Make a link key per bucket, limited to get and put of its objects and kept as minio's own secret, so links are not signed by the root account (issue 1594)

2026-10-21 14:47:14 +02:00
parent 671ab9a3ba
commit 5b3fd1008a
8 changed files with 297 additions and 57 deletions
@@ -173,6 +173,7 @@
          "MESH_MINIO_ROOT_USER": "meshroot",
          "MESH_MINIO_ROOT_PASSWORD_FILE": "${dir:state}/root.secret",
          "MESH_MINIO_REGION": "eu-west",
+          "MESH_MINIO_LINKS": "${dir:state}/links",
          "MESH_MINIO_MC_BIN": "mcli",
          "MESH_MINIO_MC_CONFIG": "${dir:state}/mc",
          "MESH_RECEIVES": "${dir:grants}/mesh.json"