litiliu opened a new issue, #3493: URL: https://github.com/apache/fluss/issues/3493
## Problem In static AK/SK mode, every Fluss server process that initializes or accesses the S3 remote filesystem, including tablet servers, must have `fs.s3a.access.key` and `fs.s3a.secret.key` in its local configuration. These credentials are loaded at process startup and are not reloaded periodically. In our environment, the S3 access key and secret key are rotated/expired periodically for security reasons. After rotation, we need Fluss to pick up the new credentials without restarting Fluss servers. Currently, the only practical way to make the rotated AK/SK take effect is to restart the affected Fluss server processes. This is undesirable because restarting tablet servers can make ongoing writes unstable and may temporarily affect cluster availability. ## Expected Behavior Fluss should support refreshing static S3 AK/SK credentials without requiring a Fluss server restart. For example, Fluss could provide one of the following mechanisms: - Periodically reload S3 credentials from the server configuration or a dedicated credential file. - Recreate or refresh the underlying S3 filesystem / credentials provider when credentials change. - Provide a configurable refresh interval, such as refreshing credentials every few hours. - Support an explicit admin operation to reload S3 filesystem credentials. ## Why This Matters S3 credentials are often rotated periodically as part of security compliance. Requiring a full Fluss server restart for every credential rotation introduces operational risk, especially for write-heavy workloads. It would be helpful if Fluss could support static AK/SK rotation in a way that does not interrupt running servers or destabilize writes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
