docs(rustfs): correct the IAM blocker — it does not reproduce on rc.5 #415

Merged

binjovi-bot merged 1 commit from docs/rustfs-capability-evidence into trunk

2026-09-07 14:47:03 +00:00

sean commented

2026-09-07 14:43:47 +00:00

Owner

#411 was planned and committed around a blocker taken from public sources — rustfs#1571 (opened 2026-01-21) and secondary write-ups saying the MinIO admin API is incomplete and mc admin user list / mc admin policy list fail. namespace.yaml stated that as fact and called it a migration gate. It is wrong for this version.

Probed against the live install with the same minio/mc:RELEASE.2025-04-08 the tenantbucket Jobs already pin. Every admin operation those Jobs depend on passed:

policy create · policy list · policy info · user add · user list · user info · policy attach · user svcacct add · ilm rule import · ilm rule list · anonymous set

And the check the 2026-06-26 audit added for H29/H30 — a scoped user reached its own bucket and was denied another. The isolation is really enforced, not merely accepted.

mc admin info is the single failure. Server introspection; nothing in tenantbucket/ calls it, so it is not a gate.

A first probe reported four more failures — all four were bugs in the probe, not RustFS: no policy file written, an empty ILM document that mc rejected before it reached the server, and svcacct spelled mc admin user svcacct in the pinned mc. That is recorded in the doc, because a capability matrix is only as good as the probe behind it and this one nearly shipped a false conclusion.

docs/rustfs-evaluation.md carries the full matrix, the S3 results, the two load-bearing startup settings, the StatefulSet rolling-update deadlock that bit during the first deploy, and what genuinely still stands in the way: a release candidate, no Tenant CR equivalent, the minio.sean.farm operator untested against it, no migration exercised, and mc admin info unavailable to any dashboard wanting it.

https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

#411 was planned and committed around a blocker taken from public sources — [rustfs#1571](https://github.com/rustfs/rustfs/issues/1571) (opened 2026-01-21) and secondary write-ups saying the MinIO admin API is incomplete and `mc admin user list` / `mc admin policy list` fail. `namespace.yaml` stated that as fact and called it a migration gate. **It is wrong for this version.** Probed against the live install with the same `minio/mc:RELEASE.2025-04-08` the `tenantbucket` Jobs already pin. Every admin operation those Jobs depend on **passed**: `policy create` · `policy list` · `policy info` · `user add` · `user list` · `user info` · `policy attach` · `user svcacct add` · `ilm rule import` · `ilm rule list` · `anonymous set` And the check the 2026-06-26 audit added for **H29/H30** — a scoped user reached its own bucket and was **denied** another. The isolation is really enforced, not merely accepted. `mc admin info` is the single failure. Server introspection; nothing in `tenantbucket/` calls it, so it is not a gate. **A first probe reported four more failures — all four were bugs in the probe**, not RustFS: no policy file written, an empty ILM document that `mc` rejected before it reached the server, and `svcacct` spelled `mc admin user svcacct` in the pinned `mc`. That is recorded in the doc, because a capability matrix is only as good as the probe behind it and this one nearly shipped a false conclusion. `docs/rustfs-evaluation.md` carries the full matrix, the S3 results, the two load-bearing startup settings, the StatefulSet rolling-update deadlock that bit during the first deploy, and what genuinely still stands in the way: a release candidate, no `Tenant` CR equivalent, the `minio.sean.farm` operator untested against it, no migration exercised, and `mc admin info` unavailable to any dashboard wanting it. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-07 14:43:47 +00:00

docs(rustfs): correct the IAM blocker — it does not reproduce on rc.5

binjovi/ci Binjovi completed the frozen plan

Details

521ec0ab9f

The RustFS install was planned and committed around a blocker taken from public
sources: rustfs/rustfs#1571 (opened 2026-01-21) and secondary write-ups saying
the MinIO admin API is incomplete and that `mc admin user list` and
`mc admin policy list` fail. namespace.yaml stated that as fact and called it a
migration gate. It is wrong for this version.

Probed against the live install on 2026-09-07 with the same
minio/mc:RELEASE.2025-04-08 the tenantbucket Jobs already pin. Every admin
operation those Jobs depend on PASSED: policy create/list/info, user
add/list/info, policy attach, user svcacct add, ilm rule import/list, anonymous
set. So did the check the 2026-06-26 audit added for findings H29/H30 -- a
scoped user reached its own bucket and was DENIED another, so the isolation is
really enforced and not just accepted.

`mc admin info` is the single failure. It is server introspection; nothing in
tenantbucket/ calls it, so it is not a gate.

A first probe reported four more failures. All four were bugs in the probe: no
policy file was written, the ILM document was empty and mc rejected it before it
reached the server, and svcacct is spelled `mc admin user svcacct` in the pinned
mc. That is recorded in the doc, because a capability matrix is only as good as
the probe that produced it and this one nearly shipped a false conclusion.

docs/rustfs-evaluation.md carries the full matrix, the S3 results, the two
load-bearing startup settings, the StatefulSet rolling-update deadlock that bit
during the first deploy, and what genuinely does still stand in the way: a
release candidate, no Tenant CR equivalent, the minio.sean.farm operator
untested against it, no migration exercised, and `mc admin info` unavailable to
any dashboard that wants it.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 521ec0ab9f into trunk

2026-09-07 14:47:03 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!415

No description provided.

Rows
Columns