docs: audit the 60 MinIO identities before any of them are recreated #436
Loading…
Reference in a new issue
No description provided.
Delete branch "docs/minio-identity-audit"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Phase 1 of the MinIO to RustFS migration. The plan calls for auditing the identities rather than copying them, because the expectation from the names alone was that most died with Pipelines. That expectation was roughly right, and wrong in the places that matter.
Measured, not inferred:
mc admin user listandmc admin policy infoagainst the live tenant, joined to every S3-looking Secret in the cluster, every pod currently mounting one, and every Argo Workflow object from the last five days. An identity is live only if a running pod holds its credential or a workflow referenced it inside five days.60 users, 65 policies. 17 live, 43 dead.
Four findings that change the migration
1.
olly-platformis one identity doing five jobs. Its policy grantsplatform-*-- a wildcard over bucket names -- plusworkflows,workflows/*andpkg. Five Secrets carry it: loki, tempo, the Argo artifact repository, sccache and package reads. The plan called this two objects; it is one identity across four buckets, and it is what a compromised build step would hold. It must be split per consumer when recreated on RustFS. That is free at creation time and expensive later.2.
minio/cnpg-minio-s3-credentialscarries the tenant ROOT key, not a named user, forcnpg-backups-- a bucket that is not migrating, because barman already moved to Hetzner offsite. No RustFS identity replaces it.3. Three dead policies grant on
alice-workflowsandplatform-workflows, which hold no objects. The dead list is dead.4.
pkghas no identity at all: anonymous read, no credential anywhere. It is the one consumer whose cutover cannot be verified by swapping a Secret.Acceptance for Phase 5
The 43 dead identities are never created on RustFS. MinIO retires when the RustFS user list is exactly the live set, expanded by the
olly-platformsplit, each passing the H29/H30 isolation check on RustFS rather than assumed from MinIO.Docs only -- no manifest changes.
https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
Phase 1 of the MinIO to RustFS migration. The plan calls for auditing the identities rather than copying them, because the expectation from the names alone was that most died with Pipelines. The expectation was roughly right and wrong in the places that matter. Measured, not inferred: mc admin user list and mc admin policy info against the live tenant, joined to every S3-looking Secret in the cluster, every pod currently mounting one, and every Argo Workflow object from the last five days. An identity is live only if a running pod holds its credential or a workflow referenced it inside five days. 60 users, 65 policies. 17 live, 43 dead. Four findings change the migration: * olly-platform is one identity doing five jobs. Its policy grants platform-* -- a WILDCARD over bucket names -- plus workflows, workflows/* and pkg, and five Secrets carry it: loki, tempo, the Argo artifact repository, sccache and package reads. The plan called this two objects; it is one identity across four buckets, and it is what a compromised build step would hold. It must be split per consumer when it is recreated on RustFS. That is free at creation time and expensive later. * minio/cnpg-minio-s3-credentials carries the tenant ROOT key, not a named user, for cnpg-backups -- a bucket that is not migrating, because barman already moved to Hetzner offsite. No RustFS identity replaces it. * Three dead policies grant on alice-workflows and platform-workflows, which hold no objects. The dead list is dead. * pkg has no identity at all: anonymous read, no credential anywhere. It is the one consumer whose cutover cannot be verified by swapping a Secret. The 43 dead identities are never created on RustFS, and the document is the acceptance list for Phase 5: MinIO retires when the RustFS user list is exactly the live set, expanded by the olly-platform split, each passing the H29/H30 isolation check on RustFS rather than assumed from MinIO. Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76