mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
c46b16ec62
The transitional references land in one commit, because they are only correct together: the repository is pgsty/silo, its default branch is main, and nothing in the tree should point a user at the old names. Changed: - Workflow branch filters. go.yml and vulncheck.yml gated on `branches: master` for both push and pull_request, so renaming the default branch would have taken automatic CI offline with no error and no signal - the workflows would simply never trigger again. They now name main. - Release target. goreleaser's `release.github.name` becomes silo, which is what actually decides where a tagged build publishes. sign-release-rpms.sh's GH_REPO default follows. - The OCI `image.source` label, the Helm chart `sources` entry, the security advisory link in the issue-template config, and the go.mod comment citing the LDAP TLS fix. - 115 occurrences across README, README_ZH, SECURITY, CONTRIBUTING and 30 docs pages, including 72 links that also carried the master branch in their path. Those matter most: GitHub redirects clone, fetch, push and web URLs after a rename, but raw.githubusercontent.com does not, and neither follows a branch rename - every one of those links would 404 twice over. - Three error strings in cmd/erasure-sets.go, cmd/storage-errors.go and internal/config/errors.go that print an issue URL to operators. These are Go string literals inside rebrand-guard's brand allowlist, so the baseline is regenerated. The regeneration removes exactly those three entries and adds none; all twelve other protected sets, including the 9014 exported symbols, are byte-identical. - The transitional-naming disclaimers in README, README_ZH, SECURITY and CONTRIBUTING are dropped, since they no longer describe anything. Deliberately unchanged, all three because they exist to reject or freeze the old name rather than to point at it: - buildscripts/minio-upgrade.sh pins pgsty/minio@sha256:b6bfe72... - the frozen pre-rebrand image is the control group for the MinIO-to-Silo upgrade test. - helm-migration-guard rejects any rendered container still pulling pgsty/minio. - verify-rebrand.sh rejects the same in the delivery surfaces. Also unchanged: docs/config/README.md links to pgsty/mc/blob/master, and that repository's default branch really is still master. It moves when mc does. verify-rebrand.sh gains three assertions so this cannot silently regress: no source reference may name pgsty/minio outside the three allowlisted guards, no link may target pgsty/silo's master branch, and go.yml and vulncheck.yml must filter on main. Both new rejections were negative-tested - reintroducing a master branch filter and adding a pgsty/minio URL each fail the gate with the specific message. This commit assumes the rename actually happens. Until the GitHub branch and repository renames are executed, the links it introduces do not resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
73 lines
3.3 KiB
Markdown
73 lines
3.3 KiB
Markdown
# etcd V3 Quickstart Guide
|
|
|
|
etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines.
|
|
|
|
## Get started
|
|
|
|
### 1. Prerequisites
|
|
|
|
- Docker 18.03 or above, refer here for [installation](https://docs.docker.com/install/).
|
|
|
|
### 2. Start etcd
|
|
|
|
etcd uses [gcr.io/etcd-development/etcd](https://console.cloud.google.com/gcr/images/etcd-development/GLOBAL/etcd) as a primary container registry.
|
|
|
|
```
|
|
rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \
|
|
podman rmi gcr.io/etcd-development/etcd:v3.3.9 || true && \
|
|
podman run \
|
|
-p 2379:2379 \
|
|
-p 2380:2380 \
|
|
--mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \
|
|
--name etcd-gcr-v3.3.9 \
|
|
gcr.io/etcd-development/etcd:v3.3.9 \
|
|
/usr/local/bin/etcd \
|
|
--name s1 \
|
|
--data-dir /etcd-data \
|
|
--listen-client-urls http://0.0.0.0:2379 \
|
|
--advertise-client-urls http://0.0.0.0:2379 \
|
|
--listen-peer-urls http://0.0.0.0:2380 \
|
|
--initial-advertise-peer-urls http://0.0.0.0:2380 \
|
|
--initial-cluster s1=http://0.0.0.0:2380 \
|
|
--initial-cluster-token tkn \
|
|
--initial-cluster-state new
|
|
```
|
|
|
|
You may also setup etcd with TLS following this documentation [here](https://coreos.com/etcd/docs/latest/op-guide/security.html)
|
|
|
|
### 3. Setup Silo with etcd
|
|
|
|
Silo server expects environment variable for etcd as `MINIO_ETCD_ENDPOINTS`, this environment variable takes many comma separated entries.
|
|
|
|
```
|
|
export MINIO_ETCD_ENDPOINTS=http://localhost:2379
|
|
silo server /data
|
|
```
|
|
|
|
NOTE: If `etcd` is configured with `Client-to-server authentication with HTTPS client certificates` then you need to use additional envs such as `MINIO_ETCD_CLIENT_CERT` pointing to path to `etcd-client.crt` and `MINIO_ETCD_CLIENT_CERT_KEY` path to `etcd-client.key` .
|
|
|
|
### 4. Test with Silo STS API
|
|
|
|
Once etcd is configured, **any STS configuration** will work including Client Grants, Web Identity or AD/LDAP.
|
|
|
|
For example, you can configure STS with Client Grants (KeyCloak) using the guides at [Silo STS Quickstart Guide](https://silo.pgsty.com/developers/security-token-service/) and [KeyCloak Configuration Guide](https://github.com/pgsty/silo/blob/main/docs/sts/keycloak.md). Once this is done, STS credentials can be generated:
|
|
|
|
```
|
|
go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrOWvhRWL4TUCga
|
|
|
|
##### Credentials
|
|
{
|
|
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
|
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
|
"expiration": "2018-08-21T15:49:38-07:00",
|
|
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
|
}
|
|
```
|
|
|
|
These credentials can now be used to perform Silo API operations, these credentials automatically expire in 1hr. To understand more about credential expiry duration and client grants STS API read further [here](https://github.com/pgsty/silo/blob/main/docs/sts/client-grants.md).
|
|
|
|
## Explore Further
|
|
|
|
- [Silo STS Quickstart Guide](https://silo.pgsty.com/developers/security-token-service/)
|
|
- [The Silo documentation website](https://silo.pgsty.com/docs/)
|