seaweedfs-provisioner
S3 buckets, identities and policies for SeaweedFS. Policies applied only when they drift; never deletes.
- v1.0.0 · latest
- MIT
- Go
- never deletes
docker pull ghcr.io/datarocks-ag/seaweedfs-provisioner:1.0.0What it does
- Buckets, identities, policies — Idempotent provisioning of S3 buckets, IAM identities and bucket policies.
- Versioning and lifecycle — Bucket versioning and object expiration rules.
- Two phases — Identities are rendered into the s3.config SeaweedFS loads at boot, merged rather than overwritten; buckets and policies are applied once the cluster is healthy.
- Policies from JSON files — Bucket policies are loaded from JSON files and applied only when they drift.
- Dry run — Previews every mutation against live state.
- Never destructive — Never deletes buckets, identities or policies that are not in the config.
buckets:
- name: documents
# Omit `versioning` entirely to leave the bucket's current setting alone;
# setting it to false actively suspends versioning.
versioning: true
- name: media-assets
- name: backups
strategy: "create"
# Object expiration rules. Rules are matched by id, and rules already on the
# bucket that are not listed here are preserved.
lifecycle:
- id: expire-old-snapshots
prefix: "snapshots/"
expiration_days: 30
status: enabled # enabled (default) | disabled
# Identities are rendered into the s3.config file SeaweedFS loads at boot
# (--phase=identities), so they take effect when the cluster starts, not while
# it is running. Once any identity exists the S3 gateway enforces auth, so an
# identity with the "Admin" action is required for the cluster phase — and for
# any other admin access — to work.
identities:
- name: admin
credentials:
- access_key: ${SEAWEEDFS_ADMIN_ACCESS_KEY}
secret_key: ${SEAWEEDFS_ADMIN_SECRET_KEY}
actions:
- "Admin"
- "Read"
- "Write"
- "List"
- "Tagging"
- name: app-service
credentials:
- access_key: ${APP_SERVICE_ACCESS_KEY}
secret_key: ${APP_SERVICE_SECRET_KEY}
actions:Documentation for this project lives in its README on GitHub.
Documentation on GitHub ↗More provisioners
Data Rocks AG
[ONE OR TWO LINES ON WHAT DATA ROCKS DOES AND FOR WHOM]