feat(rustfs): deliver loki's credential and mirror its two buckets

sean commented

2026-09-09 13:33:06 +00:00

Owner

Stage 3 begins with loki, the last consumer of ClusterSecretStore/olly-platform-minio -- moving it retires that chain and the olly half of the platform-* wildcard. Source side only: the delivery chain (reader Role pinned to two Secrets, ClusterSecretStore admitting olly alone, shaped to the key names olly already asks for) and the mirror for both buckets. --quiet is now a class rule, because mc mirror prints one line per object and Alloy ships this Job's stdout into the log store whose bucket is being copied. The guard's first negative control was about to go inert -- it probed the alphabetically first file with tempo's literal names -- so every control is generic now. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-09 13:33:07 +00:00

feat(rustfs): deliver loki's credential and mirror its two buckets

binjovi/ci Binjovi completed the frozen plan

Details

4b4fb81af0

Stage 3 begins. Loki goes first because it is the last consumer of
`ClusterSecretStore/olly-platform-minio`, so moving it retires that chain and
the olly half of the `olly-platform` wildcard -- the widest credential in the
MinIO tenant, `platform-*` across four buckets, held by five Secrets.

This is the source side only. The repoint lands in sean/olly once the mirror
has proved parity, and the MinIO buckets stay untouched as the rollback until
MinIO retires.

THE CREDENTIAL. loki.yaml gains the delivery half of the chain its key already
had: an in-namespace round trip, a reader Role pinned by name to exactly this
identity's two Secrets, and a ClusterSecretStore admitting namespace olly and
nothing else. It is shaped to `minio_access_key` / `minio_secret_key`, which is
what olly already asks for, so the repoint is an endpoint change and nothing
else. `object-store.json` records that destination, and Binjovi's converge
proves on every catalog release that this key reaches platform-loki-chunks and
platform-loki-ruler and is refused platform-tempo-traces and the canary.

THE MIRROR. Same shape as tempo's, with two differences that matter at 57k
objects rather than 268.

`--quiet`, and it is not cosmetic: `mc mirror` prints one line per object,
Alloy ships this Job's stdout into Loki, and Loki's chunks are one of the
buckets being copied -- so an unquiet mirror feeds itself. That is now a class
rule in the guard rather than something the next large bucket rediscovers, and
tempo is quieted to match.

The compactor deletes from the source while this runs. Loki sets
`retention_enabled: true` and `delete_request_store: s3`, so the source is not
static the way tempo's traces effectively were. `mc mirror` does not propagate
deletions, so a compaction mid-copy leaves an object on the destination the
source no longer has, `mc diff` reports it, and the Job fails and retries until
the two settle. The file says so, because the first person to read that diff
should know it is the compactor and not a lost write.

THE GUARD'S FIRST NEGATIVE CONTROL WAS ABOUT TO GO INERT. It probed the
alphabetically first bucket file with tempo's literal credential name, so
adding a bucket that sorts before `tempo` left it matching nothing -- still
running, still reporting a pass. Every control is written against the shape of
a mirror Job now, never one bucket's names, and a fifth covers `--quiet`.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 4b4fb81af0 into trunk

2026-09-09 13:39:11 +00:00

Rows
Columns

feat(rustfs): deliver loki's credential and mirror its two buckets #482