mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 07:43:29 +03:00
Feng Ruohang
fd2ca1c6d2
README, README_ZH, SECURITY, COMPLIANCE, CONTRIBUTING, NOTICE, code_of_conduct, the vulnerability and PR-etiquette documents, the GitHub issue and pull request templates, and the docs/ tree all present Silo as the product. The Grafana dashboards under docs/metrics/prometheus/grafana/ have their panel titles and descriptions rebranded while every minio_* query, label and expression is left alone, so existing alerts and recording rules keep matching. The distinction the review demanded is applied per hit rather than by search-and-replace: - Product and command text becomes Silo and silo: install and run instructions, systemd examples, compose services, download links, badges. - Protocol and interface text keeps MinIO: MINIO_* variables, minio_* metrics, x-minio-* headers, /minio/* routes, .minio.sys, arn:minio, and API field and error names. - Attribution keeps MinIO and gains the fork's own: the AGPL obligations, original copyright, CREDITS and NOTICE stay, with the modification notice added alongside rather than replacing them. - Historical and third-party references are left as facts, not rewritten for brand tidiness. README and README_ZH each carry an explicit non-affiliation notice, document the side-by-side package migration including the /etc/systemd/system/silo.service.d/10-legacy-user.conf drop-in for keeping a legacy UID/GID, and state that recursive chown is never performed. The trademark attribution uses the policy's approved "based on MinIO technology" wording, not the shortened form the policy rejects. github.com/pgsty/minio links are left in place and labelled transitional. The repository has not been renamed, and rewriting them now would produce documented URLs that 404 until the cutover; they change in the cutover commit together with the goreleaser release target, the OCI source label and the raw-content branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
63 lines
3.3 KiB
Markdown
63 lines
3.3 KiB
Markdown
# Automatic Site Replication
|
|
|
|
This feature allows multiple independent Silo sites (or clusters) that are using the same external IDentity Provider (IDP) to be configured as replicas. In this situation the set of replica sites are referred to as peer sites or just sites. When site-replication is enabled on a set of sites, the following changes are replicated to all other sites:
|
|
|
|
- Creation and deletion of buckets and objects
|
|
- Creation and deletion of all IAM users, groups, policies and their mappings to users or groups
|
|
- Creation of STS credentials
|
|
- Creation and deletion of service accounts (except those owned by the root user)
|
|
- Changes to Bucket features such as:
|
|
- Bucket Policies
|
|
- Bucket Tags
|
|
- Bucket Object-Lock configurations (including retention and legal hold configuration)
|
|
- Bucket Encryption configuration
|
|
|
|
> NOTE: Bucket versioning is automatically enabled for all new and existing buckets on all replicated sites.
|
|
|
|
The following Bucket features will **not be replicated**, is designed to differ between sites:
|
|
|
|
- Bucket notification configuration
|
|
- Bucket lifecycle (ILM) configuration
|
|
|
|
## Pre-requisites
|
|
|
|
- Initially, only **one** of the sites added for replication may have data. After site-replication is successfully configured, this data is replicated to the other (initially empty) sites. Subsequently, objects may be written to any of the sites, and they will be replicated to all other sites.
|
|
|
|
- **Removing a site** is not allowed from a set of replicated sites once configured.
|
|
- All sites must be using the **same** external IDP(s) if any.
|
|
- For [SSE-S3 or SSE-KMS encryption via KMS](https://silo.pgsty.com/operations/server-side-encryption/ "Silo KMS Guide"), all sites **must** have access to a central KMS deployment. This can be achieved via a central KES server or multiple KES servers (say one per site) connected via a central KMS (Vault) server.
|
|
|
|
## Configuring Site Replication
|
|
|
|
- Configure an alias in `mc` for each of the sites. For example if you have three Silo sites, you may run:
|
|
|
|
```sh
|
|
mc alias set silo1 https://silo1.example.com:9000 adminuser adminpassword
|
|
mc alias set silo2 https://silo2.example.com:9000 adminuser adminpassword
|
|
mc alias set silo3 https://silo3.example.com:9000 adminuser adminpassword
|
|
```
|
|
|
|
or
|
|
|
|
```sh
|
|
export MC_HOST_silo1=https://adminuser:adminpassword@silo1.example.com
|
|
export MC_HOST_silo2=https://adminuser:adminpassword@silo2.example.com
|
|
export MC_HOST_silo3=https://adminuser:adminpassword@silo3.example.com
|
|
```
|
|
|
|
- Add site replication configuration with:
|
|
|
|
```sh
|
|
mc admin replicate add silo1 silo2 silo3
|
|
```
|
|
|
|
- Once the above command returns success, you may query site replication configuration with:
|
|
|
|
```sh
|
|
mc admin replicate info silo1
|
|
```
|
|
|
|
** Note **
|
|
Previously, site replication required the root credentials of peer sites to be identical. This is no longer necessary because STS tokens are now signed with the site replicator service account credentials, thus allowing flexibility in the independent management of root accounts across sites and the ability to disable root accounts eventually.
|
|
|
|
However, this means that STS tokens signed previously by root credentials will no longer be valid upon upgrading to the latest version with this change. Please re-generate them as you usually do. Additionally, if site replication is ever removed - the STS tokens will become invalid, regenerate them as you usually do. |