Skip to content

[Backport release-1.5] fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1 - #3153

Merged
myasnikovdaniil merged 1 commit into
release-1.5from
backport-3136-to-release-1.5
Jul 3, 2026
Merged

[Backport release-1.5] fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1#3153
myasnikovdaniil merged 1 commit into
release-1.5from
backport-3136-to-release-1.5

Conversation

@github-actions

Copy link
Copy Markdown

Description

Backport of #3136 to release-1.5.

…r to v0.3.1

The seaweedfs COSI driver shipped at v0.1.2 hardcodes read-write S3
actions (Read, Write, List, Tagging) for every BucketAccess and never
reads the accessPolicy parameter. The chart already defines a -readonly
BucketAccessClass carrying parameters.accessPolicy: readonly, but v0.1.2
ignores it, so a credential meant to be read-only can still write
(upload and delete) objects.

Bump the driver to v0.3.1, which honours accessPolicy: readonly by
issuing Read,List-only credentials (read-write and the empty default
stay Read,Write,List,Tagging). The override lives in the package
values.yaml rather than the vendored chart so it survives make update;
the sister extra/seaweedfs chart already runs v0.3.1.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 0c6426f)
@dosubot dosubot Bot added area/storage Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor) backport Should change be backported on previous release backport-previous Backport target — previous release line kind/bug Categorizes issue or PR as related to a bug labels Jun 30, 2026
@myasnikovdaniil
myasnikovdaniil merged commit 746f873 into release-1.5 Jul 3, 2026
7 checks passed
@myasnikovdaniil
myasnikovdaniil deleted the backport-3136-to-release-1.5 branch July 3, 2026 06:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/storage Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor) backport Should change be backported on previous release backport-previous Backport target — previous release line kind/bug Categorizes issue or PR as related to a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants