Merge branch 'main' into feat/access-based-ilm

docs/bucket/notifications/README.md

@@ -840,12 +840,11 @@ Received a message: {"EventType":"s3:ObjectCreated:Put","Key":"images/myphoto.jp
 > database            (string)             database name (used only if `connection_string` is empty)
 > ```
 >
-> These are now deprecated, if you plan to upgrade to any releases after _RELEASE.2020-04-10T03-34-42Z_ make sure
-> to migrate to only using _connection_string_ option. To migrate, once you have upgraded all the servers use the
-> following command to update the existing notification targets.
+> These are now deprecated. SILO does not migrate an enabled target that only has these fields, so convert it to
+> _connection_string_ before starting SILO. On the old server, use the following command to update the target.
 >
 > ```
-> mc admin config set mysilo/ notify_postgres[:name] connection_string="host=hostname port=2832 username=psqluser password=psqlpass database=bucketevents"
+> mc admin config set mysilo/ notify_postgres[:name] connection_string="host=hostname port=2832 user=psqluser password=psqlpass dbname=bucketevents"
 > ```
 >
 > Please make sure this step is carried out, without this step PostgreSQL notification targets will not work,
@@ -973,9 +972,8 @@ key                 |                      value
 > database     (string)             database name (used only if `dsn_string` is empty)
 > ```
 >
-> These are now deprecated, if you plan to upgrade to any releases after _RELEASE.2020-04-10T03-34-42Z_ make sure
-> to migrate to only using _dsn_string_ option. To migrate, once you have upgraded all the servers use the
-> following command to update the existing notification targets.
+> These are now deprecated. SILO does not migrate an enabled target that only has these fields, so convert it to
+> _dsn_string_ before starting SILO. On the old server, use the following command to update the target.
 >
 > ```
 > mc admin config set mysilo/ notify_mysql[:name] dsn_string="mysqluser:mysqlpass@tcp(localhost:2832)/bucketevents"
@@ -1045,7 +1043,7 @@ Before updating the configuration, let's start with `mc admin config get` comman
 
 ```sh
 $ mc admin config get mysilo/ notify_mysql
-notify_mysql:myinstance enable=off format=namespace host= port= username= password= database= dsn_string= table= queue_dir= queue_limit=0
+notify_mysql:myinstance enable=off format=namespace dsn_string= table= queue_dir= queue_limit=0
 ```
 
 Use `mc admin config set` command to update MySQL notification configuration for the deployment with `dsn_string` parameter:

docs/bucket/replication/README.md

@@ -96,6 +96,12 @@ The access key provided for the replication *target* cluster should have these m
 
 Please note that the permissions required by the admin user on the target cluster can be more fine grained to exclude permissions like "s3:ReplicateDelete", "s3:GetBucketObjectLockConfiguration" etc depending on whether delete replication rules are set up or if object locking is disabled on `destbucket`. The above policies assume that replication of objects, tags and delete marker replication are all enabled on object lock enabled buckets. A sample script to setup replication is provided [here](https://github.com/pgsty/silo/blob/main/docs/bucket/replication/setup_replication.sh)
 
+The target replication credential continues to authorize replicated deletes with
+`s3:DeleteObject` plus `s3:ReplicateDelete`; it does not need
+`s3:DeleteObjectVersion`. This internal receiver contract is deliberately
+separate from ordinary S3 requests: a client deleting an explicitly named
+version, including `versionId=null`, must have `s3:DeleteObjectVersion`.
+
 To set up replication from `srcbucket` on the `mysilo` cluster to `destbucket`
 on a target Silo cluster at `https://replica-endpoint:9000`, use:
 ```
@@ -200,6 +206,10 @@ To add a replication rule allowing both delete marker replication, versioned del
 
 Additional permission of "s3:ReplicateDelete" action would need to be specified on the access key configured for the target cluster if Delete Marker replication or versioned delete replication is enabled.
 
+An explicit deny on `s3:DeleteObjectVersion` still blocks the corresponding
+replicated version purge. An allow is not otherwise required for the target
+replication credential.
+
 ```
 mc replicate add mysilo/srcbucket/Tax --priority 1 --remote-bucket `remote-target` --tags "Year=2019&Company=AcmeCorp" --storage-class "STANDARD" --replicate "delete,delete-marker"
 Replication configuration applied successfully to mysilo/srcbucket.

docs/bucket/replication/delete-replication.sh

@@ -88,11 +88,7 @@ echo "=== mysilo2"
 
 versionId="$(./mc ls --json --versions mysilo1/testbucket/dir/ | tail -n1 | jq -r .versionId)"
 
-export AWS_ACCESS_KEY_ID=minioadmin
-export AWS_SECRET_ACCESS_KEY=minioadmin
-export AWS_REGION=us-east-1
-
-aws s3api --endpoint-url http://localhost:9001 delete-object --bucket testbucket --key dir/file --version-id "$versionId"
+./mc rm --version-id "$versionId" mysilo1/testbucket/dir/file
 
 ./mc ls -r --versions mysilo1/testbucket >/tmp/mysilo1.txt
 ./mc ls -r --versions mysilo2/testbucket >/tmp/mysilo2.txt
@@ -117,6 +113,76 @@ if [ $ret -ne 0 ]; then
 	exit 1
 fi
 
+# Verify the documented least-privilege target policy. Explicit version
+# deletion on the receiver is replication traffic, so the target credential
+# needs DeleteObject + ReplicateDelete but not DeleteObjectVersion.
+./mc mb mysilo1/leastpriv/ mysilo2/leastpriv/ --with-versioning
+./mc admin user add mysilo2 repluser repluser123
+cat >/tmp/xl/replpolicy.json <<'EOF'
+{
+ "Version": "2012-10-17",
+ "Statement": [
+  {
+   "Effect": "Allow",
+   "Action": [
+    "s3:GetReplicationConfiguration",
+    "s3:ListBucket",
+    "s3:ListBucketMultipartUploads",
+    "s3:GetBucketLocation",
+    "s3:GetBucketVersioning"
+   ],
+   "Resource": ["arn:aws:s3:::leastpriv"]
+  },
+  {
+   "Effect": "Allow",
+   "Action": [
+    "s3:GetReplicationConfiguration",
+    "s3:ReplicateTags",
+    "s3:AbortMultipartUpload",
+    "s3:GetObject",
+    "s3:GetObjectVersion",
+    "s3:GetObjectVersionTagging",
+    "s3:PutObject",
+    "s3:DeleteObject",
+    "s3:ReplicateObject",
+    "s3:ReplicateDelete"
+   ],
+   "Resource": ["arn:aws:s3:::leastpriv/*"]
+  }
+ ]
+}
+EOF
+./mc admin policy create mysilo2 replpolicy /tmp/xl/replpolicy.json
+./mc admin policy attach mysilo2 replpolicy --user repluser
+./mc replicate add mysilo1/leastpriv --remote-bucket http://repluser:repluser123@localhost:9002/leastpriv/ --priority 1 --replicate delete,delete-marker
+
+./mc cp README.md mysilo1/leastpriv/dir/file
+./mc cp README.md mysilo1/leastpriv/dir/file
+sleep 1s
+
+leastPrivVersionId="$(./mc ls --json --versions mysilo1/leastpriv/dir/ | tail -n1 | jq -r .versionId)"
+./mc rm --version-id "$leastPrivVersionId" mysilo1/leastpriv/dir/file
+sleep 1s
+./mc ls -r --versions mysilo1/leastpriv >/tmp/leastpriv1.txt
+./mc ls -r --versions mysilo2/leastpriv >/tmp/leastpriv2.txt
+out=$(diff -qpruN /tmp/leastpriv1.txt /tmp/leastpriv2.txt)
+ret=$?
+if [ $ret -ne 0 ]; then
+	echo "BUG: least-privilege version delete did not replicate: $out"
+	exit 1
+fi
+
+./mc rm mysilo1/leastpriv/dir/file
+sleep 1s
+./mc ls -r --versions mysilo1/leastpriv >/tmp/leastpriv1.txt
+./mc ls -r --versions mysilo2/leastpriv >/tmp/leastpriv2.txt
+out=$(diff -qpruN /tmp/leastpriv1.txt /tmp/leastpriv2.txt)
+ret=$?
+if [ $ret -ne 0 ]; then
+	echo "BUG: least-privilege delete marker did not replicate: $out"
+	exit 1
+fi
+
 # Test listing of non replicated permanent deletes
 
 set -x
@@ -129,7 +195,7 @@ versionId="$(./mc ls --json --versions mysilo1/foobucket/dir/ | jq -r .versionId
 
 kill ${pid2} && wait ${pid2} || true
 
-aws s3api --endpoint-url http://localhost:9001 delete-object --bucket foobucket --key dir/file --version-id "$versionId"
+./mc rm --version-id "$versionId" mysilo1/foobucket/dir/file
 
 out="$(./mc ls mysilo1/foobucket/dir/)"
 if [ "$out" != "" ]; then