adding support for publishing bundle to Minio Object Storage (#5395) #5757

Dimss · 2025-01-03T17:33:59Z

As a part of #5395 this PR add support to Minio S3 storage.
The PR does not meant to be merge to main yet.
I do need someone look on the PR and provide initial feedback.
I wanna make sure this functionality is still needed and overall logic does make sense.
if all good, I'll continue to work on it, add tests, etc...

sorindumitru · 2025-01-07T20:16:07Z

Thanks for the contribution @Dimss! I'll try to take a look at it this week.

sorindumitru · 2025-01-08T20:22:36Z

@Dimss Minio is API compatible with AWS S3 API, so it should be possible to use the existing awss3 bundle publisher here. Have you tried using that? Are there any issues or missing functionality?

Dimss · 2025-01-12T17:57:05Z

@sorindumitru awss3 might be working with Minio.
However, by default when user using awss3 bundle publisher he doesn't have an option to configure what's Minio calls Endpoint URL. We possibly can extend the awss3 configuration with Endpoint URL, but then perhaps it will be not awss3 but generic s3 bundle publisher.
In addition, Minio allow insecure connections to buckets (might be useful for dev/test envs)

I think the main question here, should it be a generic S3 publisher or publisher for each provider with it's backend implementation.

kfox1111 · 2025-01-15T16:37:10Z

Thank you so much for working on this! :)

Its using the minio client, but I think it could work against any s3 server as coded?

There are a lot of s3 compatible implementations out there (many storage vendors support it) and they all work with the aws s3 client I believe, or one of the implementations like minio's client.

Having one generic s3 driver I think would be preferable to one per storage implementation, as they all essentially work the same.

sorindumitru · 2025-01-16T15:15:02Z

Having separate implementations for different platforms may make sense eventually, but I feel that for now it only adds maintenance burden.

If someone does end up needing something from this plugin where it makes sense to have it use platform specific APIs, such as platform specific authentication methods, we should look into splitting off that part into a separate plugin. @Dimss, do you need anything from an S3 publisher that is Minio specific?

For now, it's probably easiest to just add support for specifying an optional endpoint to the awss3 plugin.

Dimss · 2025-01-19T14:31:13Z

@sorindumitru ok by me.
So then I'll extend existing awss3 plugin with extra optional parameter endpoint and insecure.
Do you agree?

kfox1111 · 2025-01-19T15:21:08Z

Just endpoint for now I think? if you need to load in a custom ca for talking to minio, it can be done via the system trust bundle. If its actually insecure, not sure there is any advantage to funneling it through the s3 service rather then just using the agents insecure_bootstrap flag?

Dimss · 2025-01-19T17:08:02Z

@kfox1111 agree. then I'll just add one optional endpoint param into existing awss3 plugin

Dimss · 2025-02-04T17:03:51Z

@kfox1111, @sorindumitru I applied required changes, pls review.

amartinezfayo

Thank you @Dimss for this contribution!

We need to update the documentation of the aws_s3 bundle publisher plugin with the new Endpoint setting, indicating that's an optional setting (not required).

We should also add test coverage for this, making sure to check that the configuration has been properly wired up to the aws config.

go.sum

pkg/server/plugin/bundlepublisher/awss3/client.go

amartinezfayo · 2025-02-20T13:34:18Z

Hi @Dimss, I think we’re pretty close to having this merged. Have you had a chance to look at the latest small comments?

Dimss · 2025-02-24T12:45:24Z

Hey @amartinezfayo yeah, I saw the comments, I'll make it done in coming days.

Dimss · 2025-03-01T13:05:59Z

@amartinezfayo I've applied required changes, added tests and updated docs.
pls review.

kfox1111

LGTM. Thanks! :)

kfox1111 · 2025-03-01T14:29:50Z

Looks like the DCO needs fixing.

Dimss · 2025-03-02T09:32:12Z

@kfox1111 DCO has been added.

pkg/server/plugin/bundlepublisher/minios3/minios3.go

pkg/server/plugin/bundlepublisher/awss3/awss3.go

sorindumitru · 2025-03-02T16:53:50Z

pkg/server/plugin/bundlepublisher/awss3/client.go

+			options.BaseEndpoint = c.BaseEndpoint
+		}
+	}
+	return s3.NewFromConfig(c, options), nil


I think NewFromConfig would end up calling the nil options in the case that the BaseEndpoint is not configured. We could have the options have a default of an empty function.

@sorindumitru I do not understand what you mean.
can you pls provide an example.

The options variable defaults to the zero value of a function pointer, which is nil. NewFromConfig will then try to call that nil and get a segfault. See for example https://play.golang.com/p/SPZxT29tKjN

We can avoid this by initializing the variable to a function that doesn't do anything.

@sorindumitru, yes you are right.
@amartinezfayo suggested to change it var comment
I'll revert it back to options := func(options *s3.Options) {}, is that OK?

sorindumitru · 2025-03-02T16:55:05Z

pkg/server/plugin/bundlepublisher/awss3/awss3_test.go

@@ -98,6 +110,20 @@ func TestConfigure(t *testing.T) {
 			expectMsg:    "failed to create client: client creation error",
 			newClientErr: errors.New("client creation error"),
 		},
+		{
+			name: "wrong endpoint format",


I find the format in the test name a bit confusing because there's a Format field in the config too. Maybe we can say:

Suggested change

name: "wrong endpoint format",

name: "invalid endpoint url",

Looks like this change didn't get addressed.

sorindumitru · 2025-03-02T16:57:39Z

go.mod

@@ -1,166 +1,161 @@
 module github.com/spiffe/spire

-go 1.23.4
+go 1.24.0


This might be some leftover from rebasing, could you clean it up?

@sorindumitru
this looks up to date.. not sure why github show this diff.
in PR, the go.mod have valid go version

doc/plugin_server_bundlepublisher_aws_s3.md

…5395) Signed-off-by: Dmitry Kartsev <[email protected]>

…-5395

sorindumitru · 2025-03-03T13:38:53Z

go.sum

@@ -2229,4 +2229,4 @@ sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
 software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
-software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
+software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=


Looks like we still have these new line changes, could you also remove this? The linter is also complaining about them.

Dimss requested review from evan2645, amartinezfayo, azdagron, MarcosDY and rturner3 as code owners January 3, 2025 17:34

amartinezfayo self-assigned this Jan 7, 2025

amartinezfayo assigned sorindumitru Jan 7, 2025

Dimss requested a review from sorindumitru as a code owner February 4, 2025 15:49

amartinezfayo reviewed Feb 6, 2025

View reviewed changes

go.sum Show resolved Hide resolved

pkg/server/plugin/bundlepublisher/awss3/client.go Outdated Show resolved Hide resolved

pkg/server/plugin/bundlepublisher/awss3/client.go Show resolved Hide resolved

kfox1111 previously approved these changes Mar 1, 2025

View reviewed changes

Dimss dismissed kfox1111’s stale review via 67a371d March 2, 2025 09:18

Dimss force-pushed the s3-bundlePublisher-for-other-implementations-5395 branch 2 times, most recently from 67a371d to a4ad9d1 Compare March 2, 2025 09:21

Dimss requested review from amartinezfayo and kfox1111 March 2, 2025 09:30

Dimss force-pushed the s3-bundlePublisher-for-other-implementations-5395 branch from 079304f to b4829a7 Compare March 2, 2025 16:30

Dimss force-pushed the s3-bundlePublisher-for-other-implementations-5395 branch from b4829a7 to ca83e3f Compare March 2, 2025 16:33

sorindumitru reviewed Mar 2, 2025

View reviewed changes

doc/plugin_server_bundlepublisher_aws_s3.md Outdated Show resolved Hide resolved

Dimss force-pushed the s3-bundlePublisher-for-other-implementations-5395 branch 2 times, most recently from 7689432 to 593c46a Compare March 2, 2025 17:38

Dimss requested a review from sorindumitru March 2, 2025 17:41

Adding support for publishing bundle to Minio Object Storage (spiffe#…

cd225fd

…5395) Signed-off-by: Dmitry Kartsev <[email protected]>

Dimss force-pushed the s3-bundlePublisher-for-other-implementations-5395 branch from 593c46a to cd225fd Compare March 2, 2025 20:00

Merge branch 'main' into s3-bundlePublisher-for-other-implementations…

4c4ff06

…-5395

sorindumitru reviewed Mar 3, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

adding support for publishing bundle to Minio Object Storage (#5395) #5757

adding support for publishing bundle to Minio Object Storage (#5395) #5757

Dimss commented Jan 3, 2025

sorindumitru commented Jan 7, 2025

sorindumitru commented Jan 8, 2025

Dimss commented Jan 12, 2025 •

edited

Loading

kfox1111 commented Jan 15, 2025

sorindumitru commented Jan 16, 2025

Dimss commented Jan 19, 2025

kfox1111 commented Jan 19, 2025

Dimss commented Jan 19, 2025

Dimss commented Feb 4, 2025

amartinezfayo left a comment

amartinezfayo commented Feb 20, 2025

Dimss commented Feb 24, 2025

Dimss commented Mar 1, 2025

kfox1111 left a comment

kfox1111 commented Mar 1, 2025

Dimss commented Mar 2, 2025

sorindumitru Mar 2, 2025

Dimss Mar 2, 2025

sorindumitru Mar 2, 2025

Dimss Mar 2, 2025

sorindumitru Mar 2, 2025

sorindumitru Mar 3, 2025

sorindumitru Mar 2, 2025

Dimss Mar 2, 2025

sorindumitru Mar 3, 2025

adding support for publishing bundle to Minio Object Storage (#5395) #5757

Are you sure you want to change the base?

adding support for publishing bundle to Minio Object Storage (#5395) #5757

Conversation

Dimss commented Jan 3, 2025

sorindumitru commented Jan 7, 2025

sorindumitru commented Jan 8, 2025

Dimss commented Jan 12, 2025 • edited Loading

kfox1111 commented Jan 15, 2025

sorindumitru commented Jan 16, 2025

Dimss commented Jan 19, 2025

kfox1111 commented Jan 19, 2025

Dimss commented Jan 19, 2025

Dimss commented Feb 4, 2025

amartinezfayo left a comment

Choose a reason for hiding this comment

amartinezfayo commented Feb 20, 2025

Dimss commented Feb 24, 2025

Dimss commented Mar 1, 2025

kfox1111 left a comment

Choose a reason for hiding this comment

kfox1111 commented Mar 1, 2025

Dimss commented Mar 2, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Dimss commented Jan 12, 2025 •

edited

Loading