROT_VERIFY: &str = "RUSTFS_OBJECT_GET_SKIP_BITROT_VERIFY";
+
+/// Default: bitrot verification is enabled on GetObject reads (do not skip).
+pub const DEFAULT_OBJECT_GET_SKIP_BITROT_VERIFY: bool = false;

crates/config/src/constants/oidc.rs

@@ -0,0 +1,91 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// OIDC configuration field keys (used in KVS)
+pub const OIDC_CONFIG_URL: &str = "config_url";
+pub const OIDC_CLIENT_ID: &str = "client_id";
+pub const OIDC_CLIENT_SECRET: &str = "client_secret";
+pub const OIDC_SCOPES: &str = "scopes";
+pub const OIDC_REDIRECT_URI: &str = "redirect_uri";
+pub const OIDC_REDIRECT_URI_DYNAMIC: &str = "redirect_uri_dynamic";
+pub const OIDC_CLAIM_NAME: &str = "claim_name";
+pub const OIDC_CLAIM_PREFIX: &str = "claim_prefix";
+pub const OIDC_ROLE_POLICY: &str = "role_policy";
+pub const OIDC_DISPLAY_NAME: &str = "display_name";
+pub const OIDC_GROUPS_CLAIM: &str = "groups_claim";
+pub const OIDC_EMAIL_CLAIM: &str = "email_claim";
+pub const OIDC_USERNAME_CLAIM: &str = "username_claim";
+
+// Environment variable names for OIDC
+pub const ENV_IDENTITY_OPENID_ENABLE: &str = "RUSTFS_IDENTITY_OPENID_ENABLE";
+pub const ENV_IDENTITY_OPENID_CONFIG_URL: &str = "RUSTFS_IDENTITY_OPENID_CONFIG_URL";
+pub const ENV_IDENTITY_OPENID_CLIENT_ID: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_ID";
+pub const ENV_IDENTITY_OPENID_CLIENT_SECRET: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_SECRET";
+pub const ENV_IDENTITY_OPENID_SCOPES: &str = "RUSTFS_IDENTITY_OPENID_SCOPES";
+pub const ENV_IDENTITY_OPENID_REDIRECT_URI: &str = "RUSTFS_IDENTITY_OPENID_REDIRECT_URI";
+pub const ENV_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC: &str = "RUSTFS_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC";
+pub const ENV_IDENTITY_OPENID_CLAIM_NAME: &str = "RUSTFS_IDENTITY_OPENID_CLAIM_NAME";
+pub const ENV_IDENTITY_OPENID_CLAIM_PREFIX: &str = "RUSTFS_IDENTITY_OPENID_CLAIM_PREFIX";
+pub const ENV_IDENTITY_OPENID_ROLE_POLICY: &str = "RUSTFS_IDENTITY_OPENID_ROLE_POLICY";
+pub const ENV_IDENTITY_OPENID_DISPLAY_NAME: &str = "RUSTFS_IDENTITY_OPENID_DISPLAY_NAME";
+pub const ENV_IDENTITY_OPENID_GROUPS_CLAIM: &str = "RUSTFS_IDENTITY_OPENID_GROUPS_CLAIM";
+pub const ENV_IDENTITY_OPENID_EMAIL_CLAIM: &str = "RUSTFS_IDENTITY_OPENID_EMAIL_CLAIM";
+pub const ENV_IDENTITY_OPENID_USERNAME_CLAIM: &str = "RUSTFS_IDENTITY_OPENID_USERNAME_CLAIM";
+
+/// List of all environment variable keys for an OIDC provider.
+pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 14] = &[
+    ENV_IDENTITY_OPENID_ENABLE,
+    ENV_IDENTITY_OPENID_CONFIG_URL,
+    ENV_IDENTITY_OPENID_CLIENT_ID,
+    ENV_IDENTITY_OPENID_CLIENT_SECRET,
+    ENV_IDENTITY_OPENID_SCOPES,
+    ENV_IDENTITY_OPENID_REDIRECT_URI,
+    ENV_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC,
+    ENV_IDENTITY_OPENID_CLAIM_NAME,
+    ENV_IDENTITY_OPENID_CLAIM_PREFIX,
+    ENV_IDENTITY_OPENID_ROLE_POLICY,
+    ENV_IDENTITY_OPENID_DISPLAY_NAME,
+    ENV_IDENTITY_OPENID_GROUPS_CLAIM,
+    ENV_IDENTITY_OPENID_EMAIL_CLAIM,
+    ENV_IDENTITY_OPENID_USERNAME_CLAIM,
+];
+
+/// A list of all valid configuration keys for an OIDC provider.
+pub const IDENTITY_OPENID_KEYS: &[&str] = &[
+    crate::ENABLE_KEY,
+    OIDC_CONFIG_URL,
+    OIDC_CLIENT_ID,
+    OIDC_CLIENT_SECRET,
+    OIDC_SCOPES,
+    OIDC_REDIRECT_URI,
+    OIDC_REDIRECT_URI_DYNAMIC,
+    OIDC_CLAIM_NAME,
+    OIDC_CLAIM_PREFIX,
+    OIDC_ROLE_POLICY,
+    OIDC_DISPLAY_NAME,
+    OIDC_GROUPS_CLAIM,
+    OIDC_EMAIL_CLAIM,
+    OIDC_USERNAME_CLAIM,
+    crate::COMMENT_KEY,
+];
+
+// Default values
+pub const OIDC_DEFAULT_SCOPES: &str = "openid,profile,email";
+pub const OIDC_DEFAULT_CLAIM_NAME: &str = "groups";
+pub const OIDC_DEFAULT_GROUPS_CLAIM: &str = "groups";
+pub const OIDC_DEFAULT_EMAIL_CLAIM: &str = "email";
+pub const OIDC_DEFAULT_USERNAME_CLAIM: &str = "preferred_username";
+
+// Subsystem identifier
+pub const IDENTITY_OPENID_SUB_SYS: &str = "identity_openid";

crates/config/src/constants/protocols.rs

@@ -14,27 +14,46 @@
 
 //! Protocol server configuration constants
 
-/// Default FTPS server bind address
-pub const DEFAULT_FTPS_ADDRESS: &str = "0.0.0.0:8021";
+/// Default FTP server bind address (non-encrypted)
+pub const DEFAULT_FTP_ADDRESS: &str = "0.0.0.0:8021";
 
-/// Default SFTP server bind address
-pub const DEFAULT_SFTP_ADDRESS: &str = "0.0.0.0:8022";
+/// Default FTPS server bind address (FTP over TLS)
+pub const DEFAULT_FTPS_ADDRESS: &str = "0.0.0.0:8022";
+
+/// Default FTP passive ports range (optional)
+pub const DEFAULT_FTP_PASSIVE_PORTS: Option<&str> = None;
 
 /// Default FTPS passive ports range (optional)
 pub const DEFAULT_FTPS_PASSIVE_PORTS: Option<&str> = None;
 
+/// Default FTP external IP (auto-detected)
+pub const DEFAULT_FTP_EXTERNAL_IP: Option<&str> = None;
+
 /// Default FTPS external IP (auto-detected)
 pub const DEFAULT_FTPS_EXTERNAL_IP: Option<&str> = None;
 
 /// Environment variable names
+pub const ENV_FTP_ENABLE: &str = "RUSTFS_FTP_ENABLE";
+pub const ENV_FTP_ADDRESS: &str = "RUSTFS_FTP_ADDRESS";
+pub const ENV_FTP_PASSIVE_PORTS: &str = "RUSTFS_FTP_PASSIVE_PORTS";
+pub const ENV_FTP_EXTERNAL_IP: &str = "RUSTFS_FTP_EXTERNAL_IP";
+
 pub const ENV_FTPS_ENABLE: &str = "RUSTFS_FTPS_ENABLE";
 pub const ENV_FTPS_ADDRESS: &str = "RUSTFS_FTPS_ADDRESS";
-pub const ENV_FTPS_CERTS_FILE: &str = "RUSTFS_FTPS_CERTS_FILE";
-pub const ENV_FTPS_KEY_FILE: &str = "RUSTFS_FTPS_KEY_FILE";
+pub const ENV_FTPS_TLS_ENABLED: &str = "RUSTFS_FTPS_TLS_ENABLED";
+pub const ENV_FTPS_CERTS_DIR: &str = "RUSTFS_FTPS_CERTS_DIR";
+pub const ENV_FTPS_CA_FILE: &str = "RUSTFS_FTPS_CA_FILE";
 pub const ENV_FTPS_PASSIVE_PORTS: &str = "RUSTFS_FTPS_PASSIVE_PORTS";
 pub const ENV_FTPS_EXTERNAL_IP: &str = "RUSTFS_FTPS_EXTERNAL_IP";
 
-pub const ENV_SFTP_ENABLE: &str = "RUSTFS_SFTP_ENABLE";
-pub const ENV_SFTP_ADDRESS: &str = "RUSTFS_SFTP_ADDRESS";
-pub const ENV_SFTP_HOST_KEY: &str = "RUSTFS_SFTP_HOST_KEY";
-pub const ENV_SFTP_AUTHORIZED_KEYS: &str = "RUSTFS_SFTP_AUTHORIZED_KEYS";
+/// Default WebDAV server bind address
+pub const DEFAULT_WEBDAV_ADDRESS: &str = "0.0.0.0:8080";
+
+/// WebDAV environment variable names
+pub const ENV_WEBDAV_ENABLE: &str = "RUSTFS_WEBDAV_ENABLE";
+pub const ENV_WEBDAV_ADDRESS: &str = "RUSTFS_WEBDAV_ADDRESS";
+pub const ENV_WEBDAV_TLS_ENABLED: &str = "RUSTFS_WEBDAV_TLS_ENABLED";
+pub const ENV_WEBDAV_CERTS_DIR: &str = "RUSTFS_WEBDAV_CERTS_DIR";
+pub const ENV_WEBDAV_CA_FILE: &str = "RUSTFS_WEBDAV_CA_FILE";
+pub const ENV_WEBDAV_MAX_BODY_SIZE: &str = "RUSTFS_WEBDAV_MAX_BODY_SIZE";
+pub const ENV_WEBDAV_REQUEST_TIMEOUT: &str = "RUSTFS_WEBDAV_REQUEST_TIMEOUT";

crates/config/src/constants/proxy.rs

@@ -0,0 +1,125 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::DEFAULT_LOG_LEVEL;
+
+// ==================== Base Proxy Configuration ====================
+/// Environment variable to enable the trusted proxy middleware.
+pub const ENV_TRUSTED_PROXY_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_ENABLED";
+/// Trusted proxy middleware is enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_ENABLED: bool = true;
+
+/// Environment variable for the proxy validation mode.
+pub const ENV_TRUSTED_PROXY_VALIDATION_MODE: &str = "RUSTFS_TRUSTED_PROXY_VALIDATION_MODE";
+/// Default validation mode is "hop_by_hop".
+pub const DEFAULT_TRUSTED_PROXY_VALIDATION_MODE: &str = "hop_by_hop";
+
+/// Environment variable to enable RFC 7239 "Forwarded" header support.
+pub const ENV_TRUSTED_PROXY_ENABLE_RFC7239: &str = "RUSTFS_TRUSTED_PROXY_ENABLE_RFC7239";
+/// RFC 7239 support is enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_ENABLE_RFC7239: bool = true;
+
+/// Environment variable for the maximum allowed proxy hops.
+pub const ENV_TRUSTED_PROXY_MAX_HOPS: &str = "RUSTFS_TRUSTED_PROXY_MAX_HOPS";
+/// Default maximum hops is 10.
+pub const DEFAULT_TRUSTED_PROXY_MAX_HOPS: usize = 10;
+
+/// Environment variable to enable proxy chain continuity checks.
+pub const ENV_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK: &str = "RUSTFS_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK";
+/// Continuity checks are enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_CHAIN_CONTINUITY_CHECK: bool = true;
+
+/// Environment variable to enable logging of failed proxy validations.
+pub const ENV_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS: &str = "RUSTFS_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS";
+/// Logging of failed validations is enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_LOG_FAILED_VALIDATIONS: bool = true;
+
+// ==================== Trusted Proxy Networks ====================
+/// Environment variable for the list of trusted proxy networks (comma-separated IP/CIDR).
+pub const ENV_TRUSTED_PROXY_PROXIES: &str = "RUSTFS_TRUSTED_PROXY_NETWORKS";
+/// Default trusted networks include localhost and common private ranges.
+pub const DEFAULT_TRUSTED_PROXY_PROXIES: &str = "127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fd00::/8";
+
+/// Environment variable for additional trusted proxy networks (production specific).
+pub const ENV_TRUSTED_PROXY_EXTRA_PROXIES: &str = "RUSTFS_TRUSTED_PROXY_EXTRA_NETWORKS";
+/// No extra trusted networks by default.
+pub const DEFAULT_TRUSTED_PROXY_EXTRA_PROXIES: &str = "";
+
+/// Environment variable for individual trusted proxy IPs.
+pub const ENV_TRUSTED_PROXY_IPS: &str = "RUSTFS_TRUSTED_PROXY_IPS";
+/// No individual trusted IPs by default.
+pub const DEFAULT_TRUSTED_PROXY_IPS: &str = "";
+
+/// Environment variable for private network ranges used in internal validation.
+pub const ENV_TRUSTED_PROXY_PRIVATE_NETWORKS: &str = "RUSTFS_TRUSTED_PROXY_PRIVATE_NETWORKS";
+/// Default private networks include common RFC 1918 and RFC 4193 ranges.
+pub const DEFAULT_TRUSTED_PROXY_PRIVATE_NETWORKS: &str = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fd00::/8";
+
+// ==================== Cache Configuration ====================
+/// Environment variable for the proxy validation cache capacity.
+pub const ENV_TRUSTED_PROXY_CACHE_CAPACITY: &str = "RUSTFS_TRUSTED_PROXY_CACHE_CAPACITY";
+/// Default cache capacity is 10,000 entries.
+pub const DEFAULT_TRUSTED_PROXY_CACHE_CAPACITY: usize = 10_000;
+
+/// Environment variable for the cache entry time-to-live (TTL) in seconds.
+pub const ENV_TRUSTED_PROXY_CACHE_TTL_SECONDS: &str = "RUSTFS_TRUSTED_PROXY_CACHE_TTL_SECONDS";
+/// Default cache TTL is 300 seconds (5 minutes).
+pub const DEFAULT_TRUSTED_PROXY_CACHE_TTL_SECONDS: u64 = 300;
+
+/// Environment variable for the cache cleanup interval in seconds.
+pub const ENV_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL: &str = "RUSTFS_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL";
+/// Default cleanup interval is 60 seconds.
+pub const DEFAULT_TRUSTED_PROXY_CACHE_CLEANUP_INTERVAL: u64 = 60;
+
+// ==================== Monitoring Configuration ====================
+/// Environment variable to enable Prometheus metrics.
+pub const ENV_TRUSTED_PROXY_METRICS_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_METRICS_ENABLED";
+/// Metrics are enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_METRICS_ENABLED: bool = true;
+
+/// Environment variable for the application log level.
+pub const ENV_TRUSTED_PROXIES_LOG_LEVEL: &str = "RUSTFS_TRUSTED_PROXY_LOG_LEVEL";
+/// Default log level is "info".
+pub const DEFAULT_TRUSTED_PROXIES_LOG_LEVEL: &str = DEFAULT_LOG_LEVEL;
+
+/// Environment variable to enable structured JSON logging.
+pub const ENV_TRUSTED_PROXY_STRUCTURED_LOGGING: &str = "RUSTFS_TRUSTED_PROXY_STRUCTURED_LOGGING";
+/// Structured logging is disabled by default.
+pub const DEFAULT_TRUSTED_PROXY_STRUCTURED_LOGGING: bool = false;
+
+/// Environment variable to enable distributed tracing.
+pub const ENV_TRUSTED_PROXY_TRACING_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_TRACING_ENABLED";
+/// Tracing is enabled by default.
+pub const DEFAULT_TRUSTED_PROXY_TRACING_ENABLED: bool = true;
+
+// ==================== Cloud Integration ====================
+/// Environment variable to enable automatic cloud metadata discovery.
+pub const ENV_TRUSTED_PROXY_CLOUD_METADATA_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_METADATA_ENABLED";
+/// Cloud metadata discovery is disabled by default.
+pub const DEFAULT_TRUSTED_PROXY_CLOUD_METADATA_ENABLED: bool = false;
+
+/// Environment variable for the cloud metadata request timeout in seconds.
+pub const ENV_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT";
+/// Default cloud metadata timeout is 5 seconds.
+pub const DEFAULT_TRUSTED_PROXY_CLOUD_METADATA_TIMEOUT: u64 = 5;
+
+/// Environment variable to enable Cloudflare IP range integration.
+pub const ENV_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED: &str = "RUSTFS_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED";
+/// Cloudflare integration is disabled by default.
+pub const DEFAULT_TRUSTED_PROXY_CLOUDFLARE_IPS_ENABLED: bool = false;
+
+/// Environment variable to force a specific cloud provider (overrides auto-detection).
+pub const ENV_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE: &str = "RUSTFS_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE";
+/// No forced provider by default.
+pub const DEFAULT_TRUSTED_PROXY_CLOUD_PROVIDER_FORCE: &str = "";

crates/config/src/constants/quota.rs

@@ -0,0 +1,26 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub const QUOTA_CONFIG_FILE: &str = "quota.json";
+pub const QUOTA_TYPE_HARD: &str = "HARD";
+
+pub const QUOTA_EXCEEDED_ERROR_CODE: &str = "XRustfsQuotaExceeded";
+pub const QUOTA_INVALID_CONFIG_ERROR_CODE: &str = "InvalidArgument";
+pub const QUOTA_NOT_FOUND_ERROR_CODE: &str = "NoSuchBucket";
+pub const QUOTA_INTERNAL_ERROR_CODE: &str = "InternalError";
+
+pub const QUOTA_API_PATH: &str = "/rustfs/admin/v3/quota/{bucket}";
+
+pub const QUOTA_INVALID_TYPE_ERROR_MSG: &str = "Only HARD quota type is supported";
+pub const QUOTA_METADATA_SYSTEM_ERROR_MSG: &str = "Bucket metadata system not initialized";

crates/config/src/constants/scanner.rs

@@ -0,0 +1,118 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::time::Duration;
+
+/// Canonical environment variable name that specifies the scanner start delay in seconds.
+/// If set, this overrides the cycle interval derived from `RUSTFS_SCANNER_SPEED`.
+/// - Unit: seconds (u64).
+/// - Example: `export RUSTFS_SCANNER_START_DELAY_SECS=10`
+pub const ENV_SCANNER_START_DELAY_SECS: &str = "RUSTFS_SCANNER_START_DELAY_SECS";
+
+/// Deprecated compatibility alias for scanner start delay.
+/// Prefer `RUSTFS_SCANNER_START_DELAY_SECS`.
+#[deprecated(note = "Use RUSTFS_SCANNER_START_DELAY_SECS instead")]
+pub const ENV_DATA_SCANNER_START_DELAY_SECS: &str = "RUSTFS_DATA_SCANNER_START_DELAY_SECS";
+
+/// Environment variable that selects the scanner speed preset.
+/// Valid values: `fastest`, `fast`, `default`, `slow`, `slowest`.
+/// Controls the sleep factor, maximum sleep duration, and cycle interval.
+/// - Example: `export RUSTFS_SCANNER_SPEED=slow`
+pub const ENV_SCANNER_SPEED: &str = "RUSTFS_SCANNER_SPEED";
+
+/// Default scanner speed preset.
+pub const DEFAULT_SCANNER_SPEED: &str = "default";
+
+/// Environment variable that controls whether the scanner sleeps between operations.
+/// When `true` (default), the scanner throttles itself. When `false`, it runs at full speed.
+/// - Example: `export RUSTFS_SCANNER_IDLE_MODE=false`
+pub const ENV_SCANNER_IDLE_MODE: &str = "RUSTFS_SCANNER_IDLE_MODE";
+
+/// Default scanner idle mode.
+pub const DEFAULT_SCANNER_IDLE_MODE: bool = true;
+
+/// Scanner speed preset controlling throttling behavior.
+///
+/// Each preset defines three parameters:
+/// - **sleep_factor**: Multiplier applied to elapsed work time to compute inter-object sleep.
+/// - **max_sleep**: Upper bound on any single throttle sleep.
+/// - **cycle_interval**: Base delay between scan cycles.
+///
+/// | Preset    | Factor | Max Sleep | Cycle Interval |
+/// |-----------|--------|-----------|----------------|
+/// | `fastest` | 0      | 0         | 1 second       |
+/// | `fast`    | 1x     | 100ms     | 1 minute       |
+/// | `default` | 2x     | 1 second  | 1 minute       |
+/// | `slow`    | 10x    | 15 seconds| 1 minute       |
+/// | `slowest` | 100x   | 15 seconds| 30 minutes     |
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum ScannerSpeed {
+    Fastest,
+    Fast,
+    #[default]
+    Default,
+    Slow,
+    Slowest,
+}
+
+impl ScannerSpeed {
+    pub fn sleep_factor(self) -> f64 {
+        match self {
+            Self::Fastest => 0.0,
+            Self::Fast => 1.0,
+            Self::Default => 2.0,
+            Self::Slow => 10.0,
+            Self::Slowest => 100.0,
+        }
+    }
+
+    pub fn max_sleep(self) -> Duration {
+        match self {
+            Self::Fastest => Duration::ZERO,
+            Self::Fast => Duration::from_millis(100),
+            Self::Default => Duration::from_secs(1),
+            Self::Slow | Self::Slowest => Duration::from_secs(15),
+        }
+    }
+
+    pub fn cycle_interval(self) -> Duration {
+        match self {
+            Self::Fastest => Duration::from_secs(1),
+            Self::Fast | Self::Default | Self::Slow => Duration::from_secs(60),
+            Self::Slowest => Duration::from_secs(30 * 60),
+        }
+    }
+
+    pub fn from_env_str(s: &str) -> Self {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "fastest" => Self::Fastest,
+            "fast" => Self::Fast,
+            "slow" => Self::Slow,
+            "slowest" => Self::Slowest,
+            _ => Self::Default,
+        }
+    }
+}
+
+impl std::fmt::Display for ScannerSpeed {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Fastest => write!(f, "fastest"),
+            Self::Fast => write!(f, "fast"),
+            Self::Default => write!(f, "default"),
+            Self::Slow => write!(f, "slow"),
+            Self::Slowest => write!(f, "slowest"),
+        }
+    }
+}

crates/config/src/constants/targets.rs

@@ -16,6 +16,8 @@ pub const WEBHOOK_ENDPOINT: &str = "endpoint";
 pub const WEBHOOK_AUTH_TOKEN: &str = "auth_token";
 pub const WEBHOOK_CLIENT_CERT: &str = "client_cert";
 pub const WEBHOOK_CLIENT_KEY: &str = "client_key";
+pub const WEBHOOK_CLIENT_CA: &str = "client_ca";
+pub const WEBHOOK_SKIP_TLS_VERIFY: &str = "skip_tls_verify";
 pub const WEBHOOK_BATCH_SIZE: &str = "batch_size";
 pub const WEBHOOK_QUEUE_LIMIT: &str = "queue_limit";
 pub const WEBHOOK_QUEUE_DIR: &str = "queue_dir";

crates/config/src/lib.rs

@@ -33,11 +33,21 @@ pub use constants::profiler::*;
 #[cfg(feature = "constants")]
 pub use constants::protocols::*;
 #[cfg(feature = "constants")]
+pub use constants::proxy::*;
+#[cfg(feature = "constants")]
+pub use constants::quota::*;
+#[cfg(feature = "constants")]
 pub use constants::runtime::*;
 #[cfg(feature = "constants")]
+pub use constants::scanner::*;
+#[cfg(feature = "constants")]
 pub use constants::targets::*;
 #[cfg(feature = "constants")]
 pub use constants::tls::*;
+#[cfg(feature = "constants")]
+pub mod oidc {
+    pub use super::constants::oidc::*;
+}
 #[cfg(feature = "audit")]
 pub mod audit;
 #[cfg(feature = "notify")]

crates/config/src/notify/webhook.rs

@@ -22,6 +22,8 @@ pub const NOTIFY_WEBHOOK_KEYS: &[&str] = &[
     crate::WEBHOOK_CLIENT_CERT,
     crate::WEBHOOK_CLIENT_KEY,
     crate::COMMENT_KEY,
+    crate::WEBHOOK_CLIENT_CA,
+    crate::WEBHOOK_SKIP_TLS_VERIFY,
 ];
 
 // Webhook Environment Variables
@@ -32,8 +34,10 @@ pub const ENV_NOTIFY_WEBHOOK_QUEUE_LIMIT: &str = "RUSTFS_NOTIFY_WEBHOOK_QUEUE_LI
 pub const ENV_NOTIFY_WEBHOOK_QUEUE_DIR: &str = "RUSTFS_NOTIFY_WEBHOOK_QUEUE_DIR";
 pub const ENV_NOTIFY_WEBHOOK_CLIENT_CERT: &str = "RUSTFS_NOTIFY_WEBHOOK_CLIENT_CERT";
 pub const ENV_NOTIFY_WEBHOOK_CLIENT_KEY: &str = "RUSTFS_NOTIFY_WEBHOOK_CLIENT_KEY";
+pub const ENV_NOTIFY_WEBHOOK_CLIENT_CA: &str = "RUSTFS_NOTIFY_WEBHOOK_CLIENT_CA";
+pub const ENV_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY: &str = "RUSTFS_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY";
 
-pub const ENV_NOTIFY_WEBHOOK_KEYS: &[&str; 7] = &[
+pub const ENV_NOTIFY_WEBHOOK_KEYS: &[&str; 9] = &[
     ENV_NOTIFY_WEBHOOK_ENABLE,
     ENV_NOTIFY_WEBHOOK_ENDPOINT,
     ENV_NOTIFY_WEBHOOK_AUTH_TOKEN,
@@ -41,4 +45,6 @@ pub const ENV_NOTIFY_WEBHOOK_KEYS: &[&str; 7] = &[
     ENV_NOTIFY_WEBHOOK_QUEUE_DIR,
     ENV_NOTIFY_WEBHOOK_CLIENT_CERT,
     ENV_NOTIFY_WEBHOOK_CLIENT_KEY,
+    ENV_NOTIFY_WEBHOOK_CLIENT_CA,
+    ENV_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY,
 ];

crates/config/src/observability/mod.rs

@@ -15,43 +15,60 @@
 // Observability Keys
 
 mod metrics;
+use const_str::concat;
 pub use metrics::*;
 
 pub const ENV_OBS_ENDPOINT: &str = "RUSTFS_OBS_ENDPOINT";
 pub const ENV_OBS_TRACE_ENDPOINT: &str = "RUSTFS_OBS_TRACE_ENDPOINT";
 pub const ENV_OBS_METRIC_ENDPOINT: &str = "RUSTFS_OBS_METRIC_ENDPOINT";
 pub const ENV_OBS_LOG_ENDPOINT: &str = "RUSTFS_OBS_LOG_ENDPOINT";
+pub const ENV_OBS_PROFILING_ENDPOINT: &str = "RUSTFS_OBS_PROFILING_ENDPOINT";
 pub const ENV_OBS_USE_STDOUT: &str = "RUSTFS_OBS_USE_STDOUT";
 pub const ENV_OBS_SAMPLE_RATIO: &str = "RUSTFS_OBS_SAMPLE_RATIO";
 pub const ENV_OBS_METER_INTERVAL: &str = "RUSTFS_OBS_METER_INTERVAL";
 pub const ENV_OBS_SERVICE_NAME: &str = "RUSTFS_OBS_SERVICE_NAME";
 pub const ENV_OBS_SERVICE_VERSION: &str = "RUSTFS_OBS_SERVICE_VERSION";
 pub const ENV_OBS_ENVIRONMENT: &str = "RUSTFS_OBS_ENVIRONMENT";
+
+/// Per-signal enable/disable flags (default: true)
+pub const ENV_OBS_TRACES_EXPORT_ENABLED: &str = "RUSTFS_OBS_TRACES_EXPORT_ENABLED";
+pub const ENV_OBS_METRICS_EXPORT_ENABLED: &str = "RUSTFS_OBS_METRICS_EXPORT_ENABLED";
+pub const ENV_OBS_LOGS_EXPORT_ENABLED: &str = "RUSTFS_OBS_LOGS_EXPORT_ENABLED";
+pub const ENV_OBS_PROFILING_EXPORT_ENABLED: &str = "RUSTFS_OBS_PROFILING_EXPORT_ENABLED";
+
 pub const ENV_OBS_LOGGER_LEVEL: &str = "RUSTFS_OBS_LOGGER_LEVEL";
 pub const ENV_OBS_LOG_STDOUT_ENABLED: &str = "RUSTFS_OBS_LOG_STDOUT_ENABLED";
 pub const ENV_OBS_LOG_DIRECTORY: &str = "RUSTFS_OBS_LOG_DIRECTORY";
 pub const ENV_OBS_LOG_FILENAME: &str = "RUSTFS_OBS_LOG_FILENAME";
-pub const ENV_OBS_LOG_ROTATION_SIZE_MB: &str = "RUSTFS_OBS_LOG_ROTATION_SIZE_MB";
 pub const ENV_OBS_LOG_ROTATION_TIME: &str = "RUSTFS_OBS_LOG_ROTATION_TIME";
 pub const ENV_OBS_LOG_KEEP_FILES: &str = "RUSTFS_OBS_LOG_KEEP_FILES";
 
-/// Log pool capacity for async logging
-pub const ENV_OBS_LOG_POOL_CAPA: &str = "RUSTFS_OBS_LOG_POOL_CAPA";
+/// Log cleanup related configurations
+pub const ENV_OBS_LOG_MAX_TOTAL_SIZE_BYTES: &str = "RUSTFS_OBS_LOG_MAX_TOTAL_SIZE_BYTES";
+pub const ENV_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES: &str = "RUSTFS_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES";
+pub const ENV_OBS_LOG_COMPRESS_OLD_FILES: &str = "RUSTFS_OBS_LOG_COMPRESS_OLD_FILES";
+pub const ENV_OBS_LOG_GZIP_COMPRESSION_LEVEL: &str = "RUSTFS_OBS_LOG_GZIP_COMPRESSION_LEVEL";
+pub const ENV_OBS_LOG_COMPRESSED_FILE_RETENTION_DAYS: &str = "RUSTFS_OBS_LOG_COMPRESSED_FILE_RETENTION_DAYS";
+pub const ENV_OBS_LOG_EXCLUDE_PATTERNS: &str = "RUSTFS_OBS_LOG_EXCLUDE_PATTERNS";
+pub const ENV_OBS_LOG_DELETE_EMPTY_FILES: &str = "RUSTFS_OBS_LOG_DELETE_EMPTY_FILES";
+pub const ENV_OBS_LOG_MIN_FILE_AGE_SECONDS: &str = "RUSTFS_OBS_LOG_MIN_FILE_AGE_SECONDS";
+pub const ENV_OBS_LOG_CLEANUP_INTERVAL_SECONDS: &str = "RUSTFS_OBS_LOG_CLEANUP_INTERVAL_SECONDS";
+pub const ENV_OBS_LOG_DRY_RUN: &str = "RUSTFS_OBS_LOG_DRY_RUN";
+pub const ENV_OBS_LOG_MATCH_MODE: &str = "RUSTFS_OBS_LOG_MATCH_MODE";
 
-/// Log message capacity for async logging
-pub const ENV_OBS_LOG_MESSAGE_CAPA: &str = "RUSTFS_OBS_LOG_MESSAGE_CAPA";
-
-/// Log flush interval in milliseconds for async logging
-pub const ENV_OBS_LOG_FLUSH_MS: &str = "RUSTFS_OBS_LOG_FLUSH_MS";
-
-/// Default values for log pool
-pub const DEFAULT_OBS_LOG_POOL_CAPA: usize = 10240;
-
-/// Default values for message capacity
-pub const DEFAULT_OBS_LOG_MESSAGE_CAPA: usize = 32768;
-
-/// Default values for flush interval in milliseconds
-pub const DEFAULT_OBS_LOG_FLUSH_MS: u64 = 200;
+/// Default values for log cleanup
+pub const DEFAULT_OBS_LOG_MAX_TOTAL_SIZE_BYTES: u64 = 2 * 1024 * 1024 * 1024; // 2 GiB
+pub const DEFAULT_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES: u64 = 0; // No single file limit
+pub const DEFAULT_OBS_LOG_COMPRESS_OLD_FILES: bool = true;
+pub const DEFAULT_OBS_LOG_GZIP_COMPRESSION_LEVEL: u32 = 6;
+pub const DEFAULT_OBS_LOG_GZIP_COMPRESSION_EXTENSION: &str = "gz";
+pub const DEFAULT_OBS_LOG_GZIP_COMPRESSION_ALL_EXTENSION: &str = concat!(".", DEFAULT_OBS_LOG_GZIP_COMPRESSION_EXTENSION);
+pub const DEFAULT_OBS_LOG_COMPRESSED_FILE_RETENTION_DAYS: u64 = 30; // Retain compressed files for 30 days
+pub const DEFAULT_OBS_LOG_DELETE_EMPTY_FILES: bool = true;
+pub const DEFAULT_OBS_LOG_MIN_FILE_AGE_SECONDS: u64 = 3600; // 1 hour
+pub const DEFAULT_OBS_LOG_CLEANUP_INTERVAL_SECONDS: u64 = 1800; // 0.5 hours
+pub const DEFAULT_OBS_LOG_DRY_RUN: bool = false;
+pub const DEFAULT_OBS_LOG_MATCH_MODE: &str = "suffix";
 
 /// Default values for observability configuration
 // ### Supported Environment Values
@@ -74,6 +91,7 @@ mod tests {
         assert_eq!(ENV_OBS_TRACE_ENDPOINT, "RUSTFS_OBS_TRACE_ENDPOINT");
         assert_eq!(ENV_OBS_METRIC_ENDPOINT, "RUSTFS_OBS_METRIC_ENDPOINT");
         assert_eq!(ENV_OBS_LOG_ENDPOINT, "RUSTFS_OBS_LOG_ENDPOINT");
+        assert_eq!(ENV_OBS_PROFILING_ENDPOINT, "RUSTFS_OBS_PROFILING_ENDPOINT");
         assert_eq!(ENV_OBS_USE_STDOUT, "RUSTFS_OBS_USE_STDOUT");
         assert_eq!(ENV_OBS_SAMPLE_RATIO, "RUSTFS_OBS_SAMPLE_RATIO");
         assert_eq!(ENV_OBS_METER_INTERVAL, "RUSTFS_OBS_METER_INTERVAL");
@@ -84,9 +102,27 @@ mod tests {
         assert_eq!(ENV_OBS_LOG_STDOUT_ENABLED, "RUSTFS_OBS_LOG_STDOUT_ENABLED");
         assert_eq!(ENV_OBS_LOG_DIRECTORY, "RUSTFS_OBS_LOG_DIRECTORY");
         assert_eq!(ENV_OBS_LOG_FILENAME, "RUSTFS_OBS_LOG_FILENAME");
-        assert_eq!(ENV_OBS_LOG_ROTATION_SIZE_MB, "RUSTFS_OBS_LOG_ROTATION_SIZE_MB");
         assert_eq!(ENV_OBS_LOG_ROTATION_TIME, "RUSTFS_OBS_LOG_ROTATION_TIME");
         assert_eq!(ENV_OBS_LOG_KEEP_FILES, "RUSTFS_OBS_LOG_KEEP_FILES");
+        assert_eq!(ENV_OBS_TRACES_EXPORT_ENABLED, "RUSTFS_OBS_TRACES_EXPORT_ENABLED");
+        assert_eq!(ENV_OBS_METRICS_EXPORT_ENABLED, "RUSTFS_OBS_METRICS_EXPORT_ENABLED");
+        assert_eq!(ENV_OBS_LOGS_EXPORT_ENABLED, "RUSTFS_OBS_LOGS_EXPORT_ENABLED");
+        assert_eq!(ENV_OBS_PROFILING_EXPORT_ENABLED, "RUSTFS_OBS_PROFILING_EXPORT_ENABLED");
+        // Test log cleanup related env keys
+        assert_eq!(ENV_OBS_LOG_MAX_TOTAL_SIZE_BYTES, "RUSTFS_OBS_LOG_MAX_TOTAL_SIZE_BYTES");
+        assert_eq!(ENV_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES, "RUSTFS_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES");
+        assert_eq!(ENV_OBS_LOG_COMPRESS_OLD_FILES, "RUSTFS_OBS_LOG_COMPRESS_OLD_FILES");
+        assert_eq!(ENV_OBS_LOG_GZIP_COMPRESSION_LEVEL, "RUSTFS_OBS_LOG_GZIP_COMPRESSION_LEVEL");
+        assert_eq!(
+            ENV_OBS_LOG_COMPRESSED_FILE_RETENTION_DAYS,
+            "RUSTFS_OBS_LOG_COMPRESSED_FILE_RETENTION_DAYS"
+        );
+        assert_eq!(ENV_OBS_LOG_EXCLUDE_PATTERNS, "RUSTFS_OBS_LOG_EXCLUDE_PATTERNS");
+        assert_eq!(ENV_OBS_LOG_DELETE_EMPTY_FILES, "RUSTFS_OBS_LOG_DELETE_EMPTY_FILES");
+        assert_eq!(ENV_OBS_LOG_MIN_FILE_AGE_SECONDS, "RUSTFS_OBS_LOG_MIN_FILE_AGE_SECONDS");
+        assert_eq!(ENV_OBS_LOG_CLEANUP_INTERVAL_SECONDS, "RUSTFS_OBS_LOG_CLEANUP_INTERVAL_SECONDS");
+        assert_eq!(ENV_OBS_LOG_DRY_RUN, "RUSTFS_OBS_LOG_DRY_RUN");
+        assert_eq!(ENV_OBS_LOG_MATCH_MODE, "RUSTFS_OBS_LOG_MATCH_MODE");
     }
 
     #[test]
@@ -95,5 +131,6 @@ mod tests {
         assert_eq!(DEFAULT_OBS_ENVIRONMENT_DEVELOPMENT, "development");
         assert_eq!(DEFAULT_OBS_ENVIRONMENT_TEST, "test");
         assert_eq!(DEFAULT_OBS_ENVIRONMENT_STAGING, "staging");
+        assert_eq!(DEFAULT_OBS_LOG_MATCH_MODE, "suffix");
     }
 }

crates/credentials/src/credentials.rs

@@ -13,11 +13,12 @@
 // limitations under the License.
 
 use crate::{DEFAULT_SECRET_KEY, ENV_RPC_SECRET, IAM_POLICY_CLAIM_NAME_SA, INHERITED_POLICY_TYPE};
-use rand::{Rng, RngCore};
+use rand::{Rng, RngExt};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::collections::HashMap;
 use std::env;
+use std::fmt;
 use std::io::Error;
 use std::sync::OnceLock;
 use time::OffsetDateTime;
@@ -28,6 +29,37 @@ static GLOBAL_ACTIVE_CRED: OnceLock<Credentials> = OnceLock::new();
 /// Global RPC authentication token
 pub static GLOBAL_RUSTFS_RPC_SECRET: OnceLock<String> = OnceLock::new();
 
+/// Error type for credentials operations
+#[derive(Debug)]
+pub enum CredentialsError {
+    /// Credentials already initialized
+    AlreadyInitialized,
+    /// Failed to generate access key
+    AccessKeyGenerationFailed(Error),
+    /// Failed to generate secret key
+    SecretKeyGenerationFailed(Error),
+}
+
+impl fmt::Display for CredentialsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            CredentialsError::AlreadyInitialized => write!(f, "Credentials already initialized"),
+            CredentialsError::AccessKeyGenerationFailed(e) => write!(f, "Failed to generate access key: {}", e),
+            CredentialsError::SecretKeyGenerationFailed(e) => write!(f, "Failed to generate secret key: {}", e),
+        }
+    }
+}
+
+impl std::error::Error for CredentialsError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            CredentialsError::AccessKeyGenerationFailed(e) => Some(e),
+            CredentialsError::SecretKeyGenerationFailed(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
 /// Initialize the global action credentials
 ///
 /// # Arguments
@@ -35,15 +67,17 @@ pub static GLOBAL_RUSTFS_RPC_SECRET: OnceLock<String> = OnceLock::new();
 /// * `sk` - Optional secret key
 ///
 /// # Returns
-/// * `Result<(), Box<Credentials>>` - Ok if successful, Err with existing credentials if already initialized
-///
-/// # Panics
-/// This function panics if automatic credential generation fails when `ak` or `sk`
-/// are `None`, for example if the random number generator fails while calling
-/// `gen_access_key` or `gen_secret_key`.
-pub fn init_global_action_credentials(ak: Option<String>, sk: Option<String>) -> Result<(), Box<Credentials>> {
-    let ak = ak.unwrap_or_else(|| gen_access_key(20).expect("Failed to generate access key"));
-    let sk = sk.unwrap_or_else(|| gen_secret_key(32).expect("Failed to generate secret key"));
+/// * `Result<(), CredentialsError>` - Ok if successful, Err if already initialized or generation failed
+pub fn init_global_action_credentials(ak: Option<String>, sk: Option<String>) -> Result<(), CredentialsError> {
+    let ak = match ak {
+        Some(k) => k,
+        None => gen_access_key(20).map_err(CredentialsError::AccessKeyGenerationFailed)?,
+    };
+
+    let sk = match sk {
+        Some(k) => k,
+        None => gen_secret_key(32).map_err(CredentialsError::SecretKeyGenerationFailed)?,
+    };
 
     let cred = Credentials {
         access_key: ak,
@@ -51,12 +85,7 @@ pub fn init_global_action_credentials(ak: Option<String>, sk: Option<String>) ->
         ..Default::default()
     };
 
-    GLOBAL_ACTIVE_CRED.set(cred).map_err(|e| {
-        Box::new(Credentials {
-            access_key: e.access_key.clone(),
-            ..Default::default()
-        })
-    })
+    GLOBAL_ACTIVE_CRED.set(cred).map_err(|_| CredentialsError::AlreadyInitialized)
 }
 
 /// Get the global action credentials
@@ -195,6 +224,39 @@ pub fn get_rpc_token() -> String {
         .clone()
 }
 
+/// A wrapper struct for masking sensitive strings in Debug implementations.
+/// It avoids allocating a new String just for formatting.
+pub struct Masked<'a>(pub Option<&'a str>);
+
+impl<'a> fmt::Debug for Masked<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self.0 {
+            None => Ok(()),
+            Some(s) => {
+                let len = s.chars().count();
+                if len == 0 {
+                    Ok(())
+                } else if len == 1 {
+                    write!(f, "***")
+                } else if len == 2 {
+                    let first = s.chars().next().ok_or(fmt::Error)?;
+                    write!(f, "{}***|{}", first, len)
+                } else {
+                    let first = s.chars().next().ok_or(fmt::Error)?;
+                    let last = s.chars().last().ok_or(fmt::Error)?;
+                    write!(f, "{}***{}|{}", first, last, len)
+                }
+            }
+        }
+    }
+}
+
+impl<'a> fmt::Display for Masked<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Debug::fmt(self, f)
+    }
+}
+
 /// Credentials structure
 ///
 /// Fields:
@@ -209,7 +271,7 @@ pub fn get_rpc_token() -> String {
 /// - name: Optional name string
 /// - description: Optional description string
 ///
-#[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[derive(Serialize, Deserialize, Clone, Default)]
 pub struct Credentials {
     pub access_key: String,
     pub secret_key: String,
@@ -223,6 +285,23 @@ pub struct Credentials {
     pub description: Option<String>,
 }
 
+impl fmt::Debug for Credentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Credentials")
+            .field("access_key", &self.access_key)
+            .field("secret_key", &Masked(Some(&self.secret_key)))
+            .field("session_token", &self.session_token)
+            .field("expiration", &self.expiration)
+            .field("status", &self.status)
+            .field("parent_user", &self.parent_user)
+            .field("groups", &self.groups)
+            .field("claims", &self.claims)
+            .field("name", &self.name)
+            .field("description", &self.description)
+            .finish()
+    }
+}
+
 impl Credentials {
     pub fn is_expired(&self) -> bool {
         if self.expiration.is_none() {
@@ -383,4 +462,33 @@ mod tests {
             assert_eq!(sk.len(), 32);
         }
     }
+
+    #[test]
+    fn test_masked_debug() {
+        // Test None
+        assert_eq!(format!("{:?}", Masked(None)), "");
+
+        // Test empty string
+        assert_eq!(format!("{:?}", Masked(Some(""))), "");
+
+        // Test length 1
+        assert_eq!(format!("{:?}", Masked(Some("a"))), "***");
+
+        // Test length 2
+        assert_eq!(format!("{:?}", Masked(Some("ab"))), "a***|2");
+
+        // Test length 3
+        assert_eq!(format!("{:?}", Masked(Some("abc"))), "a***c|3");
+
+        // Test length 4
+        assert_eq!(format!("{:?}", Masked(Some("abcd"))), "a***d|4");
+
+        // Test longer string
+        assert_eq!(format!("{:?}", Masked(Some("secretpassword"))), "s***d|14");
+
+        // Test Unicode input should not panic and should keep character boundary
+        assert_eq!(format!("{:?}", Masked(Some("中"))), "***");
+        assert_eq!(format!("{:?}", Masked(Some("中文"))), "中***|2");
+        assert_eq!(format!("{:?}", Masked(Some("中文测试"))), "中***试|4");
+    }
 }