fix(rustfs): the delivered access key must be the identity's own name #510
Loading…
Reference in a new issue
No description provided.
Delete branch "sean/rustfs-zot"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The zot mirror CrashLooped six times on
mc: Unable to initialize new alias from the provided credentials.
The Access Key Id you provided does not exist in our records.
which reads like a missing credential and was a wrong one. Binjovi's converge
creates each user with the identity's name from object-store.json --
zot--and the delivery chain shipped
zot-v2, that identity's name in MinIO. Thekey existed and was correct; nothing was listening on the name it was offered
under.
Ten minutes of a 165 GiB transfer went nowhere before the message was read
closely enough to notice which half was wrong, and the drives sat at 4.6 GiB
while the Job reported Running.
tests/rustfs-identities.sh now checks the whole class: for every identity file,
a literal *_access_key in its shaped Secret must equal the file's own name,
which is the identity name and therefore the user the converge creates.
Interpolated values are skipped -- those carry the generated secret, not the
name. The control was confirmed red by restoring
zot-v2.Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
The zot mirror CrashLooped six times on mc: <ERROR> Unable to initialize new alias from the provided credentials. The Access Key Id you provided does not exist in our records. which reads like a missing credential and was a wrong one. Binjovi's converge creates each user with the identity's name from object-store.json -- `zot` -- and the delivery chain shipped `zot-v2`, that identity's name in MinIO. The key existed and was correct; nothing was listening on the name it was offered under. Ten minutes of a 165 GiB transfer went nowhere before the message was read closely enough to notice which half was wrong, and the drives sat at 4.6 GiB while the Job reported Running. tests/rustfs-identities.sh now checks the whole class: for every identity file, a literal *_access_key in its shaped Secret must equal the file's own name, which is the identity name and therefore the user the converge creates. Interpolated values are skipped -- those carry the generated secret, not the name. The control was confirmed red by restoring `zot-v2`. Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76