chrislusf opened a new pull request, #14160:
URL: https://github.com/apache/cloudstack/pull/14160
## Summary
Adds SeaweedFS as a first-class object storage provider in CloudStack,
alongside the existing MinIO, Ceph RGW, and Cloudian HyperStore providers.
SeaweedFS exposes an S3-compatible API and an AWS IAM-compatible API, so
this provider uses the AWS S3 and IAM Java SDKs — the same approach as the
Cloudian HyperStore provider. No proprietary admin client is needed.
### Key features
- **Bucket CRUD, policy, versioning, encryption, ACLs** via `AmazonS3` SDK
(AWS SDK v1, same as Ceph/Cloudian)
- **Per-account IAM user provisioning** via `AmazonIdentityManagement` SDK
(same as Cloudian HyperStore)
- **Per-bucket quota** via the SeaweedFS S3 `?seaweedfs-quota` extension
(`PUT /{bucket}?seaweedfs-quota`), authenticated via SigV4 and authorized via
the `s3:PutBucketQuota` IAM permission. This requires SeaweedFS PR #11279
(merged).
- **Usage reporting** via S3 `ListObjectsV2` (MVP; Prometheus or SOSAPI
`capacity.xml` recommended for production scale)
### Architecture
The plugin follows the Cloudian HyperStore pattern almost line for line:
- Same store-details keys: `s3Url`, `iamUrl`, `accesskey`, `secretkey`
- `iamUrl` defaults to `s3Url` (SeaweedFS registers its IAM API at `POST /`
on the same S3 endpoint)
- Same IAM-user-with-restricted-policy pattern
- Same Spring wiring
### Quota management
SeaweedFS enforces bucket quota server-side (read-only flag when usage
exceeds the limit). The configuration surface is a narrow S3 subresource — `PUT
/{bucket}?seaweedfs-quota` — authenticated via standard S3 SigV4 and authorized
via dedicated `s3:PutBucketQuota`/`s3:GetBucketQuota` IAM permissions. This
avoids exposing the broad SeaweedFS admin API to CloudStack. The plugin signs
the request with `AWSS3V4Signer` and sends it via `java.net.http.HttpClient`
(the AWS S3 SDK doesn't natively support custom subresources).
### Comparison with MinIO and Ceph
| Concern | MinIO | Ceph RGW | Cloudian | SeaweedFS |
|---------|-------|----------|----------|-----------|
| Bucket CRUD | `MinioClient` | `AmazonS3` | `AmazonS3` | `AmazonS3` |
| User creation | `MinioAdminClient` | `RgwAdmin` |
`AmazonIdentityManagement` | `AmazonIdentityManagement` |
| Per-bucket quota | `MinioAdminClient` | `RgwAdmin` | not supported | S3
extension (SigV4) |
| Usage reporting | `MinioAdminClient` | `RgwAdmin` | Cloudian admin API |
S3 `ListObjectsV2` |
### Files
New module under `plugins/storage/object/seaweedfs/`:
- `pom.xml` — Maven module
- `SeaweedFSObjectStoreProviderImpl.java` — Spring provider registration
- `SeaweedFSObjectStoreLifeCycleImpl.java` — Pool add/health-check, URL
validation
- `SeaweedFSObjectStoreDriverImpl.java` — Bucket + user ops via S3 + IAM SDK
- `SeaweedFSObjectStoreUtil.java` — S3 + IAM client builders, constants,
SigV4 quota request
- Spring/module metadata
- Tests (18 tests, all passing)
### SeaweedFS dependency
Requires SeaweedFS with the `?seaweedfs-quota` S3 extension (PR
seaweedfs/seaweedfs#11279, merged). Without it, quota operations will fail with
404; all other operations (bucket CRUD, user provisioning, usage) work with any
recent SeaweedFS release.
#### Test plan
- [ ] Unit tests pass: `mvn -pl plugins/storage/object/seaweedfs test` (18
tests, 0 failures)
- [ ] Manual: register a SeaweedFS object store via `addObjectStoragePool`
with `s3Url`, `accesskey`, `secretkey`
- [ ] Manual: create a bucket via CloudStack, verify it appears in SeaweedFS
- [ ] Manual: set a bucket quota via CloudStack, verify it appears in
SeaweedFS via `weed shell` `s3.bucket.list`
- [ ] Manual: provision a user for a CloudStack account, verify IAM user
appears in SeaweedFS
- [ ] Manual: verify usage reporting returns bucket sizes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
