fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1 - #3136
Conversation
Aleksei Sviridkin (lexfrei)
added
the
backport
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a security issue in the SeaweedFS COSI driver where the Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
github-actions
Bot
added
area/storage
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughPins the SeaweedFS COSI driver image to ChangesSeaweedFS COSI driver image pin
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request overrides the vendored seaweedfs COSI driver image to version v0.3.1 in packages/system/seaweedfs/values.yaml to enforce read-only bucket access, which was ignored in the default v0.1.2 version. It also introduces a new Helm test suite cosi_image_test.yaml to ensure this image pin is preserved across future chart updates. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/system/seaweedfs/values.yaml (1)
207-211: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the COSI driver image by digest.
ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1is still mutable; useghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1@sha256:eff99808360fae4f90d477fee80209905aeeb0ab6b39d96a5fd21c30124248cbso the deployed bits stay reproducible, matching the adjacentsidecar.imagepin.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/seaweedfs/values.yaml` around lines 207 - 211, The seaweedfs COSI driver image is still pinned by tag only, so update the image reference in the values configuration to use the immutable digest form instead of the mutable v0.3.1 tag. Keep the existing `image` setting for the SeaweedFS COSI driver and change it to the digest-pinned `ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1@sha256:eff99808360fae4f90d477fee80209905aeeb0ab6b39d96a5fd21c30124248cb`, matching the nearby `sidecar.image` pin.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/system/seaweedfs/values.yaml`:
- Around line 207-211: The seaweedfs COSI driver image is still pinned by tag
only, so update the image reference in the values configuration to use the
immutable digest form instead of the mutable v0.3.1 tag. Keep the existing
`image` setting for the SeaweedFS COSI driver and change it to the digest-pinned
`ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1@sha256:eff99808360fae4f90d477fee80209905aeeb0ab6b39d96a5fd21c30124248cb`,
matching the nearby `sidecar.image` pin.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2492a085-03b5-429d-a0b0-39ddd6602266
📒 Files selected for processing (2)
packages/system/seaweedfs/tests/cosi_image_test.yamlpackages/system/seaweedfs/values.yaml
…r to v0.3.1 The seaweedfs COSI driver shipped at v0.1.2 hardcodes read-write S3 actions (Read, Write, List, Tagging) for every BucketAccess and never reads the accessPolicy parameter. The chart already defines a -readonly BucketAccessClass carrying parameters.accessPolicy: readonly, but v0.1.2 ignores it, so a credential meant to be read-only can still write (upload and delete) objects. Bump the driver to v0.3.1, which honours accessPolicy: readonly by issuing Read,List-only credentials (read-write and the empty default stay Read,Write,List,Tagging). The override lives in the package values.yaml rather than the vendored chart so it survives make update; the sister extra/seaweedfs chart already runs v0.3.1. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
0d2389e to
0c6426f
Compare
|
Successfully created backport PR for |
2 participants
What this PR does
The SeaweedFS COSI driver shipped at
v0.1.2hardcodes read-write S3 actions (Read,Write,List,Tagging) for every BucketAccess and never reads theaccessPolicyBucketAccessClass parameter. The chart already defines a-readonlyBucketAccessClass carryingparameters.accessPolicy: readonly, and thebucketapp routesreadonly: trueusers to it — butv0.1.2ignores the parameter, so a credential meant to be read-only is silently issued with full read-write access and can upload and delete objects. This is an access-control bug.Upstream
seaweedfs/seaweedfs-cosi-driveraddedaccessPolicyhandling inv0.3.0:readonlymaps toRead,List, whilereadwriteand the empty default stayRead,Write,List,Tagging. This bumps the driver tov0.3.1via aseaweedfs.cosi.imageoverride in the packagevalues.yaml, so the override survivesmake updateand the vendored chart is left untouched. The default read-write action set is unchanged, so existing read-write credentials are unaffected; only read-only grants are tightened to actually be read-only.The
extra/seaweedfschart already runsv0.3.1with the same objectstorage-sidecar, so the driver/sidecar combination is already proven in this repo. A chart unit test pins the rendered driver image so this fix cannot silently regress on a future re-vendor.This does not close #1921. That issue bundles two features — read-only bucket access (fixed here) and Object Lock / WORM (the
-lockBucketClass), which is independent and out of scope here. Relates to #1921.Release note
Summary by CodeRabbit
ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1to keep access behavior consistent and avoid relying on a vendored default.