miki3421 opened a new pull request, #155:
URL: https://github.com/apache/openserverless-operator/pull/155
## Summary
- make the SeaweedFS service cluster-internal instead of exposing S3, Filer,
and Master as NodePorts
- allow tenant workloads to keep using authenticated S3 on port 9000 while
restricting Filer 9090 and Master 9333 to trusted non-action pods
- remove legacy Filer ingress resources and reconcile the boundary on
operator resume/update
- prevent action label impersonation by excluding pods carrying the
`user-action-pod` marker from trusted peers
## Compatibility
- authenticated tenant S3 traffic remains available on port 9000
- the existing S3 ingress remains supported
- operator access to Filer and Master remains available
- existing installations are migrated during operator resume without
recreating SeaweedFS or tenant data
- the legacy console configuration field remains accepted, but the
unauthenticated Filer API is no longer published
## Validation
- `git diff --check`
- changed Python modules compile successfully
- full Python unit suite: 126 tests passed
- clean 0.9.0 operator image build completed successfully
- verified on the baseline K3s lab with real synthetic Alpha and Beta
actions:
- before the change, an Alpha action reached ports 9000, 9090, and 9333
- after the change, the same action reached 9000 but was blocked from 9090
and 9333, including when attempting to copy the operator label
- the operator still received HTTP 200 from 9090 and 9333
- Alpha and Beta retained access to their own S3 buckets and received
`AccessDenied` for the peer bucket
- anonymous data bucket access remained HTTP 403 and public web bucket
access remained HTTP 200
No existing tenant data was modified or removed by the migration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
