Skip to content

Make accessKey and secretKey optional and add support to use IRSA Iam role #1716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: main
Choose a base branch
from
Open

Make accessKey and secretKey optional and add support to use IRSA Iam role #1716

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
0a9223b
Make accessKey and secretKey optional and add support to use IRSA Iam…
Anany-k Jul 21, 2025
0733671
Add support for IRSA role with object store
Anany-k Jul 21, 2025
2c72299
Fix test
Anany-k Jul 21, 2025
bf8b27d
Remove .js extension when importing
Anany-k Jul 21, 2025
ae6b38b
revert
Anany-k Jul 21, 2025
331781d
Merge branch 'gristlabs:main' into main
Anany-k Aug 27, 2025
8d10813
Add an env var GRIST_DOCS_MINIO_AUTH_AUTO_DETECT to when should try l…
Anany-k Aug 27, 2025
157f687
Merge branch 'gristlabs:main' into main
Anany-k Sep 5, 2025
5161271
Merge branch 'gristlabs:main' into main
Anany-k Sep 7, 2025
94c9c8a
Update how minio client is initliazed in the constructor
Anany-k Sep 7, 2025
54b36f8
Fix eslint warning
Anany-k Sep 7, 2025
600374a
Merge branch 'gristlabs:main' into main
Anany-k Sep 29, 2025
350e181
Merge branch 'gristlabs:main' into main
Anany-k Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions app/server/lib/MinIOExternalStorage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,10 @@ export class MinIOExternalStorage implements ExternalStorage {
endPoint: string,
port?: number,
useSSL?: boolean,
accessKey: string,
secretKey: string,
accessKey?: string,
secretKey?: string,
credentialsProvider?: any,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you type this property?

Import IamAwsProvider like in app/server/lib/configureMinIOExternalStorage.ts and then:

Suggested change
credentialsProvider?: any,
credentialsProvider?: IamAwsProvider,


region: string
},
private _batchSize?: number,
Expand Down
7 changes: 5 additions & 2 deletions app/server/lib/configureMinIOExternalStorage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import {wrapWithKeyMappedStorage} from 'app/server/lib/ExternalStorage';
import {appSettings} from 'app/server/lib/AppSettings';
import {MinIOExternalStorage} from 'app/server/lib/MinIOExternalStorage';
import {IamAwsProvider} from 'minio/dist/main/IamAwsProvider.js';
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: please remove the .js extension

Suggested change
import {IamAwsProvider} from 'minio/dist/main/IamAwsProvider.js';
import {IamAwsProvider} from 'minio/dist/main/IamAwsProvider';


export function configureMinIOExternalStorage(purpose: 'doc'|'meta'|'attachments', extraPrefix: string) {
const options = checkMinIOExternalStorage();
Expand Down Expand Up @@ -40,14 +41,15 @@ export function checkMinIOExternalStorage() {
const useSSL = settings.flag('useSsl').read({
envVar: ['GRIST_DOCS_MINIO_USE_SSL'],
}).getAsBool();
const accessKey = settings.flag('accessKey').requireString({
const accessKey = settings.flag('accessKey').readString({
envVar: ['GRIST_DOCS_MINIO_ACCESS_KEY'],
censor: true,
});
const secretKey = settings.flag('secretKey').requireString({
const secretKey = settings.flag('secretKey').readString({
envVar: ['GRIST_DOCS_MINIO_SECRET_KEY'],
censor: true,
});
Comment on lines +43 to 50
Copy link

Copilot AI Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since accessKey and secretKey are now optional, there should be validation logic to ensure that when authAutoDetect is false, both accessKey and secretKey are provided. Currently, the function could return undefined values for these required credentials.

Copilot uses AI. Check for mistakes.

const credentialsProvider = new IamAwsProvider({});
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if we want to use accessKey + secretKey and not IRSA?

settings.flag('url').set(`minio://${bucket}/${prefix}`);
settings.flag('active').set(true);
return {
Expand All @@ -57,6 +59,7 @@ export function checkMinIOExternalStorage() {
useSSL,
accessKey,
secretKey,
credentialsProvider,
region
};
}
Expand Down
Loading