mirror of https://github.com/rustfs/rustfs.git synced 2026-09-06 03:59:14 +00:00

Files

T

唐小鸭 10575e851a fix(site-replication): persist source stamps and apply IAM items atomically (backlog#2291)

Review findings on rustfs#7195: the receive-side staleness gate compared a
source `updatedAt` against a stamp the local write had put on the record,
and the verdict, the write and the deletion mark were three separate steps.

- IAM writes gain explicit-stamp variants (`set_policy_at`, `policy_db_set_at`,
  group and user `*_at`, `new_service_account_at`, `update_service_account_at`)
  so a replicated record carries its source time; local edits are unchanged.
- `apply_iam_item` runs verdict, write and mark commit under the
  site-replication state transaction (distributed state-object lock), so a
  concurrent older grant and newer revoke are ordered on every node.
- A replicated service account is created with its source status in one
  write (`NewServiceAccountOpts::status`), never enabled transiently.
- Deletion marks are pruned by age (30 days) instead of by count.
- Bucket-config deletes persist the source stamp (`delete_if_incarnation_at`).

Regressions run through the real receiver: delayed in-order updates for every
gated item type, concurrent grant/revoke, delete then stale re-create, disabled
service-account create, delete stamping in ecstore, and mark retention.

2026-09-06 03:05:10 +08:00

src

fix(site-replication): persist source stamps and apply IAM items atomically (backlog#2291)

2026-09-06 03:05:10 +08:00

tests

feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515 )

2026-08-01 10:05:40 +08:00

AGENTS.md

docs(agents): streamline instruction routing (#6358 )

2026-08-22 08:19:53 +08:00

Cargo.toml

refactor(time): migrate audit and notify timestamps to jiff (#5707 )

2026-08-04 23:20:44 +08:00

README.md

docs: fix some dead link (#1053 )

2025-12-08 11:23:24 +08:00

README.md

RustFS Policy - Policy Engine

Advanced policy engine and access control system for RustFS distributed object storage

📖 Documentation · 🐛 Bug Reports · 💬 Discussions

📖 Overview

RustFS Policy provides advanced policy engine and access control capabilities for the RustFS distributed object storage system. For the complete RustFS experience, please visit the main RustFS repository.

✨ Features

AWS-compatible bucket policy engine
Fine-grained resource-based access control
Condition-based policy evaluation
Policy validation and syntax checking
Role-based access control integration
Dynamic policy evaluation with context

📚 Documentation

For comprehensive documentation, examples, and usage guides, please visit the main RustFS repository.

📄 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.