Initial plan

.docker/observability/docker-compose.yml

@@ -16,7 +16,7 @@ services:
 
   tempo-init:
     image: busybox:latest
-    command: [ "sh", "-c", "chown -R 10001:10001 /var/tempo" ]
+    command: ["sh", "-c", "chown -R 10001:10001 /var/tempo"]
     volumes:
       - ./tempo-data:/var/tempo
     user: root
@@ -34,145 +34,73 @@ services:
     ports:
       - "3200:3200" # tempo
       - "24317:4317" # otlp grpc
-      - "24318:4318" # otlp http
     restart: unless-stopped
     networks:
       - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3200/metrics" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:latest
+    image: otel/opentelemetry-collector-contrib:0.129.1
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml:ro
+      - ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml
     ports:
-      - "1888:1888" # pprof
-      - "8888:8888" # Prometheus metrics for Collector
-      - "8889:8889" # Prometheus metrics for application indicators
-      - "13133:13133" # health check
-      - "4317:4317" # OTLP gRPC
-      - "4318:4318" # OTLP HTTP
-      - "55679:55679" # zpages
+      - "1888:1888"
+      - "8888:8888"
+      - "8889:8889"
+      - "13133:13133"
+      - "4317:4317"
+      - "4318:4318"
+      - "55679:55679"
     networks:
       - otel-network
-    depends_on:
-      jaeger:
-        condition: service_started
-      tempo:
-        condition: service_started
-      prometheus:
-        condition: service_started
-      loki:
-        condition: service_started
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:13133" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-
   jaeger:
-    image: jaegertracing/jaeger:latest
+    image: jaegertracing/jaeger:2.8.0
     environment:
       - TZ=Asia/Shanghai
-      - SPAN_STORAGE_TYPE=memory
-      - COLLECTOR_OTLP_ENABLED=true
     ports:
-      - "16686:16686" # Web UI
-      - "14317:4317" # OTLP gRPC
-      - "14318:4318" # OTLP HTTP
-      - "18888:8888" # collector
+      - "16686:16686"
+      - "14317:4317"
+      - "14318:4318"
     networks:
       - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:16686" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
   prometheus:
-    image: prom/prometheus:latest
+    image: prom/prometheus:v3.4.2
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
-      - ./prometheus-data:/prometheus
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml
     ports:
       - "9090:9090"
-    command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
-      - '--web.enable-otlp-receiver' # Enable OTLP
-      - '--web.enable-remote-write-receiver' # Enable remote write
-      - '--enable-feature=promql-experimental-functions' # Enable info()
-      - '--storage.tsdb.min-block-duration=15m' # Minimum block duration
-      - '--storage.tsdb.max-block-duration=1h'  # Maximum block duration
-      - '--log.level=info'
-      - '--storage.tsdb.retention.time=30d'
-      - '--storage.tsdb.path=/prometheus'
-      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
-      - '--web.console.templates=/usr/share/prometheus/consoles'
-    restart: unless-stopped
     networks:
       - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:9090/-/healthy" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
   loki:
-    image: grafana/loki:latest
+    image: grafana/loki:3.5.1
     environment:
       - TZ=Asia/Shanghai
     volumes:
-      - ./loki-config.yaml:/etc/loki/local-config.yaml:ro
+      - ./loki-config.yaml:/etc/loki/local-config.yaml
     ports:
       - "3100:3100"
     command: -config.file=/etc/loki/local-config.yaml
     networks:
       - otel-network
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3100/ready" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
   grafana:
-    image: grafana/grafana:latest
+    image: grafana/grafana:12.0.2
     ports:
       - "3000:3000"  # Web UI
     volumes:
       - ./grafana-datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml
     environment:
       - GF_SECURITY_ADMIN_PASSWORD=admin
-      - GF_SECURITY_ADMIN_USER=admin
       - TZ=Asia/Shanghai
-      - GF_INSTALL_PLUGINS=grafana-pyroscope-datasource
-    restart: unless-stopped
     networks:
       - otel-network
-    depends_on:
-      - prometheus
-      - tempo
-      - loki
-    healthcheck:
-      test: [ "CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health" ]
-      interval: 10s
-      timeout: 5s
-      retries: 3
 
-volumes:
-  prometheus-data:
-  tempo-data:
 
 networks:
   otel-network:
     driver: bridge
     name: "network_otel_config"
-    ipam:
-      config:
-        - subnet: 172.28.0.0/16
     driver_opts:
       com.docker.network.enable_ipv6: "true"

.docker/observability/grafana-datasources.yaml

@@ -29,80 +29,4 @@ datasources:
       serviceMap:
         datasourceUid: prometheus
       streamingEnabled:
-        search: true
-      tracesToLogsV2:
-        # Field with an internal link pointing to a logs data source in Grafana.
-        # datasourceUid value must match the uid value of the logs data source.
-        datasourceUid: 'loki'
-        spanStartTimeShift: '-1h'
-        spanEndTimeShift: '1h'
-        tags: [ 'job', 'instance', 'pod', 'namespace' ]
-        filterByTraceID: false
-        filterBySpanID: false
-        customQuery: true
-        query: 'method="$${__span.tags.method}"'
-        tracesToMetrics:
-          datasourceUid: 'prometheus'
-          spanStartTimeShift: '-1h'
-          spanEndTimeShift: '1h'
-          tags: [ { key: 'service.name', value: 'service' }, { key: 'job' } ]
-          queries:
-            - name: 'Sample query'
-              query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m]))'
-        tracesToProfiles:
-          datasourceUid: 'grafana-pyroscope-datasource'
-          tags: [ 'job', 'instance', 'pod', 'namespace' ]
-          profileTypeId: 'process_cpu:cpu:nanoseconds:cpu:nanoseconds'
-          customQuery: true
-          query: 'method="$${__span.tags.method}"'
-        serviceMap:
-          datasourceUid: 'prometheus'
-        nodeGraph:
-          enabled: true
-        search:
-          hide: false
-        traceQuery:
-          timeShiftEnabled: true
-          spanStartTimeShift: '-1h'
-          spanEndTimeShift: '1h'
-        spanBar:
-          type: 'Tag'
-          tag: 'http.path'
-        streamingEnabled:
-          search: true
-  - name: Jaeger
-    type: jaeger
-    uid: Jaeger
-    url: http://jaeger:16686
-    basicAuth: false
-    access: proxy
-    readOnly: false
-    isDefault: false
-    jsonData:
-      tracesToLogsV2:
-        # Field with an internal link pointing to a logs data source in Grafana.
-        # datasourceUid value must match the uid value of the logs data source.
-        datasourceUid: 'loki'
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-        tags: [ 'job', 'instance', 'pod', 'namespace' ]
-        filterByTraceID: false
-        filterBySpanID: false
-        customQuery: true
-        query: 'method="$${__span.tags.method}"'
-      tracesToMetrics:
-        datasourceUid: 'Prometheus'
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-        tags: [ { key: 'service.name', value: 'service' }, { key: 'job' } ]
-        queries:
-          - name: 'Sample query'
-            query: 'sum(rate(traces_spanmetrics_latency_bucket{$$__tags}[5m]))'
-      nodeGraph:
-        enabled: true
-      traceQuery:
-        timeShiftEnabled: true
-        spanStartTimeShift: '1h'
-        spanEndTimeShift: '-1h'
-      spanBar:
-        type: 'None'
+        search: true

.docker/observability/jaeger-config.yaml

@@ -65,7 +65,6 @@ extensions:
       some_store:
         memory:
           max_traces: 1000000
-          max_events: 100000
       another_store:
         memory:
           max_traces: 1000000
@@ -103,7 +102,6 @@ receivers:
 
 processors:
   batch:
-  metadata_keys: [ "span.kind", "http.method", "http.status_code", "db.system", "db.statement", "messaging.system", "messaging.destination", "messaging.operation","span.events","span.links" ]
   # Adaptive Sampling Processor is required to support adaptive sampling.
   # It expects remote_sampling extension with `adaptive:` config to be enabled.
   adaptive_sampling:

.docker/observability/loki-config.yaml

@@ -41,9 +41,6 @@ query_range:
 
 limits_config:
   metric_aggregation_enabled: true
-  max_line_size: 256KB
-  max_line_size_truncate: false
-  allow_structured_metadata: true
 
 schema_config:
   configs:
@@ -54,7 +51,6 @@ schema_config:
       index:
         prefix: index_
         period: 24h
-      row_shards: 16
 
 pattern_ingester:
   enabled: true
@@ -67,7 +63,6 @@ ruler:
 frontend:
   encoding: protobuf
 
-
 # By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
 # analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
 #

.docker/observability/otel-collector-config.yaml

@@ -15,108 +15,67 @@
 receivers:
   otlp:
     protocols:
-      grpc: # OTLP gRPC receiver
+      grpc: # OTLP gRPC 接收器
         endpoint: 0.0.0.0:4317
-      http: # OTLP HTTP receiver
+      http: # OTLP HTTP 接收器
         endpoint: 0.0.0.0:4318
 
 processors:
-  batch: # Batch processor to improve throughput
+  batch: # 批处理处理器，提升吞吐量
     timeout: 5s
     send_batch_size: 1000
-    metadata_keys: [ ]
-    metadata_cardinality_limit: 1000
   memory_limiter:
     check_interval: 1s
     limit_mib: 512
-  transform/logs:
-    log_statements:
-      - context: log
-        statements:
-          # Extract Body as attribute "message"
-          - set(attributes["message"], body.string)
-          # Retain the original Body
-          - set(attributes["log.body"], body.string)
 
 exporters:
-  otlp/traces: # OTLP exporter for trace data
-    endpoint: "http://jaeger:4317"  # OTLP gRPC endpoint for Jaeger
+  otlp/traces: # OTLP 导出器，用于跟踪数据
+    endpoint: "jaeger:4317"  # Jaeger 的 OTLP gRPC 端点
     tls:
-      insecure: true  # TLS is disabled in the development environment and a certificate needs to be configured in the production environment.
-    compression: gzip  # Enable compression to reduce network bandwidth
-    retry_on_failure:
-      enabled: true  # Enable retry on failure
-      initial_interval: 1s  # Initial interval for retry
-      max_interval: 30s  # Maximum interval for retry
-      max_elapsed_time: 300s  # Maximum elapsed time for retry
-    sending_queue:
-      enabled: true  # Enable sending queue
-      num_consumers: 10  # Number of consumers
-      queue_size: 5000  # Queue size
-  otlp/tempo: # OTLP exporter for trace data
-    endpoint: "http://tempo:4317"  # OTLP gRPC endpoint for tempo
+      insecure: true  # 开发环境禁用 TLS，生产环境需配置证书
+  otlp/tempo: # OTLP 导出器，用于跟踪数据
+    endpoint: "tempo:4317"  # tempo 的 OTLP gRPC 端点
     tls:
-      insecure: true  # TLS is disabled in the development environment and a certificate needs to be configured in the production environment.
-    compression: gzip  # Enable compression to reduce network bandwidth
-    retry_on_failure:
-      enabled: true  # Enable retry on failure
-      initial_interval: 1s  # Initial interval for retry
-      max_interval: 30s  # Maximum interval for retry
-      max_elapsed_time: 300s  # Maximum elapsed time for retry
-    sending_queue:
-      enabled: true  # Enable sending queue
-      num_consumers: 10  # Number of consumers
-      queue_size: 5000  # Queue size
-  prometheus: # Prometheus exporter for metrics data
-    endpoint: "0.0.0.0:8889"  # Prometheus scraping endpoint
-    namespace: "metrics"  # indicator prefix
-    send_timestamps: true  # Send timestamp
-    metric_expiration: 5m  # Metric expiration time
-    resource_to_telemetry_conversion:
-      enabled: true  # Enable resource to telemetry conversion
-  otlphttp/loki: # Loki exporter for log data
-    endpoint: "http://loki:3100/otlp"
+      insecure: true  # 开发环境禁用 TLS，生产环境需配置证书
+  prometheus: # Prometheus 导出器，用于指标数据
+    endpoint: "0.0.0.0:8889"  # Prometheus 刮取端点
+    namespace: "rustfs"  # 指标前缀
+    send_timestamps: true  # 发送时间戳
+    # enable_open_metrics: true
+  otlphttp/loki: # Loki 导出器，用于日志数据
+    # endpoint: "http://loki:3100/otlp/v1/logs"
+    endpoint: "http://loki:3100/otlp/v1/logs"
     tls:
       insecure: true
-    compression: gzip  # Enable compression to reduce network bandwidth
 extensions:
   health_check:
-    endpoint: 0.0.0.0:13133
   pprof:
-    endpoint: 0.0.0.0:1888
   zpages:
-    endpoint: 0.0.0.0:55679
 service:
-  extensions: [ health_check, pprof, zpages ]  # Enable extension
+  extensions: [ health_check, pprof, zpages ]  # 启用扩展
   pipelines:
     traces:
       receivers: [ otlp ]
-      processors: [ memory_limiter, batch ]
-      exporters: [ otlp/traces, otlp/tempo ]
+      processors: [ memory_limiter,batch ]
+      exporters: [ otlp/traces,otlp/tempo ]
     metrics:
       receivers: [ otlp ]
       processors: [ batch ]
       exporters: [ prometheus ]
     logs:
       receivers: [ otlp ]
-      processors: [ batch, transform/logs ]
+      processors: [ batch ]
       exporters: [ otlphttp/loki ]
   telemetry:
     logs:
-      level: "debug"  # Collector log level
-      encoding: "json"  # Log encoding: console or json
+      level: "info"  # Collector 日志级别
     metrics:
-      level: "detailed" # Can be basic, normal, detailed
+      level: "detailed" # 可以是 basic, normal, detailed
       readers:
         - periodic:
             exporter:
               otlp:
                 protocol: http/protobuf
                 endpoint: http://otel-collector:4318
-        - pull:
-            exporter:
-              prometheus:
-                host: '0.0.0.0'
-                port: 8888
 
 

.docker/observability/prometheus-data/.gitignore

@@ -1 +0,0 @@
-*

.docker/observability/prometheus.yml

@@ -13,53 +13,16 @@
 # limitations under the License.
 
 global:
-  scrape_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
-  evaluation_interval: 15s
-  external_labels:
-    cluster: 'rustfs-dev'  # Label to identify the cluster
-    relica: '1'  # Replica identifier
+  scrape_interval: 5s  # 刮取间隔
 
 scrape_configs:
-  - job_name: 'otel-collector-internal'
+  - job_name: 'otel-collector'
     static_configs:
-      - targets: [ 'otel-collector:8888' ]  # Scrape metrics from Collector
-    scrape_interval: 10s
-  - job_name: 'rustfs-app-metrics'
+      - targets: [ 'otel-collector:8888' ]  # 从 Collector 刮取指标
+  - job_name: 'otel-metrics'
     static_configs:
-      - targets: [ 'otel-collector:8889' ]  # Application indicators
-    scrape_interval: 15s
-    metric_relabel_configs:
+      - targets: [ 'otel-collector:8889' ]  # 应用指标
   - job_name: 'tempo'
     static_configs:
-      - targets: [ 'tempo:3200' ]  # Scrape metrics from Tempo
-  - job_name: 'jaeger'
-    static_configs:
-      - targets: [ 'jaeger:8888' ]  # Jaeger admin port
-
-otlp:
-  # Recommended attributes to be promoted to labels.
-  promote_resource_attributes:
-    - service.instance.id
-    - service.name
-    - service.namespace
-    - cloud.availability_zone
-    - cloud.region
-    - container.name
-    - deployment.environment.name
-    - k8s.cluster.name
-    - k8s.container.name
-    - k8s.cronjob.name
-    - k8s.daemonset.name
-    - k8s.deployment.name
-    - k8s.job.name
-    - k8s.namespace.name
-    - k8s.pod.name
-    - k8s.replicaset.name
-    - k8s.statefulset.name
-  # Ingest OTLP data keeping all characters in metric/label names.
-  translation_strategy: NoUTF8EscapingWithSuffixes
-
-storage:
-  # OTLP is a push-based protocol, Out of order samples is a common scenario.
-  tsdb:
-    out_of_order_time_window: 30m
+      - targets: [ 'tempo:3200' ]
+      

.docker/observability/tempo.yaml

@@ -18,9 +18,7 @@ distributor:
     otlp:
       protocols:
         grpc:
-          endpoint: "0.0.0.0:4317"
-        http:
-          endpoint: "0.0.0.0:4318"
+          endpoint: "tempo:4317"
 
 ingester:
   max_block_duration: 5m # cut the headblock when this much time passes. this is being set for demo purposes and should probably be left alone normally

.envrc

@@ -1 +0,0 @@
-use flake

.github/actions/setup/action.yml

@@ -52,19 +52,24 @@ runs:
         sudo apt-get install -y \
           musl-tools \
           build-essential \
+          lld \
+          libdbus-1-dev \
+          libwayland-dev \
+          libwebkit2gtk-4.1-dev \
+          libxdo-dev \
           pkg-config \
           libssl-dev
 
     - name: Install protoc
       uses: arduino/setup-protoc@v3
       with:
-        version: "33.1"
+        version: "31.1"
         repo-token: ${{ inputs.github-token }}
 
     - name: Install flatc
       uses: Nugine/setup-flatc@v1
       with:
-        version: "25.9.23"
+        version: "25.2.10"
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable

.github/dependabot.yml

@@ -22,18 +22,8 @@ updates:
   - package-ecosystem: "cargo" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
-      interval: "weekly"
-      day: "monday"
-      timezone: "Asia/Shanghai"
-      time: "08:00"
+      interval: "monthly"
     groups:
-      s3s:
-        update-types:
-          - "minor"
-          - "patch"
-        patterns:
-          - "s3s"
-          - "s3s-*"
       dependencies:
         patterns:
           - "*"

.github/s3tests/README.md

@@ -1,103 +0,0 @@
-# S3 Compatibility Tests Configuration
-
-This directory contains the configuration for running [Ceph S3 compatibility tests](https://github.com/ceph/s3-tests) against RustFS.
-
-## Configuration File
-
-The `s3tests.conf` file is based on the official `s3tests.conf.SAMPLE` from the ceph/s3-tests repository. It uses environment variable substitution via `envsubst` to configure the endpoint and credentials.
-
-### Key Configuration Points
-
-- **Host**: Set via `${S3_HOST}` environment variable (e.g., `rustfs-single` for single-node, `lb` for multi-node)
-- **Port**: 9000 (standard RustFS port)
-- **Credentials**: Uses `${S3_ACCESS_KEY}` and `${S3_SECRET_KEY}` from workflow environment
-- **TLS**: Disabled (`is_secure = False`)
-
-## Test Execution Strategy
-
-### Network Connectivity Fix
-
-Tests run inside a Docker container on the `rustfs-net` network, which allows them to resolve and connect to the RustFS container hostnames. This fixes the "Temporary failure in name resolution" error that occurred when tests ran on the GitHub runner host.
-
-### Performance Optimizations
-
-1. **Parallel Execution**: Uses `pytest-xdist` with `-n 4` to run tests in parallel across 4 workers
-2. **Load Distribution**: Uses `--dist=loadgroup` to distribute test groups across workers
-3. **Fail-Fast**: Uses `--maxfail=50` to stop after 50 failures, saving time on catastrophic failures
-
-### Feature Filtering
-
-Tests are filtered using pytest markers (`-m`) to skip features not yet supported by RustFS:
-
-- `lifecycle` - Bucket lifecycle policies
-- `versioning` - Object versioning
-- `s3website` - Static website hosting
-- `bucket_logging` - Bucket logging
-- `encryption` / `sse_s3` - Server-side encryption
-- `cloud_transition` / `cloud_restore` - Cloud storage transitions
-- `lifecycle_expiration` / `lifecycle_transition` - Lifecycle operations
-
-This filtering:
-1. Reduces test execution time significantly (from 1+ hour to ~10-15 minutes)
-2. Focuses on features RustFS currently supports
-3. Avoids hundreds of expected failures
-
-## Running Tests Locally
-
-### Single-Node Test
-
-```bash
-# Set credentials
-export S3_ACCESS_KEY=rustfsadmin
-export S3_SECRET_KEY=rustfsadmin
-
-# Start RustFS container
-docker run -d --name rustfs-single \
-  --network rustfs-net \
-  -e RUSTFS_ADDRESS=0.0.0.0:9000 \
-  -e RUSTFS_ACCESS_KEY=$S3_ACCESS_KEY \
-  -e RUSTFS_SECRET_KEY=$S3_SECRET_KEY \
-  -e RUSTFS_VOLUMES="/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3" \
-  rustfs-ci
-
-# Generate config
-export S3_HOST=rustfs-single
-envsubst < .github/s3tests/s3tests.conf > /tmp/s3tests.conf
-
-# Run tests
-docker run --rm \
-  --network rustfs-net \
-  -v /tmp/s3tests.conf:/etc/s3tests.conf:ro \
-  python:3.12-slim \
-  bash -c '
-    apt-get update -qq && apt-get install -y -qq git
-    git clone --depth 1 https://github.com/ceph/s3-tests.git /s3-tests
-    cd /s3-tests
-    pip install -q -r requirements.txt pytest-xdist
-    S3TEST_CONF=/etc/s3tests.conf pytest -v -n 4 \
-      s3tests/functional/test_s3.py \
-      -m "not lifecycle and not versioning and not s3website and not bucket_logging and not encryption and not sse_s3"
-  '
-```
-
-## Test Results Interpretation
-
-- **PASSED**: Test succeeded, feature works correctly
-- **FAILED**: Test failed, indicates a potential bug or incompatibility
-- **ERROR**: Test setup failed (e.g., network issues, missing dependencies)
-- **SKIPPED**: Test skipped due to marker filtering
-
-## Adding New Feature Support
-
-When adding support for a new S3 feature to RustFS:
-
-1. Remove the corresponding marker from the filter in `.github/workflows/e2e-s3tests.yml`
-2. Run the tests to verify compatibility
-3. Fix any failing tests
-4. Update this README to reflect the newly supported feature
-
-## References
-
-- [Ceph S3 Tests Repository](https://github.com/ceph/s3-tests)
-- [S3 API Compatibility](https://docs.aws.amazon.com/AmazonS3/latest/API/)
-- [pytest-xdist Documentation](https://pytest-xdist.readthedocs.io/)

.github/s3tests/s3tests.conf

@@ -1,185 +0,0 @@
-# RustFS s3-tests configuration
-# Based on: https://github.com/ceph/s3-tests/blob/master/s3tests.conf.SAMPLE
-#
-# Usage:
-#   Single-node: S3_HOST=rustfs-single envsubst < s3tests.conf > /tmp/s3tests.conf
-#   Multi-node:  S3_HOST=lb envsubst < s3tests.conf > /tmp/s3tests.conf
-
-[DEFAULT]
-## this section is just used for host, port and bucket_prefix
-
-# host set for RustFS - will be substituted via envsubst
-host = ${S3_HOST}
-
-# port for RustFS
-port = 9000
-
-## say "False" to disable TLS
-is_secure = False
-
-## say "False" to disable SSL Verify
-ssl_verify = False
-
-[fixtures]
-## all the buckets created will start with this prefix;
-## {random} will be filled with random characters to pad
-## the prefix to 30 characters long, and avoid collisions
-bucket prefix = rustfs-{random}-
-
-# all the iam account resources (users, roles, etc) created
-# will start with this name prefix
-iam name prefix = s3-tests-
-
-# all the iam account resources (users, roles, etc) created
-# will start with this path prefix
-iam path prefix = /s3-tests/
-
-[s3 main]
-# main display_name
-display_name = RustFS Tester
-
-# main user_id
-user_id = rustfsadmin
-
-# main email
-email = tester@rustfs.local
-
-# zonegroup api_name for bucket location
-api_name = default
-
-## main AWS access key
-access_key = ${S3_ACCESS_KEY}
-
-## main AWS secret key
-secret_key = ${S3_SECRET_KEY}
-
-## replace with key id obtained when secret is created, or delete if KMS not tested
-#kms_keyid = 01234567-89ab-cdef-0123-456789abcdef
-
-## Storage classes
-#storage_classes = "LUKEWARM, FROZEN"
-
-## Lifecycle debug interval (default: 10)
-#lc_debug_interval = 20
-## Restore debug interval (default: 100)
-#rgw_restore_debug_interval = 60
-#rgw_restore_processor_period = 60
-
-[s3 alt]
-# alt display_name
-display_name = RustFS Alt Tester
-
-## alt email
-email = alt@rustfs.local
-
-# alt user_id
-user_id = rustfsalt
-
-# alt AWS access key (must be different from s3 main for many tests)
-access_key = ${S3_ALT_ACCESS_KEY}
-
-# alt AWS secret key
-secret_key = ${S3_ALT_SECRET_KEY}
-
-#[s3 cloud]
-## to run the testcases with "cloud_transition" for transition
-## and "cloud_restore" for restore attribute.
-## Note: the waiting time may have to tweaked depending on
-## the I/O latency to the cloud endpoint.
-
-## host set for cloud endpoint
-# host = localhost
-
-## port set for cloud endpoint
-# port = 8001
-
-## say "False" to disable TLS
-# is_secure = False
-
-## cloud endpoint credentials
-# access_key = 0555b35654ad1656d804
-# secret_key = h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q==
-
-## storage class configured as cloud tier on local rgw server
-# cloud_storage_class = CLOUDTIER
-
-## Below are optional -
-
-## Above configured cloud storage class config options
-# retain_head_object = false
-# allow_read_through = false    # change it to enable read_through
-# read_through_restore_days = 2
-# target_storage_class = Target_SC
-# target_path = cloud-bucket
-
-## another regular storage class to test multiple transition rules,
-# storage_class = S1
-
-[s3 tenant]
-# tenant display_name
-display_name = RustFS Tenant Tester
-
-# tenant user_id
-user_id = rustfstenant
-
-# tenant AWS access key
-access_key = ${S3_ACCESS_KEY}
-
-# tenant AWS secret key
-secret_key = ${S3_SECRET_KEY}
-
-# tenant email
-email = tenant@rustfs.local
-
-# tenant name
-tenant = testx
-
-#following section needs to be added for all sts-tests
-[iam]
-#used for iam operations in sts-tests
-#email
-email = s3@rustfs.local
-
-#user_id
-user_id = rustfsiam
-
-#access_key
-access_key = ${S3_ACCESS_KEY}
-
-#secret_key
-secret_key = ${S3_SECRET_KEY}
-
-#display_name
-display_name = RustFS IAM User
-
-# iam account root user for iam_account tests
-[iam root]
-access_key = ${S3_ACCESS_KEY}
-secret_key = ${S3_SECRET_KEY}
-user_id = RGW11111111111111111
-email = account1@rustfs.local
-
-# iam account root user in a different account than [iam root]
-[iam alt root]
-access_key = ${S3_ACCESS_KEY}
-secret_key = ${S3_SECRET_KEY}
-user_id = RGW22222222222222222
-email = account2@rustfs.local
-
-#following section needs to be added when you want to run Assume Role With Webidentity test
-[webidentity]
-#used for assume role with web identity test in sts-tests
-#all parameters will be obtained from ceph/qa/tasks/keycloak.py
-#token=<access_token>
-
-#aud=<obtained after introspecting token>
-
-#sub=<obtained after introspecting token>
-
-#azp=<obtained after introspecting token>
-
-#user_token=<access token for a user, with attribute Department=[Engineering, Marketing>]
-
-#thumbprint=<obtained from x509 certificate>
-
-#KC_REALM=<name of the realm>

.github/workflows/audit.yml

@@ -40,11 +40,11 @@ env:
 jobs:
   security-audit:
     name: Security Audit
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Install cargo-audit
         uses: taiki-e/install-action@v2
@@ -65,14 +65,14 @@ jobs:
 
   dependency-review:
     name: Dependency Review
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Dependency Review
         uses: actions/dependency-review-action@v4

.github/workflows/build.yml

@@ -83,7 +83,7 @@ jobs:
   # Build strategy check - determine build type based on trigger
   build-check:
     name: Build Strategy Check
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       build_type: ${{ steps.check.outputs.build_type }}
@@ -92,7 +92,7 @@ jobs:
       is_prerelease: ${{ steps.check.outputs.is_prerelease }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -167,19 +167,19 @@ jobs:
       matrix:
         include:
           # Linux builds
-          - os: ubicloud-standard-4
+          - os: ubuntu-latest
             target: x86_64-unknown-linux-musl
             cross: false
             platform: linux
-          - os: ubicloud-standard-4
+          - os: ubuntu-latest
             target: aarch64-unknown-linux-musl
             cross: true
             platform: linux
-          - os: ubicloud-standard-4
+          - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             cross: false
             platform: linux
-          - os: ubicloud-standard-4
+          - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu
             cross: true
             platform: linux
@@ -203,7 +203,7 @@ jobs:
           #  platform: windows
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -454,7 +454,7 @@ jobs:
           OSS_ACCESS_KEY_ID: ${{ secrets.ALICLOUDOSS_KEY_ID }}
           OSS_ACCESS_KEY_SECRET: ${{ secrets.ALICLOUDOSS_KEY_SECRET }}
           OSS_REGION: cn-beijing
-          OSS_ENDPOINT: https://oss-accelerate.aliyuncs.com
+          OSS_ENDPOINT: https://oss-cn-beijing.aliyuncs.com
         shell: bash
         run: |
           BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
@@ -532,7 +532,7 @@ jobs:
     name: Build Summary
     needs: [ build-check, build-rustfs ]
     if: always() && needs.build-check.outputs.should_build == 'true'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     steps:
       - name: Build completion summary
         shell: bash
@@ -584,7 +584,7 @@ jobs:
     name: Create GitHub Release
     needs: [ build-check, build-rustfs ]
     if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     outputs:
@@ -592,7 +592,7 @@ jobs:
       release_url: ${{ steps.create.outputs.release_url }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -670,13 +670,13 @@ jobs:
     name: Upload Release Assets
     needs: [ build-check, build-rustfs, create-release ]
     if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     permissions:
       contents: write
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Download all build artifacts
         uses: actions/download-artifact@v5
@@ -751,14 +751,14 @@ jobs:
     name: Update Latest Version
     needs: [ build-check, upload-release-assets ]
     if: startsWith(github.ref, 'refs/tags/')
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     steps:
       - name: Update latest.json
         env:
           OSS_ACCESS_KEY_ID: ${{ secrets.ALICLOUDOSS_KEY_ID }}
           OSS_ACCESS_KEY_SECRET: ${{ secrets.ALICLOUDOSS_KEY_SECRET }}
           OSS_REGION: cn-beijing
-          OSS_ENDPOINT: https://oss-accelerate.aliyuncs.com
+          OSS_ENDPOINT: https://oss-cn-beijing.aliyuncs.com
         shell: bash
         run: |
           if [[ -z "$OSS_ACCESS_KEY_ID" ]]; then
@@ -801,12 +801,12 @@ jobs:
     name: Publish Release
     needs: [ build-check, create-release, upload-release-assets ]
     if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Update release notes and publish
         env:

.github/workflows/ci.yml

@@ -4,7 +4,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-#      http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
@@ -62,23 +62,17 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  CARGO_BUILD_JOBS: 8
 
 jobs:
-
   skip-check:
     name: Skip Duplicate Actions
     permissions:
       actions: write
       contents: read
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     steps:
@@ -89,13 +83,15 @@ jobs:
           concurrent_skipping: "same_content_newer"
           cancel_others: true
           paths_ignore: '["*.md", "docs/**", "deploy/**"]'
+          # Never skip release events and tag pushes
           do_not_skip: '["workflow_dispatch", "schedule", "merge_group", "release", "push"]'
 
+
   typos:
     name: Typos
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - name: Typos check with custom config file
         uses: crate-ci/typos@master
@@ -104,11 +100,13 @@ jobs:
     name: Test and Lint
     needs: skip-check
     if: needs.skip-check.outputs.should_skip != 'true'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
+      - name: Delete huge unnecessary tools folder
+        run: rm -rf /opt/hostedtoolcache
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -118,9 +116,6 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - name: Install cargo-nextest
-        uses: taiki-e/install-action@nextest
-
       - name: Run tests
         run: |
           cargo nextest run --all --exclude e2e_test
@@ -136,16 +131,11 @@ jobs:
     name: End-to-End Tests
     needs: skip-check
     if: needs.skip-check.outputs.should_skip != 'true'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Clean up previous test run
-        run: |
-          rm -rf /tmp/rustfs
-          rm -f /tmp/rustfs.log
+        uses: actions/checkout@v5
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -165,8 +155,7 @@ jobs:
       - name: Build debug binary
         run: |
           touch rustfs/build.rs
-          # Limit concurrency to prevent OOM
-          cargo build -p rustfs --bins --jobs 4
+          cargo build -p rustfs --bins
 
       - name: Run end-to-end tests
         run: |

.github/workflows/docker.yml

@@ -72,7 +72,7 @@ jobs:
   # Check if we should build Docker images
   build-check:
     name: Docker Build Check
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       should_push: ${{ steps.check.outputs.should_push }}
@@ -83,7 +83,7 @@ jobs:
       create_latest: ${{ steps.check.outputs.create_latest }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           # For workflow_run events, checkout the specific commit that triggered the workflow
@@ -162,11 +162,11 @@ jobs:
                 if [[ "$version" == *"alpha"* ]] || [[ "$version" == *"beta"* ]] || [[ "$version" == *"rc"* ]]; then
                   build_type="prerelease"
                   is_prerelease=true
-                  # TODO: Temporary change - currently allows alpha versions to also create latest tags
-                  # After the version is stable, you need to remove the following line and restore the original logic (latest is created only for stable versions)
+                  # TODO: 临时修改 - 当前允许 alpha 版本也创建 latest 标签
+                  # 等版本稳定后，需要移除下面这行，恢复原有逻辑（只有稳定版本才创建 latest）
                   if [[ "$version" == *"alpha"* ]]; then
                     create_latest=true
-                     echo "🧪 Building Docker image for prerelease: $version (temporarily allowing creation of latest tag)"
+                    echo "🧪 Building Docker image for prerelease: $version (临时允许创建 latest 标签)"
                   else
                     echo "🧪 Building Docker image for prerelease: $version"
                   fi
@@ -215,11 +215,11 @@ jobs:
               v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
                 build_type="prerelease"
                 is_prerelease=true
-                # TODO: Temporary change - currently allows alpha versions to also create latest tags
-                # After the version is stable, you need to remove the if block below and restore the original logic.
+                # TODO: 临时修改 - 当前允许 alpha 版本也创建 latest 标签
+                # 等版本稳定后，需要移除下面的 if 块，恢复原有逻辑
                 if [[ "$input_version" == *"alpha"* ]]; then
                   create_latest=true
-                   echo "🧪 Building with prerelease version: $input_version (temporarily allowing creation of latest tag)"
+                  echo "🧪 Building with prerelease version: $input_version (临时允许创建 latest 标签)"
                 else
                   echo "🧪 Building with prerelease version: $input_version"
                 fi
@@ -264,11 +264,11 @@ jobs:
     name: Build Docker Images
     needs: build-check
     if: needs.build-check.outputs.should_build == 'true'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3
@@ -330,9 +330,9 @@ jobs:
 
           # Add channel tags for prereleases and latest for stable
           if [[ "$CREATE_LATEST" == "true" ]]; then
-            # TODO: Temporary change - the current alpha version will also create the latest tag
-            # After the version is stabilized, the logic here remains unchanged, but the upstream CREATE_LATEST setting needs to be restored.
-            # Stable release (and temporary alpha versions)
+            # TODO: 临时修改 - 当前 alpha 版本也会创建 latest 标签
+            # 等版本稳定后，这里的逻辑保持不变，但上游的 CREATE_LATEST 设置需要恢复
+            # Stable release (以及临时的 alpha 版本)
             TAGS="$TAGS,${{ env.REGISTRY_DOCKERHUB }}:latest"
           elif [[ "$BUILD_TYPE" == "prerelease" ]]; then
             # Prerelease channel tags (alpha, beta, rc)
@@ -404,7 +404,7 @@ jobs:
     name: Docker Build Summary
     needs: [ build-check, build-docker ]
     if: always() && needs.build-check.outputs.should_build == 'true'
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     steps:
       - name: Docker build completion summary
         run: |
@@ -429,10 +429,10 @@ jobs:
             "prerelease")
               echo "🧪 Prerelease Docker image has been built with ${VERSION} tags"
               echo "⚠️  This is a prerelease image - use with caution"
-              # TODO: Temporary change - alpha versions currently create the latest tag
-              # After the version is stable, you need to restore the following prompt information
+              # TODO: 临时修改 - alpha 版本当前会创建 latest 标签
+              # 等版本稳定后，需要恢复下面的提示信息
               if [[ "$VERSION" == *"alpha"* ]] && [[ "$CREATE_LATEST" == "true" ]]; then
-                echo "🏷️  Latest tag has been created for alpha version (temporary measures)"
+                echo "🏷️  Latest tag has been created for alpha version (临时措施)"
               else
                 echo "🚫 Latest tag NOT created for prerelease"
               fi

.github/workflows/e2e-mint.yml

@@ -1,260 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: e2e-mint
-
-on:
-  push:
-    branches: [ main ]
-    paths:
-      - ".github/workflows/e2e-mint.yml"
-      - "Dockerfile.source"
-      - "rustfs/**"
-      - "crates/**"
-  workflow_dispatch:
-    inputs:
-      run-multi:
-        description: "Run multi-node Mint as well"
-        required: false
-        default: "false"
-
-env:
-  ACCESS_KEY: rustfsadmin
-  SECRET_KEY: rustfsadmin
-  RUST_LOG: info
-  PLATFORM: linux/amd64
-
-jobs:
-  mint-single:
-    runs-on: ubicloud-standard-4
-    timeout-minutes: 40
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Enable buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build RustFS image (source)
-        run: |
-          DOCKER_BUILDKIT=1 docker buildx build --load \
-            --platform ${PLATFORM} \
-            -t rustfs-ci \
-            -f Dockerfile.source .
-
-      - name: Create network
-        run: |
-          docker network inspect rustfs-net >/dev/null 2>&1 || docker network create rustfs-net
-
-      - name: Remove existing rustfs-single (if any)
-        run: docker rm -f rustfs-single >/dev/null 2>&1 || true
-
-      - name: Start single RustFS
-        run: |
-          docker run -d --name rustfs-single \
-            --network rustfs-net \
-            -e RUSTFS_ADDRESS=0.0.0.0:9000 \
-            -e RUSTFS_ACCESS_KEY=$ACCESS_KEY \
-            -e RUSTFS_SECRET_KEY=$SECRET_KEY \
-            -e RUSTFS_VOLUMES="/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3" \
-            -v /tmp/rustfs-single:/data \
-            rustfs-ci
-
-      - name: Wait for RustFS ready
-        run: |
-          for i in {1..30}; do
-            if docker exec rustfs-single curl -sf http://localhost:9000/health >/dev/null; then
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "RustFS did not become ready" >&2
-          docker logs rustfs-single || true
-          exit 1
-
-      - name: Run Mint (single, S3-only)
-        run: |
-          mkdir -p artifacts/mint-single
-          docker run --rm --network rustfs-net \
-            --platform ${PLATFORM} \
-            -e SERVER_ENDPOINT=rustfs-single:9000 \
-            -e ACCESS_KEY=$ACCESS_KEY \
-            -e SECRET_KEY=$SECRET_KEY \
-            -e ENABLE_HTTPS=0 \
-            -e SERVER_REGION=us-east-1 \
-            -e RUN_ON_FAIL=1 \
-            -e MINT_MODE=core \
-            -v ${GITHUB_WORKSPACE}/artifacts/mint-single:/mint/log \
-            --entrypoint /mint/mint.sh \
-            minio/mint:edge \
-            awscli aws-sdk-go aws-sdk-java-v2 aws-sdk-php aws-sdk-ruby s3cmd s3select
-
-      - name: Collect RustFS logs
-        run: |
-          mkdir -p artifacts/rustfs-single
-          docker logs rustfs-single > artifacts/rustfs-single/rustfs.log || true
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: mint-single
-          path: artifacts/**
-
-  mint-multi:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run-multi == 'true'
-    needs: mint-single
-    runs-on: ubicloud-standard-4
-    timeout-minutes: 60
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Enable buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build RustFS image (source)
-        run: |
-          DOCKER_BUILDKIT=1 docker buildx build --load \
-            --platform ${PLATFORM} \
-            -t rustfs-ci \
-            -f Dockerfile.source .
-
-      - name: Prepare cluster compose
-        run: |
-          cat > compose.yml <<'EOF'
-          version: '3.8'
-          services:
-            rustfs1:
-              image: rustfs-ci
-              hostname: rustfs1
-              networks: [rustfs-net]
-              environment:
-                - RUSTFS_ADDRESS=0.0.0.0:9000
-                - RUSTFS_ACCESS_KEY=${ACCESS_KEY}
-                - RUSTFS_SECRET_KEY=${SECRET_KEY}
-                - RUSTFS_VOLUMES=/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3
-              volumes:
-                - rustfs1-data:/data
-            rustfs2:
-              image: rustfs-ci
-              hostname: rustfs2
-              networks: [rustfs-net]
-              environment:
-                - RUSTFS_ADDRESS=0.0.0.0:9000
-                - RUSTFS_ACCESS_KEY=${ACCESS_KEY}
-                - RUSTFS_SECRET_KEY=${SECRET_KEY}
-                - RUSTFS_VOLUMES=/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3
-              volumes:
-                - rustfs2-data:/data
-            rustfs3:
-              image: rustfs-ci
-              hostname: rustfs3
-              networks: [rustfs-net]
-              environment:
-                - RUSTFS_ADDRESS=0.0.0.0:9000
-                - RUSTFS_ACCESS_KEY=${ACCESS_KEY}
-                - RUSTFS_SECRET_KEY=${SECRET_KEY}
-                - RUSTFS_VOLUMES=/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3
-              volumes:
-                - rustfs3-data:/data
-            rustfs4:
-              image: rustfs-ci
-              hostname: rustfs4
-              networks: [rustfs-net]
-              environment:
-                - RUSTFS_ADDRESS=0.0.0.0:9000
-                - RUSTFS_ACCESS_KEY=${ACCESS_KEY}
-                - RUSTFS_SECRET_KEY=${SECRET_KEY}
-                - RUSTFS_VOLUMES=/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3
-              volumes:
-                - rustfs4-data:/data
-            lb:
-              image: haproxy:2.9
-              hostname: lb
-              networks: [rustfs-net]
-              ports:
-                - "9000:9000"
-              volumes:
-                - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
-          networks:
-            rustfs-net:
-              name: rustfs-net
-          volumes:
-            rustfs1-data:
-            rustfs2-data:
-            rustfs3-data:
-            rustfs4-data:
-          EOF
-
-          cat > haproxy.cfg <<'EOF'
-          defaults
-            mode http
-            timeout connect 5s
-            timeout client  30s
-            timeout server  30s
-
-          frontend fe_s3
-            bind *:9000
-            default_backend be_s3
-
-          backend be_s3
-            balance roundrobin
-            server s1 rustfs1:9000 check
-            server s2 rustfs2:9000 check
-            server s3 rustfs3:9000 check
-            server s4 rustfs4:9000 check
-          EOF
-
-      - name: Launch cluster
-        run: docker compose -f compose.yml up -d
-
-      - name: Wait for LB ready
-        run: |
-          for i in {1..60}; do
-            if docker run --rm --network rustfs-net curlimages/curl -sf http://lb:9000/health >/dev/null; then
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "LB or backend not ready" >&2
-          docker compose -f compose.yml logs --tail=200 || true
-          exit 1
-
-      - name: Run Mint (multi, S3-only)
-        run: |
-          mkdir -p artifacts/mint-multi
-          docker run --rm --network rustfs-net \
-            --platform ${PLATFORM} \
-            -e SERVER_ENDPOINT=lb:9000 \
-            -e ACCESS_KEY=$ACCESS_KEY \
-            -e SECRET_KEY=$SECRET_KEY \
-            -e ENABLE_HTTPS=0 \
-            -e SERVER_REGION=us-east-1 \
-            -e RUN_ON_FAIL=1 \
-            -e MINT_MODE=core \
-            -v ${GITHUB_WORKSPACE}/artifacts/mint-multi:/mint/log \
-            --entrypoint /mint/mint.sh \
-            minio/mint:edge \
-            awscli aws-sdk-go aws-sdk-java-v2 aws-sdk-php aws-sdk-ruby s3cmd s3select
-
-      - name: Collect logs
-        run: |
-          mkdir -p artifacts/cluster
-          docker compose -f compose.yml logs --no-color > artifacts/cluster/cluster.log || true
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: mint-multi
-          path: artifacts/**

.github/workflows/e2e-s3tests.yml

@@ -1,422 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: e2e-s3tests
-
-on:
-  workflow_dispatch:
-    inputs:
-      test-mode:
-        description: "Test mode to run"
-        required: true
-        type: choice
-        default: "single"
-        options:
-          - single
-          - multi
-      xdist:
-        description: "Enable pytest-xdist (parallel). '0' to disable."
-        required: false
-        default: "0"
-      maxfail:
-        description: "Stop after N failures (debug friendly)"
-        required: false
-        default: "1"
-      markexpr:
-        description: "pytest -m expression (feature filters)"
-        required: false
-        default: "not lifecycle and not versioning and not s3website and not bucket_logging and not encryption"
-
-env:
-  # main user
-  S3_ACCESS_KEY: rustfsadmin
-  S3_SECRET_KEY: rustfsadmin
-  # alt user (must be different from main for many s3-tests)
-  S3_ALT_ACCESS_KEY: rustfsalt
-  S3_ALT_SECRET_KEY: rustfsalt
-
-  S3_REGION: us-east-1
-
-  RUST_LOG: info
-  PLATFORM: linux/amd64
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  s3tests-single:
-    if: github.event.inputs.test-mode == 'single'
-    runs-on: ubicloud-standard-4
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Enable buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build RustFS image (source, cached)
-        run: |
-          DOCKER_BUILDKIT=1 docker buildx build --load \
-            --platform ${PLATFORM} \
-            --cache-from type=gha \
-            --cache-to type=gha,mode=max \
-            -t rustfs-ci \
-            -f Dockerfile.source .
-
-      - name: Create network
-        run: docker network inspect rustfs-net >/dev/null 2>&1 || docker network create rustfs-net
-
-      - name: Remove existing rustfs-single (if any)
-        run: docker rm -f rustfs-single >/dev/null 2>&1 || true
-
-      - name: Start single RustFS
-        run: |
-          docker run -d --name rustfs-single \
-            --network rustfs-net \
-            -p 9000:9000 \
-            -e RUSTFS_ADDRESS=0.0.0.0:9000 \
-            -e RUSTFS_ACCESS_KEY=$S3_ACCESS_KEY \
-            -e RUSTFS_SECRET_KEY=$S3_SECRET_KEY \
-            -e RUSTFS_VOLUMES="/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3" \
-            -v /tmp/rustfs-single:/data \
-            rustfs-ci
-
-      - name: Wait for RustFS ready
-        run: |
-          for i in {1..60}; do
-            if curl -sf http://127.0.0.1:9000/health >/dev/null 2>&1; then
-              echo "RustFS is ready"
-              exit 0
-            fi
-
-            if [ "$(docker inspect -f '{{.State.Running}}' rustfs-single 2>/dev/null)" != "true" ]; then
-              echo "RustFS container not running" >&2
-              docker logs rustfs-single || true
-              exit 1
-            fi
-
-            sleep 2
-          done
-
-          echo "Health check timed out" >&2
-          docker logs rustfs-single || true
-          exit 1
-
-      - name: Generate s3tests config
-        run: |
-          export S3_HOST=127.0.0.1
-          envsubst < .github/s3tests/s3tests.conf > s3tests.conf
-
-      - name: Provision s3-tests alt user (required by suite)
-        run: |
-          python3 -m pip install --user --upgrade pip awscurl
-          export PATH="$HOME/.local/bin:$PATH"
-
-          # Admin API requires AWS SigV4 signing. awscurl is used by RustFS codebase as well.
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ACCESS_KEY}" \
-            --secret_key "${S3_SECRET_KEY}" \
-            -X PUT \
-            -H 'Content-Type: application/json' \
-            -d '{"secretKey":"'"${S3_ALT_SECRET_KEY}"'","status":"enabled","policy":"readwrite"}' \
-            "http://127.0.0.1:9000/rustfs/admin/v3/add-user?accessKey=${S3_ALT_ACCESS_KEY}"
-
-          # Explicitly attach built-in policy via policy mapping.
-          # s3-tests relies on alt client being able to ListBuckets during setup cleanup.
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ACCESS_KEY}" \
-            --secret_key "${S3_SECRET_KEY}" \
-            -X PUT \
-            "http://127.0.0.1:9000/rustfs/admin/v3/set-user-or-group-policy?policyName=readwrite&userOrGroup=${S3_ALT_ACCESS_KEY}&isGroup=false"
-
-          # Sanity check: alt user can list buckets (should not be AccessDenied).
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ALT_ACCESS_KEY}" \
-            --secret_key "${S3_ALT_SECRET_KEY}" \
-            -X GET \
-            "http://127.0.0.1:9000/" >/dev/null
-
-      - name: Prepare s3-tests
-        run: |
-          python3 -m pip install --user --upgrade pip tox
-          export PATH="$HOME/.local/bin:$PATH"
-          git clone --depth 1 https://github.com/ceph/s3-tests.git s3-tests
-
-      - name: Run ceph s3-tests (debug friendly)
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          mkdir -p artifacts/s3tests-single
-
-          cd s3-tests
-
-          set -o pipefail
-
-          MAXFAIL="${{ github.event.inputs.maxfail }}"
-          if [ -z "$MAXFAIL" ]; then MAXFAIL="1"; fi
-
-          MARKEXPR="${{ github.event.inputs.markexpr }}"
-          if [ -z "$MARKEXPR" ]; then MARKEXPR="not lifecycle and not versioning and not s3website and not bucket_logging and not encryption"; fi
-
-          XDIST="${{ github.event.inputs.xdist }}"
-          if [ -z "$XDIST" ]; then XDIST="0"; fi
-          XDIST_ARGS=""
-          if [ "$XDIST" != "0" ]; then
-            # Add pytest-xdist to requirements.txt so tox installs it inside
-            # its virtualenv. Installing outside tox does NOT work.
-            echo "pytest-xdist" >> requirements.txt
-            XDIST_ARGS="-n $XDIST --dist=loadgroup"
-          fi
-
-          # Run tests from s3tests/functional (boto2+boto3 combined directory).
-          S3TEST_CONF=${GITHUB_WORKSPACE}/s3tests.conf \
-            tox -- \
-              -vv -ra --showlocals --tb=long \
-              --maxfail="$MAXFAIL" \
-              --junitxml=${GITHUB_WORKSPACE}/artifacts/s3tests-single/junit.xml \
-              $XDIST_ARGS \
-              s3tests/functional/test_s3.py \
-              -m "$MARKEXPR" \
-              2>&1 | tee ${GITHUB_WORKSPACE}/artifacts/s3tests-single/pytest.log
-
-      - name: Collect RustFS logs
-        if: always()
-        run: |
-          mkdir -p artifacts/rustfs-single
-          docker logs rustfs-single > artifacts/rustfs-single/rustfs.log 2>&1 || true
-          docker inspect rustfs-single > artifacts/rustfs-single/inspect.json || true
-
-      - name: Upload artifacts
-        if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: s3tests-single
-          path: artifacts/**
-
-  s3tests-multi:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.test-mode == 'multi'
-    runs-on: ubicloud-standard-4
-    timeout-minutes: 150
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Enable buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build RustFS image (source, cached)
-        run: |
-          DOCKER_BUILDKIT=1 docker buildx build --load \
-            --platform ${PLATFORM} \
-            --cache-from type=gha \
-            --cache-to type=gha,mode=max \
-            -t rustfs-ci \
-            -f Dockerfile.source .
-
-      - name: Prepare cluster compose
-        run: |
-          cat > compose.yml <<'EOF'
-          services:
-            rustfs1:
-              image: rustfs-ci
-              hostname: rustfs1
-              networks: [rustfs-net]
-              environment:
-                RUSTFS_ADDRESS: "0.0.0.0:9000"
-                RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY}
-                RUSTFS_SECRET_KEY: ${S3_SECRET_KEY}
-                RUSTFS_VOLUMES: "/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3"
-              volumes:
-                - rustfs1-data:/data
-            rustfs2:
-              image: rustfs-ci
-              hostname: rustfs2
-              networks: [rustfs-net]
-              environment:
-                RUSTFS_ADDRESS: "0.0.0.0:9000"
-                RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY}
-                RUSTFS_SECRET_KEY: ${S3_SECRET_KEY}
-                RUSTFS_VOLUMES: "/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3"
-              volumes:
-                - rustfs2-data:/data
-            rustfs3:
-              image: rustfs-ci
-              hostname: rustfs3
-              networks: [rustfs-net]
-              environment:
-                RUSTFS_ADDRESS: "0.0.0.0:9000"
-                RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY}
-                RUSTFS_SECRET_KEY: ${S3_SECRET_KEY}
-                RUSTFS_VOLUMES: "/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3"
-              volumes:
-                - rustfs3-data:/data
-            rustfs4:
-              image: rustfs-ci
-              hostname: rustfs4
-              networks: [rustfs-net]
-              environment:
-                RUSTFS_ADDRESS: "0.0.0.0:9000"
-                RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY}
-                RUSTFS_SECRET_KEY: ${S3_SECRET_KEY}
-                RUSTFS_VOLUMES: "/data/rustfs0 /data/rustfs1 /data/rustfs2 /data/rustfs3"
-              volumes:
-                - rustfs4-data:/data
-            lb:
-              image: haproxy:2.9
-              hostname: lb
-              networks: [rustfs-net]
-              ports:
-                - "9000:9000"
-              volumes:
-                - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
-          networks:
-            rustfs-net:
-              name: rustfs-net
-          volumes:
-            rustfs1-data:
-            rustfs2-data:
-            rustfs3-data:
-            rustfs4-data:
-          EOF
-
-          cat > haproxy.cfg <<'EOF'
-          defaults
-            mode http
-            timeout connect 5s
-            timeout client  30s
-            timeout server  30s
-
-          frontend fe_s3
-            bind *:9000
-            default_backend be_s3
-
-          backend be_s3
-            balance roundrobin
-            server s1 rustfs1:9000 check
-            server s2 rustfs2:9000 check
-            server s3 rustfs3:9000 check
-            server s4 rustfs4:9000 check
-          EOF
-
-      - name: Launch cluster
-        run: docker compose -f compose.yml up -d
-
-      - name: Wait for LB ready
-        run: |
-          for i in {1..90}; do
-            if curl -sf http://127.0.0.1:9000/health >/dev/null 2>&1; then
-              echo "Load balancer is ready"
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "LB or backend not ready" >&2
-          docker compose -f compose.yml logs --tail=200 || true
-          exit 1
-
-      - name: Generate s3tests config
-        run: |
-          export S3_HOST=127.0.0.1
-          envsubst < .github/s3tests/s3tests.conf > s3tests.conf
-
-      - name: Provision s3-tests alt user (required by suite)
-        run: |
-          python3 -m pip install --user --upgrade pip awscurl
-          export PATH="$HOME/.local/bin:$PATH"
-
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ACCESS_KEY}" \
-            --secret_key "${S3_SECRET_KEY}" \
-            -X PUT \
-            -H 'Content-Type: application/json' \
-            -d '{"secretKey":"'"${S3_ALT_SECRET_KEY}"'","status":"enabled","policy":"readwrite"}' \
-            "http://127.0.0.1:9000/rustfs/admin/v3/add-user?accessKey=${S3_ALT_ACCESS_KEY}"
-
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ACCESS_KEY}" \
-            --secret_key "${S3_SECRET_KEY}" \
-            -X PUT \
-            "http://127.0.0.1:9000/rustfs/admin/v3/set-user-or-group-policy?policyName=readwrite&userOrGroup=${S3_ALT_ACCESS_KEY}&isGroup=false"
-
-          awscurl \
-            --service s3 \
-            --region "${S3_REGION}" \
-            --access_key "${S3_ALT_ACCESS_KEY}" \
-            --secret_key "${S3_ALT_SECRET_KEY}" \
-            -X GET \
-            "http://127.0.0.1:9000/" >/dev/null
-
-      - name: Prepare s3-tests
-        run: |
-          python3 -m pip install --user --upgrade pip tox
-          export PATH="$HOME/.local/bin:$PATH"
-          git clone --depth 1 https://github.com/ceph/s3-tests.git s3-tests
-
-      - name: Run ceph s3-tests (multi, debug friendly)
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          mkdir -p artifacts/s3tests-multi
-
-          cd s3-tests
-
-          set -o pipefail
-
-          MAXFAIL="${{ github.event.inputs.maxfail }}"
-          if [ -z "$MAXFAIL" ]; then MAXFAIL="1"; fi
-
-          MARKEXPR="${{ github.event.inputs.markexpr }}"
-          if [ -z "$MARKEXPR" ]; then MARKEXPR="not lifecycle and not versioning and not s3website and not bucket_logging and not encryption"; fi
-
-          XDIST="${{ github.event.inputs.xdist }}"
-          if [ -z "$XDIST" ]; then XDIST="0"; fi
-          XDIST_ARGS=""
-          if [ "$XDIST" != "0" ]; then
-            # Add pytest-xdist to requirements.txt so tox installs it inside
-            # its virtualenv. Installing outside tox does NOT work.
-            echo "pytest-xdist" >> requirements.txt
-            XDIST_ARGS="-n $XDIST --dist=loadgroup"
-          fi
-
-          # Run tests from s3tests/functional (boto2+boto3 combined directory).
-          S3TEST_CONF=${GITHUB_WORKSPACE}/s3tests.conf \
-            tox -- \
-              -vv -ra --showlocals --tb=long \
-              --maxfail="$MAXFAIL" \
-              --junitxml=${GITHUB_WORKSPACE}/artifacts/s3tests-multi/junit.xml \
-              $XDIST_ARGS \
-              s3tests/functional/test_s3.py \
-              -m "$MARKEXPR" \
-              2>&1 | tee ${GITHUB_WORKSPACE}/artifacts/s3tests-multi/pytest.log
-
-      - name: Collect logs
-        if: always()
-        run: |
-          mkdir -p artifacts/cluster
-          docker compose -f compose.yml logs --no-color > artifacts/cluster/cluster.log 2>&1 || true
-
-      - name: Upload artifacts
-        if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: s3tests-multi
-          path: artifacts/**

.github/workflows/helm-package.yml

@@ -1,95 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Publish helm chart to artifacthub
-
-on:
-  workflow_run:
-    workflows: [ "Build and Release" ]
-    types: [ completed ]
-
-permissions:
-  contents: read
-
-env:
-  new_version: ${{ github.event.workflow_run.head_branch }}
-
-jobs:
-  build-helm-package:
-    runs-on: ubicloud-standard-4
-    # Only run on successful builds triggered by tag pushes (version format: x.y.z or x.y.z-suffix)
-    if: |
-      github.event.workflow_run.conclusion == 'success' && 
-      github.event.workflow_run.event == 'push' &&
-      contains(github.event.workflow_run.head_branch, '.')
-
-    steps:
-      - name: Checkout helm chart repo
-        uses: actions/checkout@v6
-
-      - name: Replace chart app version
-        run: |
-          set -e
-          set -x
-          old_version=$(grep "^appVersion:" helm/rustfs/Chart.yaml | awk '{print $2}')
-          sed -i "s/$old_version/$new_version/g" helm/rustfs/Chart.yaml
-          sed  -i "/^image:/,/^[^ ]/ s/tag:.*/tag: "$new_version"/" helm/rustfs/values.yaml
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4.3.0
-
-      - name: Package Helm Chart
-        run: |
-          cp helm/README.md helm/rustfs/
-          package_version=$(echo $new_version | awk -F '-' '{print $2}' | awk -F '.' '{print $NF}') 
-          helm package ./helm/rustfs --destination helm/rustfs/ --version "0.0.$package_version"
-
-      - name: Upload helm package as artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: helm-package
-          path: helm/rustfs/*.tgz
-          retention-days: 1
-
-  publish-helm-package:
-    runs-on: ubicloud-standard-4
-    needs: [ build-helm-package ]
-
-    steps:
-      - name: Checkout helm package repo
-        uses: actions/checkout@v6
-        with:
-          repository: rustfs/helm
-          token: ${{ secrets.RUSTFS_HELM_PACKAGE }}
-
-      - name: Download helm package
-        uses: actions/download-artifact@v4
-        with:
-          name: helm-package
-          path: ./
-
-      - name: Set up helm
-        uses: azure/setup-helm@v4.3.0
-
-      - name: Generate index
-        run: helm repo index . --url https://charts.rustfs.com
-
-      - name: Push helm package and index file
-        run: |
-          git config --global user.name "${{ secrets.USERNAME }}"
-          git config --global user.email "${{ secrets.EMAIL_ADDRESS }}"
-          git status .
-          git add .
-          git commit -m "Update rustfs helm package with $new_version."
-          git push origin main

.github/workflows/issue-translator.yml

@@ -25,7 +25,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     steps:
       - uses: usthe/issues-translate-action@v2.7
         with:

.github/workflows/performance.yml

@@ -40,11 +40,11 @@ env:
 jobs:
   performance-profile:
     name: Performance Profiling
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -115,11 +115,11 @@ jobs:
 
   benchmark:
     name: Benchmark Tests
-    runs-on: ubicloud-standard-4
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup

.gitignore

@@ -2,7 +2,6 @@
 .DS_Store
 .idea
 .vscode
-.direnv/
 /test
 /logs
 /data
@@ -24,13 +23,4 @@ profile.json
 *.go
 *.pb
 *.svg
-deploy/logs/*.log.*
-
-# s3-tests local artifacts (root directory only)
-/s3-tests/
-/s3-tests-local/
-/s3tests.conf
-/s3tests.conf.*
-*.events
-*.audit
-*.snappy
+deploy/logs/*.log.*

.pre-commit-config.yaml

@@ -1,32 +0,0 @@
-# See https://pre-commit.com for more information
-# See https://pre-commit.com/hooks.html for more hooks
-repos:
-  - repo: local
-    hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo fmt --all --check
-        language: system
-        types: [rust]
-        pass_filenames: false
-
-      - id: cargo-clippy
-        name: cargo clippy
-        entry: cargo clippy --all-targets --all-features -- -D warnings
-        language: system
-        types: [rust]
-        pass_filenames: false
-
-      - id: cargo-check
-        name: cargo check
-        entry: cargo check --all-targets
-        language: system
-        types: [rust]
-        pass_filenames: false
-
-      - id: cargo-test
-        name: cargo test
-        entry: bash -c 'cargo test --workspace --exclude e2e_test && cargo test --all --doc'
-        language: system
-        types: [rust]
-        pass_filenames: false

.vscode/launch.json

@@ -1,31 +1,9 @@
 {
+    // 使用 IntelliSense 了解相关属性。 
+    // 悬停以查看现有属性的描述。
+    // 欲了解更多信息，请访问: https://go.microsoft.com/fwlink/?linkid=830387
     "version": "0.2.0",
     "configurations": [
-          {
-            "type": "lldb",
-            "request": "launch",
-            "name": "Debug(only) executable 'rustfs'",
-            "env": {
-              "RUST_LOG": "rustfs=info,ecstore=info,s3s=info,iam=info",
-              "RUSTFS_SKIP_BACKGROUND_TASK": "on"
-              //"RUSTFS_OBS_LOG_DIRECTORY": "./deploy/logs",
-              // "RUSTFS_POLICY_PLUGIN_URL":"http://localhost:8181/v1/data/rustfs/authz/allow",
-              // "RUSTFS_POLICY_PLUGIN_AUTH_TOKEN":"your-opa-token"
-            },
-            "program": "${workspaceFolder}/target/debug/rustfs",
-            "args": [
-              "--access-key",
-              "rustfsadmin",
-              "--secret-key",
-              "rustfsadmin",
-              "--address",
-              "0.0.0.0:9010",
-              "--server-domains",
-              "127.0.0.1:9010",
-              "./target/volume/test{1...4}"
-            ],
-            "cwd": "${workspaceFolder}"
-        },
         {
             "type": "lldb",
             "request": "launch",
@@ -44,7 +22,6 @@
             "env": {
                 "RUST_LOG": "rustfs=debug,ecstore=info,s3s=debug,iam=debug",
                 "RUSTFS_SKIP_BACKGROUND_TASK": "on",
-                //"RUSTFS_OBS_LOG_DIRECTORY": "./deploy/logs",
                 // "RUSTFS_POLICY_PLUGIN_URL":"http://localhost:8181/v1/data/rustfs/authz/allow",
                 // "RUSTFS_POLICY_PLUGIN_AUTH_TOKEN":"your-opa-token" 
             },
@@ -89,8 +66,12 @@
                     "test",
                     "--no-run",
                     "--lib",
-                    "--package=rustfs-ecstore"
-                ]
+                    "--package=ecstore"
+                ],
+                "filter": {
+                    "name": "ecstore",
+                    "kind": "lib"
+                }
             },
             "args": [],
             "cwd": "${workspaceFolder}"
@@ -104,19 +85,6 @@
             "cwd": "${workspaceFolder}",
             //"stopAtEntry": false,
             //"preLaunchTask": "cargo build",
-            "env": {
-                "RUSTFS_ACCESS_KEY": "rustfsadmin",
-                "RUSTFS_SECRET_KEY": "rustfsadmin",
-                "RUSTFS_VOLUMES": "./target/volume/test{1...4}",
-                "RUSTFS_ADDRESS": ":9000",
-                "RUSTFS_CONSOLE_ENABLE": "true",
-                // "RUSTFS_OBS_TRACE_ENDPOINT": "http://127.0.0.1:4318/v1/traces", // jeager otlp http endpoint
-                // "RUSTFS_OBS_METRIC_ENDPOINT": "http://127.0.0.1:4318/v1/metrics", // default otlp http endpoint
-                // "RUSTFS_OBS_LOG_ENDPOINT": "http://127.0.0.1:4318/v1/logs", // default otlp http endpoint
-                // "RUSTFS_COMPRESS_ENABLE": "true",
-                "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
-                "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
-            },
             "sourceLanguages": [
                 "rust"
             ],

AGENTS.md

@@ -2,7 +2,6 @@
 
 ## Communication Rules
 - Respond to the user in Chinese; use English in all other contexts.
-- Code and documentation must be written in English only. Chinese text is allowed solely as test data/fixtures when a case explicitly requires Chinese-language content for validation.
 
 ## Project Structure & Module Organization
 The workspace root hosts shared dependencies in `Cargo.toml`. The service binary lives under `rustfs/src/main.rs`, while reusable crates sit in `crates/` (`crypto`, `iam`, `kms`, and `e2e_test`). Local fixtures for standalone flows reside in `test_standalone/`, deployment manifests are under `deploy/`, Docker assets sit at the root, and automation lives in `scripts/`. Skim each crate’s README or module docs before contributing changes.

CONTRIBUTING.md

@@ -2,8 +2,6 @@
 
 ## 📋 Code Quality Requirements
 
-For instructions on setting up and running the local development environment, please see [Development Guide](docs/DEVELOPMENT.md).
-
 ### 🔧 Code Formatting Rules
 
 **MANDATORY**: All code must be properly formatted before committing. This project enforces strict formatting standards to maintain code consistency and readability.

Cargo.toml

@@ -97,19 +97,18 @@ async-channel = "2.5.0"
 async-compression = { version = "0.4.19" }
 async-recursion = "1.1.1"
 async-trait = "0.1.89"
-axum = "0.8.7"
-axum-extra = "0.12.2"
-axum-server = { version = "0.8.0", features = ["tls-rustls-no-provider"], default-features = false }
+axum = "0.8.6"
+axum-extra = "0.12.1"
+axum-server = { version = "0.7.2", features = ["tls-rustls-no-provider"], default-features = false }
 futures = "0.3.31"
 futures-core = "0.3.31"
 futures-util = "0.3.31"
-pollster = "0.4.0"
-hyper = { version = "1.8.1", features = ["http2", "http1", "server"] }
+hyper = { version = "1.7.0", features = ["http2", "http1", "server"] }
 hyper-rustls = { version = "0.27.7", default-features = false, features = ["native-tokio", "http1", "tls12", "logging", "http2", "ring", "webpki-roots"] }
-hyper-util = { version = "0.1.19", features = ["tokio", "server-auto", "server-graceful"] }
-http = "1.4.0"
+hyper-util = { version = "0.1.17", features = ["tokio", "server-auto", "server-graceful"] }
+http = "1.3.1"
 http-body = "1.0.1"
-reqwest = { version = "0.12.26", default-features = false, features = ["rustls-tls-webpki-roots", "charset", "http2", "system-proxy", "stream", "json", "blocking"] }
+reqwest = { version = "0.12.24", default-features = false, features = ["rustls-tls-webpki-roots", "charset", "http2", "system-proxy", "stream", "json", "blocking"] }
 socket2 = "0.6.1"
 tokio = { version = "1.48.0", features = ["fs", "rt-multi-thread"] }
 tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "tls12", "ring"] }
@@ -120,40 +119,42 @@ tonic = { version = "0.14.2", features = ["gzip"] }
 tonic-prost = { version = "0.14.2" }
 tonic-prost-build = { version = "0.14.2" }
 tower = { version = "0.5.2", features = ["timeout"] }
-tower-http = { version = "0.6.8", features = ["cors"] }
+tower-http = { version = "0.6.6", features = ["cors"] }
 
 # Serialization and Data Formats
-bytes = { version = "1.11.0", features = ["serde"] }
-bytesize = "2.3.1"
+bytes = { version = "1.10.1", features = ["serde"] }
+bytesize = "2.1.0"
 byteorder = "1.5.0"
 flatbuffers = "25.9.23"
 form_urlencoded = "1.2.2"
 prost = "0.14.1"
-quick-xml = "0.38.4"
-rmcp = { version = "0.12.0" }
+quick-xml = "0.38.3"
+rmcp = { version = "0.8.4" }
 rmp = { version = "0.8.14" }
 rmp-serde = { version = "1.3.0" }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.145", features = ["raw_value"] }
 serde_urlencoded = "0.7.1"
-schemars = "1.1.0"
+schemars = "1.0.5"
 
 # Cryptography and Security
-aes-gcm = { version = "0.11.0-rc.2", features = ["rand_core"] }
-argon2 = { version = "0.6.0-rc.5" }
-blake3 = { version = "1.8.2", features = ["rayon", "mmap"] }
-chacha20poly1305 = { version = "0.11.0-rc.2" }
-crc-fast = "1.6.0"
-hmac = { version = "0.13.0-rc.3" }
-jsonwebtoken = { version = "10.2.0", features = ["rust_crypto"] }
-pbkdf2 = "0.13.0-rc.5"
-rsa = { version = "0.10.0-rc.10" }
+aes-gcm = { version = "0.10.3", features = ["std"] }
+argon2 = { version = "0.5.3", features = ["std"] }
+blake3 = { version = "1.8.2" }
+chacha20poly1305 = { version = "0.10.1" }
+crc-fast = "1.3.0"
+crc32c = "0.6.8"
+crc32fast = "1.5.0"
+crc64fast-nvme = "1.2.0"
+hmac = "0.12.1"
+jsonwebtoken = { version = "10.1.0", features = ["rust_crypto"] }
+pbkdf2 = "0.12.2"
+rsa = { version = "0.9.8" }
 rustls = { version = "0.23.35", features = ["ring", "logging", "std", "tls12"], default-features = false }
 rustls-pemfile = "2.2.0"
-rustls-pki-types = "1.13.2"
-sha1 = "0.11.0-rc.3"
-sha2 = "0.11.0-rc.3"
-subtle = "2.6"
+rustls-pki-types = "1.13.0"
+sha1 = "0.10.6"
+sha2 = "0.10.9"
 zeroize = { version = "1.8.2", features = ["derive"] }
 
 # Time and Date
@@ -167,41 +168,42 @@ arc-swap = "1.7.1"
 astral-tokio-tar = "0.5.6"
 atoi = "2.0.0"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.8.12" }
-aws-credential-types = { version = "1.2.11" }
-aws-sdk-s3 = { version = "1.117.0", default-features = false, features = ["sigv4a", "rustls", "rt-tokio"] }
-aws-smithy-types = { version = "1.3.5" }
+aws-config = { version = "1.8.10" }
+aws-credential-types = { version = "1.2.8" }
+aws-sdk-s3 = { version = "1.110.0", default-features = false, features = ["sigv4a", "rustls", "rt-tokio"] }
+aws-smithy-types = { version = "1.3.4" }
 base64 = "0.22.1"
 base64-simd = "0.8.0"
 brotli = "8.0.2"
 cfg-if = "1.0.4"
-clap = { version = "4.5.53", features = ["derive", "env"] }
-const-str = { version = "0.7.1", features = ["std", "proc"] }
-convert_case = "0.10.0"
-criterion = { version = "0.8", features = ["html_reports"] }
+clap = { version = "4.5.51", features = ["derive", "env"] }
+const-str = { version = "0.7.0", features = ["std", "proc"] }
+convert_case = "0.8.0"
+criterion = { version = "0.7", features = ["html_reports"] }
 crossbeam-queue = "0.3.12"
-datafusion = "51.0.0"
+datafusion = "50.3.0"
 derive_builder = "0.20.2"
 enumset = "1.1.10"
-faster-hex = "0.10.0"
 flate2 = "1.1.5"
-flexi_logger = { version = "0.31.7", features = ["trc", "dont_minimize_extra_stacks", "compress", "kv", "json"] }
+flexi_logger = { version = "0.31.7", features = ["trc", "dont_minimize_extra_stacks", "compress", "kv"] }
 glob = "0.3.3"
-google-cloud-storage = "1.5.0"
-google-cloud-auth = "1.3.0"
-hashbrown = { version = "0.16.1", features = ["serde", "rayon"] }
+google-cloud-storage = "1.2.0"
+google-cloud-auth = "1.1.0"
+hashbrown = { version = "0.16.0", features = ["serde", "rayon"] }
 heed = { version = "0.22.0" }
 hex-simd = "0.8.0"
 highway = { version = "1.3.0" }
 ipnetwork = { version = "0.21.1", features = ["serde"] }
 lazy_static = "1.5.0"
-libc = "0.2.178"
-libsystemd = "0.7.2"
-local-ip-address = "0.6.8"
+libc = "0.2.177"
+libsystemd = { version = "0.7.2" }
+local-ip-address = "0.6.5"
 lz4 = "1.28.1"
 matchit = "0.9.0"
-md-5 = "0.11.0-rc.3"
+md-5 = "0.10.6"
 md5 = "0.8.0"
+metrics = "0.24.2"
+metrics-exporter-opentelemetry = "0.1.2"
 mime_guess = "2.0.5"
 moka = { version = "0.12.11", features = ["future"] }
 netif = "0.1.6"
@@ -210,19 +212,21 @@ nu-ansi-term = "0.50.3"
 num_cpus = { version = "1.17.0" }
 nvml-wrapper = "0.11.0"
 object_store = "0.12.4"
+once_cell = "1.21.3"
 parking_lot = "0.12.5"
 path-absolutize = "3.1.1"
 path-clean = "1.0.1"
 pin-project-lite = "0.2.16"
 pretty_assertions = "1.4.1"
-rand = { version = "0.10.0-rc.5", features = ["serde"] }
+rand = "0.9.2"
 rayon = "1.11.0"
 reed-solomon-simd = { version = "3.1.0" }
 regex = { version = "1.12.2" }
-rumqttc = { version = "0.25.1" }
+rumqttc = { version = "0.25.0" }
 rust-embed = { version = "8.9.0" }
 rustc-hash = { version = "2.1.1" }
-s3s = { version = "0.12.0-rc.6", features = ["minio"], git = "https://github.com/s3s-project/s3s.git", branch = "main" }
+s3s = { version = "0.12.0-rc.3", features = ["minio"] }
+scopeguard = "1.2.0"
 serial_test = "3.2.0"
 shadow-rs = { version = "1.4.0", default-features = false }
 siphasher = "1.0.1"
@@ -230,7 +234,7 @@ smallvec = { version = "1.15.1", features = ["serde"] }
 smartstring = "1.0.1"
 snafu = "0.8.9"
 snap = "1.1.1"
-starshard = { version = "0.6.0", features = ["rayon", "async", "serde"] }
+starshard = { version = "0.5.0", features = ["rayon", "async", "serde"] }
 strum = { version = "0.27.2", features = ["derive"] }
 sysctl = "0.7.1"
 sysinfo = "0.37.2"
@@ -238,34 +242,32 @@ temp-env = "0.3.6"
 tempfile = "3.23.0"
 test-case = "3.3.1"
 thiserror = "2.0.17"
-tracing = { version = "0.1.44" }
-tracing-appender = "0.2.4"
+tracing = { version = "0.1.41" }
+tracing-appender = "0.2.3"
 tracing-error = "0.2.1"
 tracing-opentelemetry = "0.32.0"
-tracing-subscriber = { version = "0.3.22", features = ["env-filter", "time"] }
+tracing-subscriber = { version = "0.3.20", features = ["env-filter", "time"] }
 transform-stream = "0.3.1"
 url = "2.5.7"
 urlencoding = "2.1.3"
-uuid = { version = "1.19.0", features = ["v4", "fast-rng", "macro-diagnostics"] }
+uuid = { version = "1.18.1", features = ["v4", "fast-rng", "macro-diagnostics"] }
 vaultrs = { version = "0.7.4" }
 walkdir = "2.5.0"
-wildmatch = { version = "2.6.1", features = ["serde"] }
+wildmatch = { version = "2.5.0", features = ["serde"] }
 winapi = { version = "0.3.9" }
 xxhash-rust = { version = "0.8.15", features = ["xxh64", "xxh3"] }
 zip = "6.0.0"
 zstd = "0.13.3"
 
 # Observability and Metrics
-metrics = "0.24.3"
 opentelemetry = { version = "0.31.0" }
 opentelemetry-appender-tracing = { version = "0.31.1", features = ["experimental_use_tracing_span_context", "experimental_metadata_attributes", "spec_unstable_logs_enabled"] }
-opentelemetry-otlp = { version = "0.31.0", features = ["gzip-http", "reqwest-rustls"] }
+opentelemetry-otlp = { version = "0.31.0", default-features = false, features = ["grpc-tonic", "gzip-tonic", "trace", "metrics", "logs", "internal-logs"] }
 opentelemetry_sdk = { version = "0.31.0" }
 opentelemetry-semantic-conventions = { version = "0.31.0", features = ["semconv_experimental"] }
 opentelemetry-stdout = { version = "0.31.0" }
 
 # Performance Analysis and Memory Profiling
-mimalloc = "0.1"
 # Use tikv-jemallocator as memory allocator and enable performance analysis
 tikv-jemallocator = { version = "0.6", features = ["profiling", "stats", "unprefixed_malloc_on_supported_platforms", "background_threads"] }
 # Used to control and obtain statistics for jemalloc at runtime
@@ -274,11 +276,11 @@ tikv-jemalloc-ctl = { version = "0.6", features = ["use_std", "stats", "profilin
 jemalloc_pprof = { version = "0.8.1", features = ["symbolize", "flamegraph"] }
 # Used to generate CPU performance analysis data and flame diagrams
 pprof = { version = "0.15.0", features = ["flamegraph", "protobuf-codec"] }
-
+mimalloc = "0.1"
 
 
 [workspace.metadata.cargo-shear]
-ignored = ["rustfs", "rustfs-mcp"]
+ignored = ["rustfs", "rustfs-mcp", "tokio-test", "scopeguard"]
 
 [profile.release]
 opt-level = 3

Dockerfile

@@ -64,12 +64,8 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /build/rustfs /usr/bin/rustfs
 COPY entrypoint.sh /entrypoint.sh
 
-RUN chmod +x /usr/bin/rustfs /entrypoint.sh
-
-RUN addgroup -g 10001 -S rustfs && \
-    adduser -u 10001 -G rustfs -S rustfs -D && \
+RUN chmod +x /usr/bin/rustfs /entrypoint.sh && \
     mkdir -p /data /logs && \
-    chown -R rustfs:rustfs /data /logs && \
     chmod 0750 /data /logs
 
 ENV RUSTFS_ADDRESS=":9000" \
@@ -81,13 +77,12 @@ ENV RUSTFS_ADDRESS=":9000" \
     RUSTFS_CORS_ALLOWED_ORIGINS="*" \
     RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
     RUSTFS_VOLUMES="/data" \
-    RUST_LOG="warn"
-    
+    RUST_LOG="warn" \
+    RUSTFS_OBS_LOG_DIRECTORY="/logs" \
+    RUSTFS_SINKS_FILE_PATH="/logs"
+
 EXPOSE 9000 9001
-
-VOLUME ["/data"]
-
-USER rustfs
+VOLUME ["/data", "/logs"]
 
 ENTRYPOINT ["/entrypoint.sh"]
 

Dockerfile.source

@@ -39,9 +39,7 @@ RUN set -eux; \
     libssl-dev \
     lld \
     protobuf-compiler \
-    flatbuffers-compiler \
-    gcc-aarch64-linux-gnu \
-    gcc-x86-64-linux-gnu; \
+    flatbuffers-compiler; \
     rm -rf /var/lib/apt/lists/*
 
 # Optional: cross toolchain for aarch64 (only when targeting linux/arm64)
@@ -53,18 +51,18 @@ RUN set -eux; \
     rm -rf /var/lib/apt/lists/*; \
     fi
 
-# Add Rust targets for both arches (to support cross-builds on multi-arch runners)
+# Add Rust targets based on TARGETPLATFORM
 RUN set -eux; \
-    rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; \
-    rustup component add rust-std-x86_64-unknown-linux-gnu rust-std-aarch64-unknown-linux-gnu
+    case "${TARGETPLATFORM:-linux/amd64}" in \
+    linux/amd64) rustup target add x86_64-unknown-linux-gnu ;; \
+    linux/arm64) rustup target add aarch64-unknown-linux-gnu ;; \
+    *) echo "Unsupported TARGETPLATFORM=${TARGETPLATFORM}" >&2; exit 1 ;; \
+    esac
 
 # Cross-compilation environment (used only when targeting aarch64)
 ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
 ENV CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
 ENV CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++
-ENV CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc
-ENV CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc
-ENV CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++
 
 WORKDIR /usr/src/rustfs
 
@@ -74,6 +72,7 @@ COPY Cargo.toml Cargo.lock ./
 # 2) workspace member manifests (adjust if workspace layout changes)
 COPY rustfs/Cargo.toml rustfs/Cargo.toml
 COPY crates/*/Cargo.toml crates/
+COPY cli/rustfs-gui/Cargo.toml cli/rustfs-gui/Cargo.toml
 
 # Pre-fetch dependencies for better caching
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
@@ -118,49 +117,6 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     ;; \
     esac
 
-# -----------------------------
-# Development stage (keeps toolchain)
-# -----------------------------
-FROM builder AS dev
-
-ARG BUILD_DATE
-ARG VCS_REF
-
-LABEL name="RustFS (dev-source)" \
-    maintainer="RustFS Team" \
-    build-date="${BUILD_DATE}" \
-    vcs-ref="${VCS_REF}" \
-    description="RustFS - local development with Rust toolchain."
-
-# Install runtime dependencies that might be missing in partial builder
-# (builder already has build-essential, lld, etc.)
-WORKDIR /app
-
-ENV CARGO_INCREMENTAL=1
-
-# Ensure we have the same default env vars available
-ENV RUSTFS_ADDRESS=":9000" \
-    RUSTFS_ACCESS_KEY="rustfsadmin" \
-    RUSTFS_SECRET_KEY="rustfsadmin" \
-    RUSTFS_CONSOLE_ENABLE="true" \
-    RUSTFS_VOLUMES="/data" \
-    RUST_LOG="warn" \
-    RUSTFS_OBS_LOG_DIRECTORY="/logs" \
-    RUSTFS_USERNAME="rustfs" \
-    RUSTFS_GROUPNAME="rustfs" \
-    RUSTFS_UID="1000" \
-    RUSTFS_GID="1000"
-
-# Note: We don't COPY source here because we expect it to be mounted at /app
-# We rely on cargo run to build and run
-EXPOSE 9000 9001
-
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-ENTRYPOINT ["/entrypoint.sh"]
-CMD ["cargo", "run", "--bin", "rustfs", "--"]
-
 # -----------------------------
 # Runtime stage (Ubuntu minimal)
 # -----------------------------
@@ -210,13 +166,15 @@ ENV RUSTFS_ADDRESS=":9000" \
     RUSTFS_CONSOLE_ENABLE="true" \
     RUSTFS_VOLUMES="/data" \
     RUST_LOG="warn" \
+    RUSTFS_OBS_LOG_DIRECTORY="/logs" \
+    RUSTFS_SINKS_FILE_PATH="/logs" \
     RUSTFS_USERNAME="rustfs" \
     RUSTFS_GROUPNAME="rustfs" \
     RUSTFS_UID="1000" \
     RUSTFS_GID="1000"
 
 EXPOSE 9000
-VOLUME ["/data"]
+VOLUME ["/data", "/logs"]
 
 # Keep root here; entrypoint will drop privileges using chroot --userspec
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -1,6 +1,6 @@
 [![RustFS](https://rustfs.com/images/rustfs-github.png)](https://rustfs.com)
 
-<p align="center">RustFS is a high-performance, distributed object storage system built in Rust.</p>
+<p align="center">RustFS is a high-performance distributed object storage software built using Rust</p>
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <a href="https://docs.rustfs.com/installation/">Getting Started</a>
+  <a href="https://docs.rustfs.com/introduction.html">Getting Started</a>
   · <a href="https://docs.rustfs.com/">Docs</a>
   · <a href="https://github.com/rustfs/rustfs/issues">Bug reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">Discussions</a>
@@ -19,6 +19,7 @@
 
 <p align="center">
 English | <a href="https://github.com/rustfs/rustfs/blob/main/README_ZH.md">简体中文</a> |
+  <!-- Keep these links. Translations will automatically update with the README. -->
   <a href="https://readme-i18n.com/rustfs/rustfs?lang=de">Deutsch</a> |
   <a href="https://readme-i18n.com/rustfs/rustfs?lang=es">Español</a> |
   <a href="https://readme-i18n.com/rustfs/rustfs?lang=fr">français</a> |
@@ -28,196 +29,172 @@ English | <a href="https://github.com/rustfs/rustfs/blob/main/README_ZH.md">简
   <a href="https://readme-i18n.com/rustfs/rustfs?lang=ru">Русский</a>
 </p>
 
-RustFS is a high-performance, distributed object storage system built in Rust—one of the most loved programming languages worldwide. RustFS combines the simplicity of MinIO with the memory safety and raw performance of Rust. It offers full S3 compatibility, is completely open-source, and is optimized for data lakes, AI, and big data workloads.
+RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages
+worldwide. Along with MinIO, it shares a range of advantages such as simplicity, S3 compatibility, open-source nature,
+support for data lakes, AI, and big data. Furthermore, it has a better and more user-friendly open-source license in
+comparison to other storage systems, being constructed under the Apache license. As Rust serves as its foundation,
+RustFS provides faster speed and safer distributed features for high-performance object storage.
 
-Unlike other storage systems, RustFS is released under the permissible Apache 2.0 license, avoiding the restrictions of AGPL. With Rust as its foundation, RustFS delivers superior speed and secure distributed features for next-generation object storage.
+> ⚠️ **RustFS is under rapid development. Do NOT use in production environments!**
 
-## Feature & Status
+## Features
 
-- **High Performance**: Built with Rust to ensure maximum speed and resource efficiency.
-- **Distributed Architecture**: Scalable and fault-tolerant design suitable for large-scale deployments.
-- **S3 Compatibility**: Seamless integration with existing S3-compatible applications and tools.
-- **Data Lake Support**: Optimized for high-throughput big data and AI workloads.
-- **Open Source**: Licensed under Apache 2.0, encouraging unrestricted community contributions and commercial usage.
-- **User-Friendly**: Designed with simplicity in mind for easy deployment and management.
+- **High Performance**: Built with Rust, ensuring speed and efficiency.
+- **Distributed Architecture**: Scalable and fault-tolerant design for large-scale deployments.
+- **S3 Compatibility**: Seamless integration with existing S3-compatible applications.
+- **Data Lake Support**: Optimized for big data and AI workloads.
+- **Open Source**: Licensed under Apache 2.0, encouraging community contributions and transparency.
+- **User-Friendly**: Designed with simplicity in mind, making it easy to deploy and manage.
 
-| Feature | Status | Feature | Status |
-| :--- | :--- | :--- | :--- |
-| **S3 Core Features** | ✅ Available | **Bitrot Protection** | ✅ Available |
-| **Upload / Download** | ✅ Available | **Single Node Mode** | ✅ Available |
-| **Versioning** | ✅ Available |  **Bucket Replication** | ⚠️ Partial Support |
-| **Logging** | ✅ Available |  **Lifecycle Management** | 🚧 Under Testing |
-| **Event Notifications** | ✅ Available |  **Distributed Mode** | 🚧 Under Testing |
-| **K8s Helm Charts** | ✅ Available |  **OPA (Open Policy Agent)** | 🚧 Under Testing |
+## RustFS vs MinIO
 
+Stress test server parameters
 
-
-
-## RustFS vs MinIO Performance
-
-**Stress Test Environment:**
-
-| Type    | Parameter | Remark                                                   |
+| Type    | parameter | Remark                                                   |
 |---------|-----------|----------------------------------------------------------|
-| CPU     | 2 Core    | Intel Xeon (Sapphire Rapids) Platinum 8475B, 2.7/3.2 GHz |
-| Memory  | 4GB       |                                                          |
-| Network | 15Gbps    |                                                          |
-| Drive   | 40GB x 4  | IOPS 3800 / Drive                                        |
+| CPU     | 2 Core    | Intel Xeon(Sapphire Rapids) Platinum 8475B , 2.7/3.2 GHz |   |
+| Memory  | 4GB       |                                                          |
+| Network | 15Gbp     |                                                          |
+| Driver  | 40GB x 4  | IOPS 3800 / Driver                                       |
 
 <https://github.com/user-attachments/assets/2e4979b5-260c-4f2c-ac12-c87fd558072a>
 
-### RustFS vs Other Object Storage
+### RustFS vs Other object storage
 
-| Feature | RustFS | Other Object Storage |
-| :--- | :--- | :--- |
-| **Console Experience** | **Powerful Console**<br>Comprehensive management interface. | **Basic / Limited Console**<br>Often overly simple or lacking critical features. |
-| **Language & Safety** | **Rust-based**<br>Memory safety by design. | **Go or C-based**<br>Potential for memory GC pauses or leaks. |
-| **Data Sovereignty** | **No Telemetry / Full Compliance**<br>Guards against unauthorized cross-border data egress. Compliant with GDPR (EU/UK), CCPA (US), and APPI (Japan). | **Potential Risk**<br>Possible legal exposure and unwanted data telemetry. |
-| **Licensing** | **Permissive Apache 2.0**<br>Business-friendly, no "poison pill" clauses. | **Restrictive AGPL v3**<br>Risk of license traps and intellectual property pollution. |
-| **Compatibility** | **100% S3 Compatible**<br>Works with any cloud provider or client, anywhere. | **Variable Compatibility**<br>May lack support for local cloud vendors or specific APIs. |
-| **Edge & IoT** | **Strong Edge Support**<br>Ideal for secure, innovative edge devices. | **Weak Edge Support**<br>Often too heavy for edge gateways. |
-| **Risk Profile** | **Enterprise Risk Mitigation**<br>Clear IP rights and safe for commercial use. | **Legal Risks**<br>Intellectual property ambiguity and usage restrictions. |
+| RustFS                                                                          | Other object storage                                                                                                    |
+|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|
+| Powerful Console                                                                | Simple and useless Console                                                                                              |
+| Developed based on Rust language, memory is safer                               | Developed in Go or C, with potential issues like memory GC/leaks                                                        |
+| Does not report logs to third-party countries                                   | Reporting logs to other third countries may violate national security laws                                              |
+| Licensed under Apache, more business-friendly                                   | AGPL V3 License and other License, polluted open source and License traps, infringement of intellectual property rights |
+| Comprehensive S3 support, works with domestic and international cloud providers | Full support for S3, but no local cloud vendor support                                                                  |
+| Rust-based development, strong support for secure and innovative devices        | Poor support for edge gateways and secure innovative devices                                                            |
+| Stable commercial prices, free community support                                | High pricing, with costs up to $250,000 for 1PiB                                                                        |
+| No risk                                                                         | Intellectual property risks and risks of prohibited uses                                                                |
 
 ## Quickstart
 
 To get started with RustFS, follow these steps:
 
-### 1. One-click Installation (Option 1)
+1. **One-click installation script (Option 1)​​**
 
   ```bash
-  curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
-````
+  curl -O  https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
+  ```
 
-### 2\. Docker Quick Start (Option 2)
+2. **Docker Quick Start (Option 2)​​**
 
-The RustFS container runs as a non-root user `rustfs` (UID `10001`). If you run Docker with `-v` to mount a host directory, please ensure the host directory owner is set to `10001`, otherwise you will encounter permission denied errors.
+  ```bash
+   # create data and logs directories
+   mkdir -p data logs
 
-```bash
- # Create data and logs directories
- mkdir -p data logs
+   # using latest alpha version
+   docker run -d -p 9000:9000 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:alpha
 
- # Change the owner of these directories
- chown -R 10001:10001 data logs
+   # Specific version
+   docker run -d -p 9000:9000 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0.alpha.45
+   ```
 
- # Using latest version
- docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
+For docker installation, you can also run the container with docker compose. With the `docker-compose.yml` file under
+root directory, running the command:
 
- # Using specific version
- docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0.alpha.68
-```
+  ```
+  docker compose --profile observability up -d
+  ```
 
-You can also use Docker Compose. Using the `docker-compose.yml` file in the root directory:
+**NOTE**: You should be better to have a look for `docker-compose.yaml` file. Because, several services contains in the
+file. Grafan,prometheus,jaeger containers will be launched using docker compose file, which is helpful for rustfs
+observability. If you want to start redis as well as nginx container, you can specify the corresponding profiles.
 
-```bash
-docker compose --profile observability up -d
-```
+3. **Build from Source (Option 3) - Advanced Users**
 
-**NOTE**: We recommend reviewing the `docker-compose.yaml` file before running. It defines several services including Grafana, Prometheus, and Jaeger, which are helpful for RustFS observability. If you wish to start Redis or Nginx containers, you can specify the corresponding profiles.
+   For developers who want to build RustFS Docker images from source with multi-architecture support:
 
-### 3\. Build from Source (Option 3) - Advanced Users
+   ```bash
+   # Build multi-architecture images locally
+   ./docker-buildx.sh --build-arg RELEASE=latest
 
-For developers who want to build RustFS Docker images from source with multi-architecture support:
+   # Build and push to registry
+   ./docker-buildx.sh --push
 
-```bash
-# Build multi-architecture images locally
-./docker-buildx.sh --build-arg RELEASE=latest
+   # Build specific version
+   ./docker-buildx.sh --release v1.0.0 --push
 
-# Build and push to registry
-./docker-buildx.sh --push
+   # Build for custom registry
+   ./docker-buildx.sh --registry your-registry.com --namespace yourname --push
+   ```
 
-# Build specific version
-./docker-buildx.sh --release v1.0.0 --push
+   The `docker-buildx.sh` script supports:
+    - **Multi-architecture builds**: `linux/amd64`, `linux/arm64`
+    - **Automatic version detection**: Uses git tags or commit hashes
+    - **Registry flexibility**: Supports Docker Hub, GitHub Container Registry, etc.
+    - **Build optimization**: Includes caching and parallel builds
 
-# Build for custom registry
-./docker-buildx.sh --registry your-registry.com --namespace yourname --push
-```
+   You can also use Make targets for convenience:
 
-The `docker-buildx.sh` script supports:
-\- **Multi-architecture builds**: `linux/amd64`, `linux/arm64`
-\- **Automatic version detection**: Uses git tags or commit hashes
-\- **Registry flexibility**: Supports Docker Hub, GitHub Container Registry, etc.
-\- **Build optimization**: Includes caching and parallel builds
+   ```bash
+   make docker-buildx                    # Build locally
+   make docker-buildx-push               # Build and push
+   make docker-buildx-version VERSION=v1.0.0  # Build specific version
+   make help-docker                      # Show all Docker-related commands
+   ```
 
-You can also use Make targets for convenience:
+4. **Build with helm chart(Option 4) - Cloud Native environment**
 
-```bash
-make docker-buildx                    # Build locally
-make docker-buildx-push               # Build and push
-make docker-buildx-version VERSION=v1.0.0  # Build specific version
-make help-docker                      # Show all Docker-related commands
-```
+   Following the instructions on [helm chart README](./helm/README.md) to install RustFS on kubernetes cluster.
 
-> **Heads-up (macOS cross-compilation)**: macOS keeps the default `ulimit -n` at 256, so `cargo zigbuild` or `./build-rustfs.sh --platform ...` may fail with `ProcessFdQuotaExceeded` when targeting Linux. The build script attempts to raise the limit automatically, but if you still see the warning, run `ulimit -n 4096` (or higher) in your shell before building.
+5. **Access the Console**: Open your web browser and navigate to `http://localhost:9000` to access the RustFS console,
+   default username and password is `rustfsadmin` .
+6. **Create a Bucket**: Use the console to create a new bucket for your objects.
+7. **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs to interact with your
+   RustFS instance.
 
-### 4\. Build with Helm Chart (Option 4) - Cloud Native
-
-Follow the instructions in the [Helm Chart README](https://charts.rustfs.com/) to install RustFS on a Kubernetes cluster.
-
-### 5\. Nix Flake (Option 5)
-
-If you have [Nix with flakes enabled](https://nixos.wiki/wiki/Flakes#Enable_flakes):
-
-```bash
-# Run directly without installing
-nix run github:rustfs/rustfs
-
-# Build the binary
-nix build github:rustfs/rustfs
-./result/bin/rustfs --help
-
-# Or from a local checkout
-nix build
-nix run
-```
-
------
-
-### Accessing RustFS
-
-5.  **Access the Console**: Open your web browser and navigate to `http://localhost:9000` to access the RustFS console.
-      * Default credentials: `rustfsadmin` / `rustfsadmin`
-6.  **Create a Bucket**: Use the console to create a new bucket for your objects.
-7.  **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs/clients to interact with your RustFS instance.
-
-**NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured.html).
+**NOTE**: If you want to access RustFS instance with `https`, you can refer
+to [TLS configuration docs](https://docs.rustfs.com/integration/tls-configured.html).
 
 ## Documentation
 
-For detailed documentation, including configuration options, API references, and advanced usage, please visit our [Documentation](https://docs.rustfs.com).
+For detailed documentation, including configuration options, API references, and advanced usage, please visit
+our [Documentation](https://docs.rustfs.com).
 
 ## Getting Help
 
-If you have any questions or need assistance:
+If you have any questions or need assistance, you can:
 
-  - Check the [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) for common issues and solutions.
-  - Join our [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) to ask questions and share your experiences.
-  - Open an issue on our [GitHub Issues](https://github.com/rustfs/rustfs/issues) page for bug reports or feature requests.
+- Check the [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) for common issues and solutions.
+- Join our [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) to ask questions and share your
+  experiences.
+- Open an issue on our [GitHub Issues](https://github.com/rustfs/rustfs/issues) page for bug reports or feature
+  requests.
 
 ## Links
 
-  - [Documentation](https://docs.rustfs.com) - The manual you should read
-  - [Changelog](https://github.com/rustfs/rustfs/releases) - What we broke and fixed
-  - [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) - Where the community lives
+- [Documentation](https://docs.rustfs.com) - The manual you should read
+- [Changelog](https://github.com/rustfs/rustfs/releases) - What we broke and fixed
+- [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) - Where the community lives
 
 ## Contact
 
-  - **Bugs**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
-  - **Business**: [hello@rustfs.com](mailto:hello@rustfs.com)
-  - **Jobs**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
-  - **General Discussion**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
-  - **Contributing**: [CONTRIBUTING.md](CONTRIBUTING.md)
+- **Bugs**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
+- **Business**: <hello@rustfs.com>
+- **Jobs**: <jobs@rustfs.com>
+- **General Discussion**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
+- **Contributing**: [CONTRIBUTING.md](CONTRIBUTING.md)
 
 ## Contributors
 
-RustFS is a community-driven project, and we appreciate all contributions. Check out the [Contributors](https://github.com/rustfs/rustfs/graphs/contributors) page to see the amazing people who have helped make RustFS better.
+RustFS is a community-driven project, and we appreciate all contributions. Check out
+the [Contributors](https://github.com/rustfs/rustfs/graphs/contributors) page to see the amazing people who have helped
+make RustFS better.
 
 <a href="https://github.com/rustfs/rustfs/graphs/contributors">
-<img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="Contributors" />
+  <img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="Contributors"/>
 </a>
 
 ## Github Trending Top
 
-🚀 RustFS is beloved by open-source enthusiasts and enterprise users worldwide, often appearing on the GitHub Trending top charts.
+🚀 RustFS is beloved by open-source enthusiasts and enterprise users worldwide, often appearing on the GitHub Trending
+top charts.
 
 <a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://raw.githubusercontent.com/rustfs/rustfs/refs/heads/main/docs/rustfs-trending.jpg" alt="rustfs%2Frustfs | Trendshift" /></a>
 

README_ZH.md

@@ -1,219 +1,183 @@
 [![RustFS](https://rustfs.com/images/rustfs-github.png)](https://rustfs.com)
 
-<p align="center">RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。</p>
+<p align="center">RustFS 是一个使用 Rust 构建的高性能分布式对象存储软件</p >
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
-  <a href="https://github.com/rustfs/rustfs/actions/workflows/docker.yml"><img alt="构建并推送 Docker 镜像" src="https://github.com/rustfs/rustfs/actions/workflows/docker.yml/badge.svg" /></a>
-  <img alt="GitHub 提交活跃度" src="https://img.shields.io/github/commit-activity/m/rustfs/rustfs"/>
-  <img alt="Github 最新提交" src="https://img.shields.io/github/last-commit/rustfs/rustfs"/>
+  <a href="https://github.com/rustfs/rustfs/actions/workflows/docker.yml"><img alt="Build and Push Docker Images" src="https://github.com/rustfs/rustfs/actions/workflows/docker.yml/badge.svg" /></a>
+  <img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/m/rustfs/rustfs"/>
+  <img alt="Github Last Commit" src="https://img.shields.io/github/last-commit/rustfs/rustfs"/>
   <a href="https://hellogithub.com/repository/rustfs/rustfs" target="_blank"><img src="https://abroad.hellogithub.com/v1/widgets/recommend.svg?rid=b95bcb72bdc340b68f16fdf6790b7d5b&claim_uid=MsbvjYeLDKAH457&theme=small" alt="Featured｜HelloGitHub" /></a>
-</p>
+</p >
 
 <p align="center">
-  <a href="https://docs.rustfs.com/installation/">快速开始</a>
-  · <a href="https://docs.rustfs.com/">文档</a>
-  · <a href="https://github.com/rustfs/rustfs/issues">报告 Bug</a>
-  · <a href="https://github.com/rustfs/rustfs/discussions">社区讨论</a>
-</p>
+  <a href="https://docs.rustfs.com/zh/introduction.html">快速开始</a >
+  · <a href="https://docs.rustfs.com/zh/">文档</a >
+  · <a href="https://github.com/rustfs/rustfs/issues">问题报告</a >
+  · <a href="https://github.com/rustfs/rustfs/discussions">讨论</a >
+</p >
 
 <p align="center">
-  <a href="https://github.com/rustfs/rustfs/blob/main/README.md">English</a> | 简体中文 |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=de">Deutsch</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=es">Español</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=fr">français</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=ja">日本語</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=ko">한국어</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=pt">Portuguese</a> |
-  <a href="https://readme-i18n.com/rustfs/rustfs?lang=ru">Русский</a>
-</p>
+<a href="https://github.com/rustfs/rustfs/blob/main/README.md">English</a > | 简体中文
+</p >
 
-RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust 是全球最受开发者喜爱的编程语言之一，RustFS 完美结合了 MinIO 的简洁性与 Rust 的内存安全及高性能优势。它提供完整的 S3 兼容性，完全开源，并专为数据湖、人工智能（AI）和大数据负载进行了优化。
+RustFS 是一个使用 Rust（全球最受欢迎的编程语言之一）构建的高性能分布式对象存储软件。与 MinIO 一样，它具有简单性、S3
+兼容性、开源特性以及对数据湖、AI 和大数据的支持等一系列优势。此外，与其他存储系统相比，它采用 Apache
+许可证构建，拥有更好、更用户友好的开源许可证。由于以 Rust 为基础，RustFS 为高性能对象存储提供了更快的速度和更安全的分布式功能。
 
-与其他存储系统不同，RustFS 采用更宽松、商业友好的 Apache 2.0 许可证，避免了 AGPL 协议的限制。以 Rust 为基石，RustFS 为下一代对象存储提供了更快的速度和更安全的分布式特性。
+## 特性
 
-## 特征和功能状态
-
-- **高性能**：基于 Rust 构建，确保极致的速度和资源效率。
+- **高性能**：使用 Rust 构建，确保速度和效率。
 - **分布式架构**：可扩展且容错的设计，适用于大规模部署。
-- **S3 兼容性**：与现有的 S3 兼容应用和工具无缝集成。
-- **数据湖支持**：专为高吞吐量的大数据和 AI 工作负载优化。
-- **完全开源**：采用 Apache 2.0 许可证，鼓励社区贡献和商业使用。
-- **简单易用**：设计简洁，易于部署和管理。
+- **S3 兼容性**：与现有 S3 兼容应用程序无缝集成。
+- **数据湖支持**：针对大数据和 AI 工作负载进行了优化。
+- **开源**：采用 Apache 2.0 许可证，鼓励社区贡献和透明度。
+- **用户友好**：设计简单，易于部署和管理。
 
+## RustFS vs MinIO
 
-| 功能 | 状态 |   功能 | 状态 | 
-| :--- | :--- | :--- | :--- |
-| **S3 核心功能** | ✅ 可用 |    **Bitrot (防数据腐烂)** | ✅ 可用 |
-| **上传 / 下载** | ✅ 可用 |     **单机模式** | ✅ 可用 |
-| **版本控制** | ✅ 可用 | **存储桶复制** | ⚠️ 部分可用 |
-| **日志功能** | ✅ 可用 |  **生命周期管理** | 🚧 测试中 |
-| **事件通知** | ✅ 可用 |  **分布式模式** | 🚧 测试中 |
-| **K8s Helm Chart** | ✅ 可用 |  **OPA (策略引擎)** | 🚧 测试中 |
+压力测试服务器参数
 
-
-
-
-## RustFS vs MinIO 性能对比
-
-**压力测试环境参数：**
-
-| 类型    | 参数 | 备注                                                   |
-|---------|-----------|----------------------------------------------------------|
-| CPU     | 2 核    | Intel Xeon (Sapphire Rapids) Platinum 8475B , 2.7/3.2 GHz |
-| 内存  | 4GB       |                                                          |
-| 网络 | 15Gbps     |                                                          |
-| 硬盘  | 40GB x 4  | IOPS 3800 / Drive                                       |
+| 类型  | 参数       | 备注                                                       |
+|-----|----------|----------------------------------------------------------|
+| CPU | 2 核心     | Intel Xeon(Sapphire Rapids) Platinum 8475B , 2.7/3.2 GHz |   |
+| 内存  | 4GB      |                                                          |
+| 网络  | 15Gbp    |                                                          |
+| 驱动器 | 40GB x 4 | IOPS 3800 / 驱动器                                          |
 
 <https://github.com/user-attachments/assets/2e4979b5-260c-4f2c-ac12-c87fd558072a>
 
 ### RustFS vs 其他对象存储
 
-| 特性 | RustFS | 其他对象存储 |
-| :--- | :--- | :--- |
-| **控制台体验** | **功能强大的控制台**<br>提供全面的管理界面。 | **基础/简陋的控制台**<br>通常功能过于简单或缺失关键特性。 |
-| **语言与安全** | **基于 Rust 开发**<br>天生的内存安全。 | **基于 Go 或 C 开发**<br>存在内存 GC 停顿或内存泄漏的潜在风险。 |
-| **数据主权** | **无遥测 / 完全合规**<br>防止未经授权的数据跨境传输。完全符合 GDPR (欧盟/英国)、CCPA (美国) 和 APPI (日本) 等法规。 | **潜在风险**<br>可能存在法律风险和隐蔽的数据遥测（Telemetry）。 |
-| **开源协议** | **宽松的 Apache 2.0**<br>商业友好，无“毒丸”条款。 | **受限的 AGPL v3**<br>存在许可证陷阱和知识产权污染的风险。 |
-| **兼容性** | **100% S3 兼容**<br>适用于任何云提供商和客户端，随处运行。 | **兼容性不一**<br>虽然支持 S3，但可能缺乏对本地云厂商或特定 API 的支持。 |
-| **边缘与 IoT** | **强大的边缘支持**<br>非常适合安全、创新的边缘设备。 | **边缘支持较弱**<br>对于边缘网关来说通常过于沉重。 |
-| **成本** | **稳定且免费**<br>免费社区支持，稳定的商业定价。 | **高昂成本**<br>1PiB 的成本可能高达 250,000 美元。 |
-| **风险控制** | **企业级风险规避**<br>清晰的知识产权，商业使用安全无忧。 | **法律风险**<br>知识产权归属模糊及使用限制风险。 |
+| RustFS                   | 其他对象存储                              |
+|--------------------------|-------------------------------------|
+| 强大的控制台                   | 简单且无用的控制台                           |
+| 基于 Rust 语言开发，内存更安全       | 使用 Go 或 C 开发，存在内存 GC/泄漏等潜在问题        |
+| 不向第三方国家报告日志              | 向其他第三方国家报告日志可能违反国家安全法律              |
+| 采用 Apache 许可证，对商业更友好     | AGPL V3 许可证等其他许可证，污染开源和许可证陷阱，侵犯知识产权 |
+| 全面的 S3 支持，适用于国内外云提供商     | 完全支持 S3，但不支持本地云厂商                   |
+| 基于 Rust 开发，对安全和创新设备有强大支持 | 对边缘网关和安全创新设备支持较差                    |
+| 稳定的商业价格，免费社区支持           | 高昂的定价，1PiB 成本高达 $250,000            |
+| 无风险                      | 知识产权风险和禁止使用的风险                      |
 
 ## 快速开始
 
-请按照以下步骤快速上手 RustFS：
+要开始使用 RustFS，请按照以下步骤操作：
 
-### 1. 一键安装脚本 (选项 1)
+1. **一键脚本快速启动 (方案一)**
+
+   ```bash
+   curl -O  https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
+   ```
+
+2. **Docker 快速启动（方案二）**
 
   ```bash
-  curl -O https://rustfs.com/install_rustfs.sh && bash install_rustfs.sh
-````
+   docker run -d -p 9000:9000  -v /data:/data rustfs/rustfs
+   ```
 
-### 2\. Docker 快速启动 (选项 2)
+对于使用 Docker 安装来讲，你还可以使用 `docker compose` 来启动 rustfs 实例。在仓库的根目录下面有一个 `docker-compose.yml`
+文件。运行如下命令即可：
 
-RustFS 容器以非 root 用户 `rustfs` (UID `10001`) 运行。如果您使用 Docker 的 `-v` 参数挂载宿主机目录，请务必确保宿主机目录的所有者已更改为 `1000`，否则会遇到权限拒绝错误。
+  ```
+  docker compose --profile observability up -d
+  ```
 
-```bash
- # 创建数据和日志目录
- mkdir -p data logs
+**注意**：在使用 `docker compose` 之前，你应该仔细阅读一下 `docker-compose.yaml`，因为该文件中包含多个服务，除了 rustfs
+以外，还有 grafana、prometheus、jaeger 等，这些是为 rustfs 可观测性服务的，还有 redis 和 nginx。你想启动哪些容器，就需要用
+`--profile` 参数指定相应的 profile。
 
- # 更改这两个目录的所有者
- chown -R 10001:10001 data logs
+3. **从源码构建（方案三）- 高级用户**
 
- # 使用最新版本运行
- docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
+   面向希望从源码构建支持多架构 Docker 镜像的开发者：
 
- # 使用指定版本运行
- docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0.alpha.68
-```
+   ```bash
+   # 本地构建多架构镜像
+   ./docker-buildx.sh --build-arg RELEASE=latest
 
-您也可以使用 Docker Compose。使用根目录下的 `docker-compose.yml` 文件：
+   # 构建并推送至镜像仓库
+   ./docker-buildx.sh --push
 
-```bash
-docker compose --profile observability up -d
-```
+   # 构建指定版本
+   ./docker-buildx.sh --release v1.0.0 --push
 
-**注意**: 我们建议您在运行前查看 `docker-compose.yaml` 文件。该文件定义了包括 Grafana、Prometheus 和 Jaeger 在内的多个服务，有助于 RustFS 的可观测性监控。如果您还想启动 Redis 或 Nginx 容器，可以指定相应的 profile。
+   # 构建并推送到自定义镜像仓库
+   ./docker-buildx.sh --registry your-registry.com --namespace yourname --push
+   ```
 
-### 3\. 源码编译 (选项 3) - 进阶用户
+   `docker-buildx.sh` 脚本支持：
+    - **多架构构建**：`linux/amd64`、`linux/arm64`
+    - **自动版本检测**：可使用 git 标签或提交哈希
+    - **仓库灵活性**：支持 Docker Hub、GitHub Container Registry 等
+    - **构建优化**：包含缓存和并行构建
 
-适用于希望从源码构建支持多架构 RustFS Docker 镜像的开发者：
+   你也可以使用 Makefile 提供的目标命令以提升便捷性：
 
-```bash
-# 在本地构建多架构镜像
-./docker-buildx.sh --build-arg RELEASE=latest
+   ```bash
+   make docker-buildx                    # 本地构建
+   make docker-buildx-push               # 构建并推送
+   make docker-buildx-version VERSION=v1.0.0  # 构建指定版本
+   make help-docker                      # 显示全部 Docker 相关命令
+   ```
 
-# 构建并推送到仓库
-./docker-buildx.sh --push
+4. **使用 Helm Chart 部署（方案四）- 云原生环境**
 
-# 构建指定版本
-./docker-buildx.sh --release v1.0.0 --push
+   按照 [helm chart 说明文档](./helm/README.md) 的指引，在 Kubernetes 集群中安装 RustFS。
 
-# 构建并推送到自定义仓库
-./docker-buildx.sh --registry your-registry.com --namespace yourname --push
-```
+5. **访问控制台**：打开 Web 浏览器并导航到 `http://localhost:9000` 以访问 RustFS 控制台，默认的用户名和密码是
+   `rustfsadmin` 。
+6. **创建存储桶**：使用控制台为您的对象创建新的存储桶。
+7. **上传对象**：您可以直接通过控制台上传文件，或使用 S3 兼容的 API 与您的 RustFS 实例交互。
 
-`docker-buildx.sh` 脚本支持：
-\- **多架构构建**: `linux/amd64`, `linux/arm64`
-\- **自动版本检测**: 使用 git tags 或 commit hash
-\- **灵活的仓库支持**: 支持 Docker Hub, GitHub Container Registry 等
-\- **构建优化**: 包含缓存和并行构建
-
-为了方便起见，您也可以使用 Make 命令：
-
-```bash
-make docker-buildx                    # 本地构建
-make docker-buildx-push               # 构建并推送
-make docker-buildx-version VERSION=v1.0.0  # 构建指定版本
-make help-docker                      # 显示所有 Docker 相关命令
-```
-
-> **注意 (macOS 交叉编译)**: macOS 默认的 `ulimit -n` 限制为 256，因此在使用 `cargo zigbuild` 或 `./build-rustfs.sh --platform ...` 交叉编译 Linux 版本时，可能会因 `ProcessFdQuotaExceeded` 失败。构建脚本会尝试自动提高限制，但如果您仍然看到警告，请在构建前在终端运行 `ulimit -n 4096` (或更高)。
-
-### 4\. 使用 Helm Chart 安装 (选项 4) - 云原生环境
-
-请按照 [Helm Chart README](https://charts.rustfs.com) 上的说明在 Kubernetes 集群上安装 RustFS。
-
------
-
-### 访问 RustFS
-
-5.  **访问控制台**: 打开浏览器并访问 `http://localhost:9000` 进入 RustFS 控制台。
-      * 默认账号/密码: `rustfsadmin` / `rustfsadmin`
-6.  **创建存储桶**: 使用控制台为您​​的对象创建一个新的存储桶 (Bucket)。
-7.  **上传对象**: 您可以直接通过控制台上传文件，或使用 S3 兼容的 API/客户端与您的 RustFS 实例进行交互。
-
-**注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured.html)。
+**注意**：如果你想通过 `https` 来访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/zh/integration/tls-configured.html)
 
 ## 文档
 
-有关详细文档，包括配置选项、API 参考和高级用法，请访问我们的 [官方文档](https://docs.rustfs.com)。
+有关详细文档，包括配置选项、API 参考和高级用法，请访问我们的[文档](https://docs.rustfs.com)。
 
 ## 获取帮助
 
-如果您有任何问题或需要帮助：
+如果您有任何问题或需要帮助，您可以：
 
-  - 查看 [FAQ](https://github.com/rustfs/rustfs/discussions/categories/q-a) 寻找常见问题和解决方案。
-  - 加入我们的 [GitHub Discussions](https://github.com/rustfs/rustfs/discussions) 提问并分享您的经验。
-  - 在我们的 [GitHub Issues](https://github.com/rustfs/rustfs/issues) 页面提交 Bug 报告或功能请求。
+- 查看[常见问题解答](https://github.com/rustfs/rustfs/discussions/categories/q-a)以获取常见问题和解决方案。
+- 加入我们的 [GitHub 讨论](https://github.com/rustfs/rustfs/discussions)来提问和分享您的经验。
+- 在我们的 [GitHub Issues](https://github.com/rustfs/rustfs/issues) 页面上开启问题，报告错误或功能请求。
 
 ## 链接
 
-  - [官方文档](https://docs.rustfs.com) - 必读手册
-  - [更新日志](https://github.com/rustfs/rustfs/releases) - 版本变更记录
-  - [社区讨论](https://github.com/rustfs/rustfs/discussions) - 社区交流地
+- [文档](https://docs.rustfs.com) - 您应该阅读的手册
+- [更新日志](https://docs.rustfs.com/changelog) - 我们破坏和修复的内容
+- [GitHub 讨论](https://github.com/rustfs/rustfs/discussions) - 社区所在地
 
-## 联系方式
+## 联系
 
-  - **Bug 反馈**: [GitHub Issues](https://github.com/rustfs/rustfs/issues)
-  - **商务合作**: [hello@rustfs.com](mailto:hello@rustfs.com)
-  - **工作机会**: [jobs@rustfs.com](mailto:jobs@rustfs.com)
-  - **一般讨论**: [GitHub Discussions](https://github.com/rustfs/rustfs/discussions)
-  - **贡献指南**: [CONTRIBUTING.md](https://www.google.com/search?q=CONTRIBUTING.md)
+- **错误报告**：[GitHub Issues](https://github.com/rustfs/rustfs/issues)
+- **商务合作**：<hello@rustfs.com>
+- **招聘**：<jobs@rustfs.com>
+- **一般讨论**：[GitHub 讨论](https://github.com/rustfs/rustfs/discussions)
+- **贡献**：[CONTRIBUTING.md](CONTRIBUTING.md)
 
 ## 贡献者
 
-RustFS 是一个社区驱动的项目，我们感谢所有的贡献。请查看 [贡献者](https://github.com/rustfs/rustfs/graphs/contributors) 页面，看看那些让 RustFS 变得更好的了不起的人们。
+RustFS 是一个社区驱动的项目，我们感谢所有的贡献。查看[贡献者](https://github.com/rustfs/rustfs/graphs/contributors)页面，了解帮助
+RustFS 变得更好的杰出人员。
 
 <a href="https://github.com/rustfs/rustfs/graphs/contributors">
-<img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="Contributors" />
-</a>
+  <img src="https://opencollective.com/rustfs/contributors.svg?width=890&limit=500&button=false" alt="贡献者"/>
+</a >
 
-## Github Trending Top
+## Github 全球推荐榜
 
-🚀 RustFS 深受全球开源爱好者和企业用户的喜爱，经常荣登 GitHub Trending 榜单。
+🚀 RustFS 受到了全世界开源爱好者和企业用户的喜欢，多次登顶 Github Trending 全球榜。
 
 <a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://raw.githubusercontent.com/rustfs/rustfs/refs/heads/main/docs/rustfs-trending.jpg" alt="rustfs%2Frustfs | Trendshift" /></a>
 
-## Star 历史
-
-[![Star History Chart](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
+## Star 历史图
 
+[![Star 历史图](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
 
 ## 许可证
 
 [Apache 2.0](https://opensource.org/licenses/Apache-2.0)
 
 **RustFS** 是 RustFS, Inc. 的商标。所有其他商标均为其各自所有者的财产。
-

SECURITY.md

@@ -2,7 +2,8 @@
 
 ## Supported Versions
 
-Security updates are provided for the latest released version of this project.
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
@@ -10,10 +11,8 @@ Security updates are provided for the latest released version of this project.
 
 ## Reporting a Vulnerability
 
-Please report security vulnerabilities **privately** via GitHub Security Advisories:
+Use this section to tell people how to report a vulnerability.
 
-https://github.com/rustfs/rustfs/security/advisories/new
-
-Do **not** open a public issue for security-sensitive bugs.
-
-You can expect an initial response within a reasonable timeframe. Further updates will be provided as the report is triaged.
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

build-rustfs.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # RustFS Binary Build Script
 # This script compiles RustFS binaries for different platforms and architectures
@@ -163,35 +163,6 @@ print_message() {
     echo -e "${color}${message}${NC}"
 }
 
-# Prevent zig/ld from hitting macOS file descriptor defaults during linking
-ensure_file_descriptor_limit() {
-    local required_limit=4096
-    local current_limit
-    current_limit=$(ulimit -Sn 2>/dev/null || echo "")
-
-    if [ -z "$current_limit" ] || [ "$current_limit" = "unlimited" ]; then
-        return
-    fi
-
-    if (( current_limit >= required_limit )); then
-        return
-    fi
-
-    local hard_limit target_limit
-    hard_limit=$(ulimit -Hn 2>/dev/null || echo "")
-    target_limit=$required_limit
-
-    if [ -n "$hard_limit" ] && [ "$hard_limit" != "unlimited" ] && (( hard_limit < required_limit )); then
-        target_limit=$hard_limit
-    fi
-
-    if ulimit -Sn "$target_limit" 2>/dev/null; then
-        print_message $YELLOW "🔧 Increased open file limit from $current_limit to $target_limit to avoid ProcessFdQuotaExceeded"
-    else
-        print_message $YELLOW "⚠️ Unable to raise ulimit -n automatically (current: $current_limit, needed: $required_limit). Please run 'ulimit -n $required_limit' manually before building."
-    fi
-}
-
 # Get version from git
 get_version() {
     if git describe --abbrev=0 --tags >/dev/null 2>&1; then
@@ -599,11 +570,10 @@ main() {
         fi
     fi
 
-    ensure_file_descriptor_limit
-
     # Start build process
     build_rustfs
 }
 
 # Run main function
 main
+

crates/ahm/Cargo.toml

@@ -13,12 +13,10 @@ keywords = ["RustFS", "AHM", "health-management", "scanner", "Minio"]
 categories = ["web-programming", "development-tools", "filesystem"]
 
 [dependencies]
-rustfs-config = { workspace = true }
 rustfs-ecstore = { workspace = true }
 rustfs-common = { workspace = true }
 rustfs-filemeta = { workspace = true }
 rustfs-madmin = { workspace = true }
-rustfs-utils = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tokio-util = { workspace = true }
 tracing = { workspace = true }

crates/ahm/src/heal/channel.rs

@@ -90,12 +90,7 @@ impl HealChannelProcessor {
 
     /// Process start request
     async fn process_start_request(&self, request: HealChannelRequest) -> Result<()> {
-        info!(
-            "Processing heal start request: {} for bucket: {}/{}",
-            request.id,
-            request.bucket,
-            request.object_prefix.as_deref().unwrap_or("")
-        );
+        info!("Processing heal start request: {} for bucket: {}", request.id, request.bucket);
 
         // Convert channel request to heal request
         let heal_request = self.convert_to_heal_request(request.clone())?;
@@ -329,14 +324,6 @@ mod tests {
         async fn list_objects_for_heal(&self, _bucket: &str, _prefix: &str) -> crate::Result<Vec<String>> {
             Ok(vec![])
         }
-        async fn list_objects_for_heal_page(
-            &self,
-            _bucket: &str,
-            _prefix: &str,
-            _continuation_token: Option<&str>,
-        ) -> crate::Result<(Vec<String>, Option<String>, bool)> {
-            Ok((vec![], None, false))
-        }
         async fn get_disk_for_resume(&self, _set_disk_id: &str) -> crate::Result<rustfs_ecstore::disk::DiskStore> {
             Err(crate::Error::other("Not implemented in mock"))
         }

crates/ahm/src/heal/erasure_healer.rs

@@ -49,9 +49,8 @@ impl ErasureSetHealer {
     }
 
     /// execute erasure set heal with resume
-    #[tracing::instrument(skip(self, buckets), fields(set_disk_id = %set_disk_id, bucket_count = buckets.len()))]
     pub async fn heal_erasure_set(&self, buckets: &[String], set_disk_id: &str) -> Result<()> {
-        info!("Starting erasure set heal");
+        info!("Starting erasure set heal for {} buckets on set disk {}", buckets.len(), set_disk_id);
 
         // 1. generate or get task id
         let task_id = self.get_or_create_task_id(set_disk_id).await?;
@@ -232,7 +231,6 @@ impl ErasureSetHealer {
 
     /// heal single bucket with resume
     #[allow(clippy::too_many_arguments)]
-    #[tracing::instrument(skip(self, current_object_index, processed_objects, successful_objects, failed_objects, _skipped_objects, resume_manager, checkpoint_manager), fields(bucket = %bucket, bucket_index = bucket_index))]
     async fn heal_bucket_with_resume(
         &self,
         bucket: &str,
@@ -245,7 +243,7 @@ impl ErasureSetHealer {
         resume_manager: &ResumeManager,
         checkpoint_manager: &CheckpointManager,
     ) -> Result<()> {
-        info!(target: "rustfs:ahm:heal_bucket_with_resume" ,"Starting heal for bucket from object index {}", current_object_index);
+        info!(target: "rustfs:ahm:heal_bucket_with_resume" ,"Starting heal for bucket: {} from object index {}", bucket, current_object_index);
 
         // 1. get bucket info
         let _bucket_info = match self.storage.get_bucket_info(bucket).await? {
@@ -256,114 +254,82 @@ impl ErasureSetHealer {
             }
         };
 
-        // 2. process objects with pagination to avoid loading all objects into memory
-        let mut continuation_token: Option<String> = None;
-        let mut global_obj_idx = 0usize;
+        // 2. get objects to heal
+        let objects = self.storage.list_objects_for_heal(bucket, "").await?;
 
-        loop {
-            // Get one page of objects
-            let (objects, next_token, is_truncated) = self
-                .storage
-                .list_objects_for_heal_page(bucket, "", continuation_token.as_deref())
+        // 3. continue from checkpoint
+        for (obj_idx, object) in objects.iter().enumerate().skip(*current_object_index) {
+            // check if already processed
+            if checkpoint_manager.get_checkpoint().await.processed_objects.contains(object) {
+                continue;
+            }
+
+            // update current object
+            resume_manager
+                .set_current_item(Some(bucket.to_string()), Some(object.clone()))
                 .await?;
 
-            // Process objects in this page
-            for object in objects {
-                // Skip objects before the checkpoint
-                if global_obj_idx < *current_object_index {
-                    global_obj_idx += 1;
+            // Check if object still exists before attempting heal
+            let object_exists = match self.storage.object_exists(bucket, object).await {
+                Ok(exists) => exists,
+                Err(e) => {
+                    warn!("Failed to check existence of {}/{}: {}, skipping", bucket, object, e);
+                    *current_object_index = obj_idx + 1;
                     continue;
                 }
+            };
 
-                // check if already processed
-                if checkpoint_manager.get_checkpoint().await.processed_objects.contains(&object) {
-                    global_obj_idx += 1;
-                    continue;
-                }
+            if !object_exists {
+                info!(
+                    target: "rustfs:ahm:heal_bucket_with_resume" ,"Object {}/{} no longer exists, skipping heal (likely deleted intentionally)",
+                    bucket, object
+                );
+                checkpoint_manager.add_processed_object(object.clone()).await?;
+                *successful_objects += 1; // Treat as successful - object is gone as intended
+                *current_object_index = obj_idx + 1;
+                continue;
+            }
 
-                // update current object
-                resume_manager
-                    .set_current_item(Some(bucket.to_string()), Some(object.clone()))
-                    .await?;
+            // heal object
+            let heal_opts = HealOpts {
+                scan_mode: HealScanMode::Normal,
+                remove: true,
+                recreate: true, // Keep recreate enabled for legitimate heal scenarios
+                ..Default::default()
+            };
 
-                // Check if object still exists before attempting heal
-                let object_exists = match self.storage.object_exists(bucket, &object).await {
-                    Ok(exists) => exists,
-                    Err(e) => {
-                        warn!("Failed to check existence of {}/{}: {}, marking as failed", bucket, object, e);
-                        *failed_objects += 1;
-                        checkpoint_manager.add_failed_object(object.clone()).await?;
-                        global_obj_idx += 1;
-                        *current_object_index = global_obj_idx;
-                        continue;
-                    }
-                };
-
-                if !object_exists {
-                    info!(
-                        target: "rustfs:ahm:heal_bucket_with_resume" ,"Object {}/{} no longer exists, skipping heal (likely deleted intentionally)",
-                        bucket, object
-                    );
+            match self.storage.heal_object(bucket, object, None, &heal_opts).await {
+                Ok((_result, None)) => {
+                    *successful_objects += 1;
                     checkpoint_manager.add_processed_object(object.clone()).await?;
-                    *successful_objects += 1; // Treat as successful - object is gone as intended
-                    global_obj_idx += 1;
-                    *current_object_index = global_obj_idx;
-                    continue;
+                    info!("Successfully healed object {}/{}", bucket, object);
                 }
-
-                // heal object
-                let heal_opts = HealOpts {
-                    scan_mode: HealScanMode::Normal,
-                    remove: true,
-                    recreate: true, // Keep recreate enabled for legitimate heal scenarios
-                    ..Default::default()
-                };
-
-                match self.storage.heal_object(bucket, &object, None, &heal_opts).await {
-                    Ok((_result, None)) => {
-                        *successful_objects += 1;
-                        checkpoint_manager.add_processed_object(object.clone()).await?;
-                        info!("Successfully healed object {}/{}", bucket, object);
-                    }
-                    Ok((_, Some(err))) => {
-                        *failed_objects += 1;
-                        checkpoint_manager.add_failed_object(object.clone()).await?;
-                        warn!("Failed to heal object {}/{}: {}", bucket, object, err);
-                    }
-                    Err(err) => {
-                        *failed_objects += 1;
-                        checkpoint_manager.add_failed_object(object.clone()).await?;
-                        warn!("Error healing object {}/{}: {}", bucket, object, err);
-                    }
+                Ok((_, Some(err))) => {
+                    *failed_objects += 1;
+                    checkpoint_manager.add_failed_object(object.clone()).await?;
+                    warn!("Failed to heal object {}/{}: {}", bucket, object, err);
                 }
-
-                *processed_objects += 1;
-                global_obj_idx += 1;
-                *current_object_index = global_obj_idx;
-
-                // check cancel status
-                if self.cancel_token.is_cancelled() {
-                    info!("Heal task cancelled during object processing");
-                    return Err(Error::TaskCancelled);
-                }
-
-                // save checkpoint periodically
-                if global_obj_idx % 100 == 0 {
-                    checkpoint_manager
-                        .update_position(bucket_index, *current_object_index)
-                        .await?;
+                Err(err) => {
+                    *failed_objects += 1;
+                    checkpoint_manager.add_failed_object(object.clone()).await?;
+                    warn!("Error healing object {}/{}: {}", bucket, object, err);
                 }
             }
 
-            // Check if there are more pages
-            if !is_truncated {
-                break;
+            *processed_objects += 1;
+            *current_object_index = obj_idx + 1;
+
+            // check cancel status
+            if self.cancel_token.is_cancelled() {
+                info!("Heal task cancelled during object processing");
+                return Err(Error::TaskCancelled);
             }
 
-            continuation_token = next_token;
-            if continuation_token.is_none() {
-                warn!("List is truncated but no continuation token provided for {}", bucket);
-                break;
+            // save checkpoint periodically
+            if obj_idx % 100 == 0 {
+                checkpoint_manager
+                    .update_position(bucket_index, *current_object_index)
+                    .await?;
             }
         }
 
@@ -397,7 +363,7 @@ impl ErasureSetHealer {
                 let _permit = semaphore
                     .acquire()
                     .await
-                    .map_err(|e| Error::other(format!("Failed to acquire semaphore for bucket heal: {e}")))?;
+                    .map_err(|e| Error::other(format!("Failed to acquire semaphore for bucket heal: {}", e)))?;
 
                 if cancel_token.is_cancelled() {
                     return Err(Error::TaskCancelled);
@@ -429,12 +395,16 @@ impl ErasureSetHealer {
             }
         };
 
-        // 2. process objects with pagination to avoid loading all objects into memory
-        let mut continuation_token: Option<String> = None;
-        let mut total_scanned = 0u64;
-        let mut total_success = 0u64;
-        let mut total_failed = 0u64;
+        // 2. get objects to heal
+        let objects = storage.list_objects_for_heal(bucket, "").await?;
 
+        // 3. update progress
+        {
+            let mut p = progress.write().await;
+            p.objects_scanned += objects.len() as u64;
+        }
+
+        // 4. heal objects concurrently
         let heal_opts = HealOpts {
             scan_mode: HealScanMode::Normal,
             remove: true,   // remove corrupted data
@@ -442,65 +412,27 @@ impl ErasureSetHealer {
             ..Default::default()
         };
 
-        loop {
-            // Get one page of objects
-            let (objects, next_token, is_truncated) = storage
-                .list_objects_for_heal_page(bucket, "", continuation_token.as_deref())
-                .await?;
+        let object_results = Self::heal_objects_concurrently(storage, bucket, &objects, &heal_opts, progress).await;
 
-            let page_count = objects.len() as u64;
-            total_scanned += page_count;
+        // 5. count results
+        let (success_count, failure_count) = object_results
+            .into_iter()
+            .fold((0, 0), |(success, failure), result| match result {
+                Ok(_) => (success + 1, failure),
+                Err(_) => (success, failure + 1),
+            });
 
-            // 3. update progress
-            {
-                let mut p = progress.write().await;
-                p.objects_scanned = total_scanned;
-            }
-
-            // 4. heal objects concurrently for this page
-            let object_results = Self::heal_objects_concurrently(storage, bucket, &objects, &heal_opts, progress).await;
-
-            // 5. count results for this page
-            let (success_count, failure_count) =
-                object_results
-                    .into_iter()
-                    .fold((0, 0), |(success, failure), result| match result {
-                        Ok(_) => (success + 1, failure),
-                        Err(_) => (success, failure + 1),
-                    });
-
-            total_success += success_count;
-            total_failed += failure_count;
-
-            // 6. update progress
-            {
-                let mut p = progress.write().await;
-                p.objects_healed = total_success;
-                p.objects_failed = total_failed;
-                p.set_current_object(Some(format!("processing bucket: {bucket} (page)")));
-            }
-
-            // Check if there are more pages
-            if !is_truncated {
-                break;
-            }
-
-            continuation_token = next_token;
-            if continuation_token.is_none() {
-                warn!("List is truncated but no continuation token provided for {}", bucket);
-                break;
-            }
-        }
-
-        // 7. final progress update
+        // 6. update progress
         {
             let mut p = progress.write().await;
+            p.objects_healed += success_count;
+            p.objects_failed += failure_count;
             p.set_current_object(Some(format!("completed bucket: {bucket}")));
         }
 
         info!(
-            "Completed heal for bucket {}: {} success, {} failures (total scanned: {})",
-            bucket, total_success, total_failed, total_scanned
+            "Completed heal for bucket {}: {} success, {} failures",
+            bucket, success_count, failure_count
         );
 
         Ok(())
@@ -529,7 +461,7 @@ impl ErasureSetHealer {
                 let _permit = semaphore
                     .acquire()
                     .await
-                    .map_err(|e| Error::other(format!("Failed to acquire semaphore for object heal: {e}")))?;
+                    .map_err(|e| Error::other(format!("Failed to acquire semaphore for object heal: {}", e)))?;
 
                 match storage.heal_object(&bucket, &object, None, &heal_opts).await {
                     Ok((_result, None)) => {

crates/ahm/src/heal/manager.rs

@@ -22,7 +22,7 @@ use rustfs_ecstore::disk::DiskAPI;
 use rustfs_ecstore::disk::error::DiskError;
 use rustfs_ecstore::global::GLOBAL_LOCAL_DISK_MAP;
 use std::{
-    collections::{BinaryHeap, HashMap, HashSet},
+    collections::{HashMap, VecDeque},
     sync::Arc,
     time::{Duration, SystemTime},
 };
@@ -33,151 +33,6 @@ use tokio::{
 use tokio_util::sync::CancellationToken;
 use tracing::{error, info, warn};
 
-/// Priority queue wrapper for heal requests
-/// Uses BinaryHeap for priority-based ordering while maintaining FIFO for same-priority items
-#[derive(Debug)]
-struct PriorityHealQueue {
-    /// Heap of (priority, sequence, request) tuples
-    heap: BinaryHeap<PriorityQueueItem>,
-    /// Sequence counter for FIFO ordering within same priority
-    sequence: u64,
-    /// Set of request keys to prevent duplicates
-    dedup_keys: HashSet<String>,
-}
-
-/// Wrapper for heap items to implement proper ordering
-#[derive(Debug)]
-struct PriorityQueueItem {
-    priority: HealPriority,
-    sequence: u64,
-    request: HealRequest,
-}
-
-impl Eq for PriorityQueueItem {}
-
-impl PartialEq for PriorityQueueItem {
-    fn eq(&self, other: &Self) -> bool {
-        self.priority == other.priority && self.sequence == other.sequence
-    }
-}
-
-impl Ord for PriorityQueueItem {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        // First compare by priority (higher priority first)
-        match self.priority.cmp(&other.priority) {
-            std::cmp::Ordering::Equal => {
-                // If priorities are equal, use sequence for FIFO (lower sequence first)
-                other.sequence.cmp(&self.sequence)
-            }
-            ordering => ordering,
-        }
-    }
-}
-
-impl PartialOrd for PriorityQueueItem {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl PriorityHealQueue {
-    fn new() -> Self {
-        Self {
-            heap: BinaryHeap::new(),
-            sequence: 0,
-            dedup_keys: HashSet::new(),
-        }
-    }
-
-    fn len(&self) -> usize {
-        self.heap.len()
-    }
-
-    fn is_empty(&self) -> bool {
-        self.heap.is_empty()
-    }
-
-    fn push(&mut self, request: HealRequest) -> bool {
-        let key = Self::make_dedup_key(&request);
-
-        // Check for duplicates
-        if self.dedup_keys.contains(&key) {
-            return false; // Duplicate request, don't add
-        }
-
-        self.dedup_keys.insert(key);
-        self.sequence += 1;
-        self.heap.push(PriorityQueueItem {
-            priority: request.priority,
-            sequence: self.sequence,
-            request,
-        });
-        true
-    }
-
-    /// Get statistics about queue contents by priority
-    fn get_priority_stats(&self) -> HashMap<HealPriority, usize> {
-        let mut stats = HashMap::new();
-        for item in &self.heap {
-            *stats.entry(item.priority).or_insert(0) += 1;
-        }
-        stats
-    }
-
-    fn pop(&mut self) -> Option<HealRequest> {
-        self.heap.pop().map(|item| {
-            let key = Self::make_dedup_key(&item.request);
-            self.dedup_keys.remove(&key);
-            item.request
-        })
-    }
-
-    /// Create a deduplication key from a heal request
-    fn make_dedup_key(request: &HealRequest) -> String {
-        match &request.heal_type {
-            HealType::Object {
-                bucket,
-                object,
-                version_id,
-            } => {
-                format!("object:{}:{}:{}", bucket, object, version_id.as_deref().unwrap_or(""))
-            }
-            HealType::Bucket { bucket } => {
-                format!("bucket:{bucket}")
-            }
-            HealType::ErasureSet { set_disk_id, .. } => {
-                format!("erasure_set:{set_disk_id}")
-            }
-            HealType::Metadata { bucket, object } => {
-                format!("metadata:{bucket}:{object}")
-            }
-            HealType::MRF { meta_path } => {
-                format!("mrf:{meta_path}")
-            }
-            HealType::ECDecode {
-                bucket,
-                object,
-                version_id,
-            } => {
-                format!("ecdecode:{}:{}:{}", bucket, object, version_id.as_deref().unwrap_or(""))
-            }
-        }
-    }
-
-    /// Check if a request with the same key already exists in the queue
-    #[allow(dead_code)]
-    fn contains_key(&self, request: &HealRequest) -> bool {
-        let key = Self::make_dedup_key(request);
-        self.dedup_keys.contains(&key)
-    }
-
-    /// Check if an erasure set heal request for a specific set_disk_id exists
-    fn contains_erasure_set(&self, set_disk_id: &str) -> bool {
-        let key = format!("erasure_set:{set_disk_id}");
-        self.dedup_keys.contains(&key)
-    }
-}
-
 /// Heal config
 #[derive(Debug, Clone)]
 pub struct HealConfig {
@@ -195,28 +50,12 @@ pub struct HealConfig {
 
 impl Default for HealConfig {
     fn default() -> Self {
-        let queue_size: usize =
-            rustfs_utils::get_env_usize(rustfs_config::ENV_HEAL_QUEUE_SIZE, rustfs_config::DEFAULT_HEAL_QUEUE_SIZE);
-        let heal_interval = Duration::from_secs(rustfs_utils::get_env_u64(
-            rustfs_config::ENV_HEAL_INTERVAL_SECS,
-            rustfs_config::DEFAULT_HEAL_INTERVAL_SECS,
-        ));
-        let enable_auto_heal =
-            rustfs_utils::get_env_bool(rustfs_config::ENV_HEAL_AUTO_HEAL_ENABLE, rustfs_config::DEFAULT_HEAL_AUTO_HEAL_ENABLE);
-        let task_timeout = Duration::from_secs(rustfs_utils::get_env_u64(
-            rustfs_config::ENV_HEAL_TASK_TIMEOUT_SECS,
-            rustfs_config::DEFAULT_HEAL_TASK_TIMEOUT_SECS,
-        ));
-        let max_concurrent_heals = rustfs_utils::get_env_usize(
-            rustfs_config::ENV_HEAL_MAX_CONCURRENT_HEALS,
-            rustfs_config::DEFAULT_HEAL_MAX_CONCURRENT_HEALS,
-        );
         Self {
-            enable_auto_heal,
-            heal_interval,        // 10 seconds
-            max_concurrent_heals, // max 4,
-            task_timeout,         // 5 minutes
-            queue_size,
+            enable_auto_heal: true,
+            heal_interval: Duration::from_secs(10), // 10 seconds
+            max_concurrent_heals: 4,
+            task_timeout: Duration::from_secs(300), // 5 minutes
+            queue_size: 1000,
         }
     }
 }
@@ -246,8 +85,8 @@ pub struct HealManager {
     state: Arc<RwLock<HealState>>,
     /// Active heal tasks
     active_heals: Arc<Mutex<HashMap<String, Arc<HealTask>>>>,
-    /// Heal queue (priority-based)
-    heal_queue: Arc<Mutex<PriorityHealQueue>>,
+    /// Heal queue
+    heal_queue: Arc<Mutex<VecDeque<HealRequest>>>,
     /// Storage layer interface
     storage: Arc<dyn HealStorageAPI>,
     /// Cancel token
@@ -264,7 +103,7 @@ impl HealManager {
             config: Arc::new(RwLock::new(config)),
             state: Arc::new(RwLock::new(HealState::default())),
             active_heals: Arc::new(Mutex::new(HashMap::new())),
-            heal_queue: Arc::new(Mutex::new(PriorityHealQueue::new())),
+            heal_queue: Arc::new(Mutex::new(VecDeque::new())),
             storage,
             cancel_token: CancellationToken::new(),
             statistics: Arc::new(RwLock::new(HealStatistics::new())),
@@ -286,7 +125,7 @@ impl HealManager {
         // start scheduler
         self.start_scheduler().await?;
 
-        // start auto disk scanner to heal unformatted disks
+        // start auto disk scanner
         self.start_auto_disk_scanner().await?;
 
         info!("HealManager started successfully");
@@ -322,54 +161,17 @@ impl HealManager {
         let config = self.config.read().await;
         let mut queue = self.heal_queue.lock().await;
 
-        let queue_len = queue.len();
-        let queue_capacity = config.queue_size;
-
-        if queue_len >= queue_capacity {
+        if queue.len() >= config.queue_size {
             return Err(Error::ConfigurationError {
-                message: format!("Heal queue is full ({queue_len}/{queue_capacity})"),
+                message: "Heal queue is full".to_string(),
             });
         }
 
-        // Warn when queue is getting full (>80% capacity)
-        let capacity_threshold = (queue_capacity as f64 * 0.8) as usize;
-        if queue_len >= capacity_threshold {
-            warn!(
-                "Heal queue is {}% full ({}/{}). Consider increasing queue size or processing capacity.",
-                (queue_len * 100) / queue_capacity,
-                queue_len,
-                queue_capacity
-            );
-        }
-
         let request_id = request.id.clone();
-        let priority = request.priority;
-
-        // Try to push the request; if it's a duplicate, still return the request_id
-        let is_new = queue.push(request);
-
-        // Log queue statistics periodically (when adding high/urgent priority items)
-        if matches!(priority, HealPriority::High | HealPriority::Urgent) {
-            let stats = queue.get_priority_stats();
-            info!(
-                "Heal queue stats after adding {:?} priority request: total={}, urgent={}, high={}, normal={}, low={}",
-                priority,
-                queue_len + 1,
-                stats.get(&HealPriority::Urgent).unwrap_or(&0),
-                stats.get(&HealPriority::High).unwrap_or(&0),
-                stats.get(&HealPriority::Normal).unwrap_or(&0),
-                stats.get(&HealPriority::Low).unwrap_or(&0)
-            );
-        }
-
+        queue.push_back(request);
         drop(queue);
 
-        if is_new {
-            info!("Submitted heal request: {} with priority: {:?}", request_id, priority);
-        } else {
-            info!("Heal request already queued (duplicate): {}", request_id);
-        }
-
+        info!("Submitted heal request: {}", request_id);
         Ok(request_id)
     }
 
@@ -469,18 +271,13 @@ impl HealManager {
         let cancel_token = self.cancel_token.clone();
         let storage = self.storage.clone();
 
-        info!(
-            "start_auto_disk_scanner: Starting auto disk scanner with interval: {:?}",
-            config.read().await.heal_interval
-        );
-
         tokio::spawn(async move {
             let mut interval = interval(config.read().await.heal_interval);
 
             loop {
                 tokio::select! {
                     _ = cancel_token.cancelled() => {
-                        info!("start_auto_disk_scanner: Auto disk scanner received shutdown signal");
+                        info!("Auto disk scanner received shutdown signal");
                         break;
                     }
                     _ = interval.tick() => {
@@ -499,7 +296,6 @@ impl HealManager {
                         }
 
                         if endpoints.is_empty() {
-                            info!("start_auto_disk_scanner: No endpoints need healing");
                             continue;
                         }
 
@@ -507,7 +303,7 @@ impl HealManager {
                         let buckets = match storage.list_buckets().await {
                             Ok(buckets) => buckets.iter().map(|b| b.name.clone()).collect::<Vec<String>>(),
                             Err(e) => {
-                                error!("start_auto_disk_scanner: Failed to get bucket list for auto healing: {}", e);
+                                error!("Failed to get bucket list for auto healing: {}", e);
                                 continue;
                             }
                         };
@@ -517,7 +313,7 @@ impl HealManager {
                             let Some(set_disk_id) =
                                 crate::heal::utils::format_set_disk_id_from_i32(ep.pool_idx, ep.set_idx)
                             else {
-                                warn!("start_auto_disk_scanner: Skipping endpoint {} without valid pool/set index", ep);
+                                warn!("Skipping endpoint {} without valid pool/set index", ep);
                                 continue;
                             };
                             // skip if already queued or healing
@@ -525,7 +321,13 @@ impl HealManager {
                             let mut skip = false;
                             {
                                 let queue = heal_queue.lock().await;
-                                if queue.contains_erasure_set(&set_disk_id) {
+                                if queue.iter().any(|req| {
+                                    matches!(
+                                        &req.heal_type,
+                                        crate::heal::task::HealType::ErasureSet { set_disk_id: queued_id, .. }
+                                        if queued_id == &set_disk_id
+                                    )
+                                }) {
                                     skip = true;
                                 }
                             }
@@ -543,7 +345,6 @@ impl HealManager {
                             }
 
                             if skip {
-                                info!("start_auto_disk_scanner: Skipping auto erasure set heal for endpoint: {} (set_disk_id: {}) because it is already queued or healing", ep, set_disk_id);
                                 continue;
                             }
 
@@ -557,8 +358,8 @@ impl HealManager {
                                 HealPriority::Normal,
                             );
                             let mut queue = heal_queue.lock().await;
-                            queue.push(req);
-                            info!("start_auto_disk_scanner: Enqueued auto erasure set heal for endpoint: {} (set_disk_id: {})", ep, set_disk_id);
+                            queue.push_back(req);
+                            info!("Enqueued auto erasure set heal for endpoint: {} (set_disk_id: {})", ep, set_disk_id);
                         }
                     }
                 }
@@ -568,9 +369,8 @@ impl HealManager {
     }
 
     /// Process heal queue
-    /// Processes multiple tasks per cycle when capacity allows and queue has high-priority items
     async fn process_heal_queue(
-        heal_queue: &Arc<Mutex<PriorityHealQueue>>,
+        heal_queue: &Arc<Mutex<VecDeque<HealRequest>>>,
         active_heals: &Arc<Mutex<HashMap<String, Arc<HealTask>>>>,
         config: &Arc<RwLock<HealConfig>>,
         statistics: &Arc<RwLock<HealStatistics>>,
@@ -579,83 +379,51 @@ impl HealManager {
         let config = config.read().await;
         let mut active_heals_guard = active_heals.lock().await;
 
-        // Check if new heal tasks can be started
-        let active_count = active_heals_guard.len();
-        if active_count >= config.max_concurrent_heals {
+        // check if new heal tasks can be started
+        if active_heals_guard.len() >= config.max_concurrent_heals {
             return;
         }
 
-        // Calculate how many tasks we can start this cycle
-        let available_slots = config.max_concurrent_heals - active_count;
-
         let mut queue = heal_queue.lock().await;
-        let queue_len = queue.len();
+        if let Some(request) = queue.pop_front() {
+            let task = Arc::new(HealTask::from_request(request, storage.clone()));
+            let task_id = task.id.clone();
+            active_heals_guard.insert(task_id.clone(), task.clone());
+            drop(active_heals_guard);
+            let active_heals_clone = active_heals.clone();
+            let statistics_clone = statistics.clone();
 
-        if queue_len == 0 {
-            return;
-        }
-
-        // Process multiple tasks if:
-        // 1. We have available slots
-        // 2. Queue is not empty
-        // Prioritize urgent/high priority tasks by processing up to 2 tasks per cycle if available
-        let tasks_to_process = if queue_len > 0 {
-            std::cmp::min(available_slots, std::cmp::min(2, queue_len))
-        } else {
-            0
-        };
-
-        for _ in 0..tasks_to_process {
-            if let Some(request) = queue.pop() {
-                let task_priority = request.priority;
-                let task = Arc::new(HealTask::from_request(request, storage.clone()));
-                let task_id = task.id.clone();
-                active_heals_guard.insert(task_id.clone(), task.clone());
-                let active_heals_clone = active_heals.clone();
-                let statistics_clone = statistics.clone();
-
-                // start heal task
-                tokio::spawn(async move {
-                    info!("Starting heal task: {} with priority: {:?}", task_id, task_priority);
-                    let result = task.execute().await;
-                    match result {
-                        Ok(_) => {
-                            info!("Heal task completed successfully: {}", task_id);
+            // start heal task
+            tokio::spawn(async move {
+                info!("Starting heal task: {}", task_id);
+                let result = task.execute().await;
+                match result {
+                    Ok(_) => {
+                        info!("Heal task completed successfully: {}", task_id);
+                    }
+                    Err(e) => {
+                        error!("Heal task failed: {} - {}", task_id, e);
+                    }
+                }
+                let mut active_heals_guard = active_heals_clone.lock().await;
+                if let Some(completed_task) = active_heals_guard.remove(&task_id) {
+                    // update statistics
+                    let mut stats = statistics_clone.write().await;
+                    match completed_task.get_status().await {
+                        HealTaskStatus::Completed => {
+                            stats.update_task_completion(true);
                         }
-                        Err(e) => {
-                            error!("Heal task failed: {} - {}", task_id, e);
+                        _ => {
+                            stats.update_task_completion(false);
                         }
                     }
-                    let mut active_heals_guard = active_heals_clone.lock().await;
-                    if let Some(completed_task) = active_heals_guard.remove(&task_id) {
-                        // update statistics
-                        let mut stats = statistics_clone.write().await;
-                        match completed_task.get_status().await {
-                            HealTaskStatus::Completed => {
-                                stats.update_task_completion(true);
-                            }
-                            _ => {
-                                stats.update_task_completion(false);
-                            }
-                        }
-                        stats.update_running_tasks(active_heals_guard.len() as u64);
-                    }
-                });
-            } else {
-                break;
-            }
-        }
+                    stats.update_running_tasks(active_heals_guard.len() as u64);
+                }
+            });
 
-        // Update statistics for all started tasks
-        let mut stats = statistics.write().await;
-        stats.total_tasks += tasks_to_process as u64;
-
-        // Log queue status if items remain
-        if !queue.is_empty() {
-            let remaining = queue.len();
-            if remaining > 10 {
-                info!("Heal queue has {} pending requests, {} tasks active", remaining, active_heals_guard.len());
-            }
+            // update statistics
+            let mut stats = statistics.write().await;
+            stats.total_tasks += 1;
         }
     }
 }
@@ -670,333 +438,3 @@ impl std::fmt::Debug for HealManager {
             .finish()
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::heal::task::{HealOptions, HealPriority, HealRequest, HealType};
-
-    #[test]
-    fn test_priority_queue_ordering() {
-        let mut queue = PriorityHealQueue::new();
-
-        // Add requests with different priorities
-        let low_req = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket1".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Low,
-        );
-
-        let normal_req = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket2".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let high_req = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket3".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::High,
-        );
-
-        let urgent_req = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket4".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Urgent,
-        );
-
-        // Add in random order: low, high, normal, urgent
-        assert!(queue.push(low_req));
-        assert!(queue.push(high_req));
-        assert!(queue.push(normal_req));
-        assert!(queue.push(urgent_req));
-
-        assert_eq!(queue.len(), 4);
-
-        // Should pop in priority order: urgent, high, normal, low
-        let popped1 = queue.pop().unwrap();
-        assert_eq!(popped1.priority, HealPriority::Urgent);
-
-        let popped2 = queue.pop().unwrap();
-        assert_eq!(popped2.priority, HealPriority::High);
-
-        let popped3 = queue.pop().unwrap();
-        assert_eq!(popped3.priority, HealPriority::Normal);
-
-        let popped4 = queue.pop().unwrap();
-        assert_eq!(popped4.priority, HealPriority::Low);
-
-        assert_eq!(queue.len(), 0);
-    }
-
-    #[test]
-    fn test_priority_queue_fifo_same_priority() {
-        let mut queue = PriorityHealQueue::new();
-
-        // Add multiple requests with same priority
-        let req1 = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket1".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let req2 = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket2".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let req3 = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket3".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let id1 = req1.id.clone();
-        let id2 = req2.id.clone();
-        let id3 = req3.id.clone();
-
-        assert!(queue.push(req1));
-        assert!(queue.push(req2));
-        assert!(queue.push(req3));
-
-        // Should maintain FIFO order for same priority
-        let popped1 = queue.pop().unwrap();
-        assert_eq!(popped1.id, id1);
-
-        let popped2 = queue.pop().unwrap();
-        assert_eq!(popped2.id, id2);
-
-        let popped3 = queue.pop().unwrap();
-        assert_eq!(popped3.id, id3);
-    }
-
-    #[test]
-    fn test_priority_queue_deduplication() {
-        let mut queue = PriorityHealQueue::new();
-
-        let req1 = HealRequest::new(
-            HealType::Object {
-                bucket: "bucket1".to_string(),
-                object: "object1".to_string(),
-                version_id: None,
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let req2 = HealRequest::new(
-            HealType::Object {
-                bucket: "bucket1".to_string(),
-                object: "object1".to_string(),
-                version_id: None,
-            },
-            HealOptions::default(),
-            HealPriority::High,
-        );
-
-        // First request should be added
-        assert!(queue.push(req1));
-        assert_eq!(queue.len(), 1);
-
-        // Second request with same object should be rejected (duplicate)
-        assert!(!queue.push(req2));
-        assert_eq!(queue.len(), 1);
-    }
-
-    #[test]
-    fn test_priority_queue_contains_erasure_set() {
-        let mut queue = PriorityHealQueue::new();
-
-        let req = HealRequest::new(
-            HealType::ErasureSet {
-                buckets: vec!["bucket1".to_string()],
-                set_disk_id: "pool_0_set_1".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        assert!(queue.push(req));
-        assert!(queue.contains_erasure_set("pool_0_set_1"));
-        assert!(!queue.contains_erasure_set("pool_0_set_2"));
-    }
-
-    #[test]
-    fn test_priority_queue_dedup_key_generation() {
-        // Test different heal types generate different keys
-        let obj_req = HealRequest::new(
-            HealType::Object {
-                bucket: "bucket1".to_string(),
-                object: "object1".to_string(),
-                version_id: None,
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let bucket_req = HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket1".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let erasure_req = HealRequest::new(
-            HealType::ErasureSet {
-                buckets: vec!["bucket1".to_string()],
-                set_disk_id: "pool_0_set_1".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-
-        let obj_key = PriorityHealQueue::make_dedup_key(&obj_req);
-        let bucket_key = PriorityHealQueue::make_dedup_key(&bucket_req);
-        let erasure_key = PriorityHealQueue::make_dedup_key(&erasure_req);
-
-        // All keys should be different
-        assert_ne!(obj_key, bucket_key);
-        assert_ne!(obj_key, erasure_key);
-        assert_ne!(bucket_key, erasure_key);
-
-        assert!(obj_key.starts_with("object:"));
-        assert!(bucket_key.starts_with("bucket:"));
-        assert!(erasure_key.starts_with("erasure_set:"));
-    }
-
-    #[test]
-    fn test_priority_queue_mixed_priorities_and_types() {
-        let mut queue = PriorityHealQueue::new();
-
-        // Add various requests
-        let requests = vec![
-            (
-                HealType::Object {
-                    bucket: "b1".to_string(),
-                    object: "o1".to_string(),
-                    version_id: None,
-                },
-                HealPriority::Low,
-            ),
-            (
-                HealType::Bucket {
-                    bucket: "b2".to_string(),
-                },
-                HealPriority::Urgent,
-            ),
-            (
-                HealType::ErasureSet {
-                    buckets: vec!["b3".to_string()],
-                    set_disk_id: "pool_0_set_1".to_string(),
-                },
-                HealPriority::Normal,
-            ),
-            (
-                HealType::Object {
-                    bucket: "b4".to_string(),
-                    object: "o4".to_string(),
-                    version_id: None,
-                },
-                HealPriority::High,
-            ),
-        ];
-
-        for (heal_type, priority) in requests {
-            let req = HealRequest::new(heal_type, HealOptions::default(), priority);
-            queue.push(req);
-        }
-
-        assert_eq!(queue.len(), 4);
-
-        // Check they come out in priority order
-        let priorities: Vec<HealPriority> = (0..4).filter_map(|_| queue.pop().map(|r| r.priority)).collect();
-
-        assert_eq!(
-            priorities,
-            vec![
-                HealPriority::Urgent,
-                HealPriority::High,
-                HealPriority::Normal,
-                HealPriority::Low,
-            ]
-        );
-    }
-
-    #[test]
-    fn test_priority_queue_stats() {
-        let mut queue = PriorityHealQueue::new();
-
-        // Add requests with different priorities
-        for _ in 0..3 {
-            queue.push(HealRequest::new(
-                HealType::Bucket {
-                    bucket: format!("bucket-low-{}", queue.len()),
-                },
-                HealOptions::default(),
-                HealPriority::Low,
-            ));
-        }
-
-        for _ in 0..2 {
-            queue.push(HealRequest::new(
-                HealType::Bucket {
-                    bucket: format!("bucket-normal-{}", queue.len()),
-                },
-                HealOptions::default(),
-                HealPriority::Normal,
-            ));
-        }
-
-        queue.push(HealRequest::new(
-            HealType::Bucket {
-                bucket: "bucket-high".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::High,
-        ));
-
-        let stats = queue.get_priority_stats();
-
-        assert_eq!(*stats.get(&HealPriority::Low).unwrap_or(&0), 3);
-        assert_eq!(*stats.get(&HealPriority::Normal).unwrap_or(&0), 2);
-        assert_eq!(*stats.get(&HealPriority::High).unwrap_or(&0), 1);
-        assert_eq!(*stats.get(&HealPriority::Urgent).unwrap_or(&0), 0);
-    }
-
-    #[test]
-    fn test_priority_queue_is_empty() {
-        let mut queue = PriorityHealQueue::new();
-
-        assert!(queue.is_empty());
-
-        queue.push(HealRequest::new(
-            HealType::Bucket {
-                bucket: "test".to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        ));
-
-        assert!(!queue.is_empty());
-
-        queue.pop();
-
-        assert!(queue.is_empty());
-    }
-}

crates/ahm/src/heal/resume.rs

@@ -30,7 +30,7 @@ const RESUME_CHECKPOINT_FILE: &str = "ahm_checkpoint.json";
 /// Helper function to convert Path to &str, returning an error if conversion fails
 fn path_to_str(path: &Path) -> Result<&str> {
     path.to_str()
-        .ok_or_else(|| Error::other(format!("Invalid UTF-8 path: {path:?}")))
+        .ok_or_else(|| Error::other(format!("Invalid UTF-8 path: {:?}", path)))
 }
 
 /// resume state

crates/ahm/src/heal/storage.rs

@@ -107,21 +107,9 @@ pub trait HealStorageAPI: Send + Sync {
     /// Heal format using ecstore
     async fn heal_format(&self, dry_run: bool) -> Result<(HealResultItem, Option<Error>)>;
 
-    /// List objects for healing (returns all objects, may use significant memory for large buckets)
-    ///
-    /// WARNING: This method loads all objects into memory at once. For buckets with many objects,
-    /// consider using `list_objects_for_heal_page` instead to process objects in pages.
+    /// List objects for healing
     async fn list_objects_for_heal(&self, bucket: &str, prefix: &str) -> Result<Vec<String>>;
 
-    /// List objects for healing with pagination (returns one page and continuation token)
-    /// Returns (objects, next_continuation_token, is_truncated)
-    async fn list_objects_for_heal_page(
-        &self,
-        bucket: &str,
-        prefix: &str,
-        continuation_token: Option<&str>,
-    ) -> Result<(Vec<String>, Option<String>, bool)>;
-
     /// Get disk for resume functionality
     async fn get_disk_for_resume(&self, set_disk_id: &str) -> Result<DiskStore>;
 }
@@ -192,7 +180,8 @@ impl HealStorageAPI for ECStoreHealStorage {
                             MAX_READ_BYTES, bucket, object
                         );
                         return Err(Error::other(format!(
-                            "Object too large: {n_read} bytes (max: {MAX_READ_BYTES} bytes) for {bucket}/{object}"
+                            "Object too large: {} bytes (max: {} bytes) for {}/{}",
+                            n_read, MAX_READ_BYTES, bucket, object
                         )));
                     }
                 }
@@ -412,13 +401,13 @@ impl HealStorageAPI for ECStoreHealStorage {
         match self.ecstore.get_object_info(bucket, object, &Default::default()).await {
             Ok(_) => Ok(true), // Object exists
             Err(e) => {
-                // Map ObjectNotFound to false, other errors must be propagated!
+                // Map ObjectNotFound to false, other errors to false as well for safety
                 if matches!(e, rustfs_ecstore::error::StorageError::ObjectNotFound(_, _)) {
                     debug!("Object not found: {}/{}", bucket, object);
                     Ok(false)
                 } else {
-                    error!("Error checking object existence {}/{}: {}", bucket, object, e);
-                    Err(Error::other(e))
+                    debug!("Error checking object existence {}/{}: {}", bucket, object, e);
+                    Ok(false) // Treat errors as non-existence to be safe
                 }
             }
         }
@@ -505,67 +494,24 @@ impl HealStorageAPI for ECStoreHealStorage {
 
     async fn list_objects_for_heal(&self, bucket: &str, prefix: &str) -> Result<Vec<String>> {
         debug!("Listing objects for heal: {}/{}", bucket, prefix);
-        warn!(
-            "list_objects_for_heal loads all objects into memory. For large buckets, consider using list_objects_for_heal_page instead."
-        );
 
-        let mut all_objects = Vec::new();
-        let mut continuation_token: Option<String> = None;
-
-        loop {
-            let (page_objects, next_token, is_truncated) = self
-                .list_objects_for_heal_page(bucket, prefix, continuation_token.as_deref())
-                .await?;
-
-            all_objects.extend(page_objects);
-
-            if !is_truncated {
-                break;
-            }
-
-            continuation_token = next_token;
-            if continuation_token.is_none() {
-                warn!("List is truncated but no continuation token provided for {}/{}", bucket, prefix);
-                break;
-            }
-        }
-
-        info!("Found {} objects for heal in {}/{}", all_objects.len(), bucket, prefix);
-        Ok(all_objects)
-    }
-
-    async fn list_objects_for_heal_page(
-        &self,
-        bucket: &str,
-        prefix: &str,
-        continuation_token: Option<&str>,
-    ) -> Result<(Vec<String>, Option<String>, bool)> {
-        debug!("Listing objects for heal (page): {}/{}", bucket, prefix);
-
-        const MAX_KEYS: i32 = 1000;
-        let continuation_token_opt = continuation_token.map(|s| s.to_string());
-
-        // Use list_objects_v2 to get objects with pagination
-        let list_info = match self
+        // Use list_objects_v2 to get objects
+        match self
             .ecstore
             .clone()
-            .list_objects_v2(bucket, prefix, continuation_token_opt, None, MAX_KEYS, false, None, false)
+            .list_objects_v2(bucket, prefix, None, None, 1000, false, None)
             .await
         {
-            Ok(info) => info,
+            Ok(list_info) => {
+                let objects: Vec<String> = list_info.objects.into_iter().map(|obj| obj.name).collect();
+                info!("Found {} objects for heal in {}/{}", objects.len(), bucket, prefix);
+                Ok(objects)
+            }
             Err(e) => {
                 error!("Failed to list objects for heal: {}/{} - {}", bucket, prefix, e);
-                return Err(Error::other(e));
+                Err(Error::other(e))
             }
-        };
-
-        // Collect objects from this page
-        let page_objects: Vec<String> = list_info.objects.into_iter().map(|obj| obj.name).collect();
-        let page_count = page_objects.len();
-
-        debug!("Listed {} objects (page) for heal in {}/{}", page_count, bucket, prefix);
-
-        Ok((page_objects, list_info.next_continuation_token, list_info.is_truncated))
+        }
     }
 
     async fn get_disk_for_resume(&self, set_disk_id: &str) -> Result<DiskStore> {

crates/ahm/src/heal/task.rs

@@ -51,7 +51,7 @@ pub enum HealType {
 }
 
 /// Heal priority
-#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[derive(Debug, Default, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
 pub enum HealPriority {
     /// Low priority
     Low = 0,
@@ -272,7 +272,6 @@ impl HealTask {
         }
     }
 
-    #[tracing::instrument(skip(self), fields(task_id = %self.id, heal_type = ?self.heal_type))]
     pub async fn execute(&self) -> Result<()> {
         // update status and timestamps atomically to avoid race conditions
         let now = SystemTime::now();
@@ -286,7 +285,7 @@ impl HealTask {
             *task_start_instant = Some(start_instant);
         }
 
-        info!("Task started");
+        info!("Starting heal task: {} with type: {:?}", self.id, self.heal_type);
 
         let result = match &self.heal_type {
             HealType::Object {
@@ -316,7 +315,7 @@ impl HealTask {
             Ok(_) => {
                 let mut status = self.status.write().await;
                 *status = HealTaskStatus::Completed;
-                info!("Task completed successfully");
+                info!("Heal task completed successfully: {}", self.id);
             }
             Err(Error::TaskCancelled) => {
                 let mut status = self.status.write().await;
@@ -355,9 +354,8 @@ impl HealTask {
     }
 
     // specific heal implementation method
-    #[tracing::instrument(skip(self), fields(bucket = %bucket, object = %object, version_id = ?version_id))]
     async fn heal_object(&self, bucket: &str, object: &str, version_id: Option<&str>) -> Result<()> {
-        info!("Starting object heal workflow");
+        info!("Healing object: {}/{}", bucket, object);
 
         // update progress
         {
@@ -367,7 +365,7 @@ impl HealTask {
         }
 
         // Step 1: Check if object exists and get metadata
-        warn!("Step 1: Checking object existence and metadata");
+        info!("Step 1: Checking object existence and metadata");
         self.check_control_flags().await?;
         let object_exists = self.await_with_control(self.storage.object_exists(bucket, object)).await?;
         if !object_exists {
@@ -426,7 +424,7 @@ impl HealTask {
 
                     // If heal failed and remove_corrupted is enabled, delete the corrupted object
                     if self.options.remove_corrupted {
-                        info!("Removing corrupted object: {}/{}", bucket, object);
+                        warn!("Removing corrupted object: {}/{}", bucket, object);
                         if !self.options.dry_run {
                             self.await_with_control(self.storage.delete_object(bucket, object)).await?;
                             info!("Successfully deleted corrupted object: {}/{}", bucket, object);
@@ -449,9 +447,11 @@ impl HealTask {
                 info!("Step 3: Verifying heal result");
                 let object_size = result.object_size as u64;
                 info!(
-                    object_size = object_size,
-                    drives_healed = result.after.drives.len(),
-                    "Heal completed successfully"
+                    "Heal completed successfully: {}/{} ({} bytes, {} drives healed)",
+                    bucket,
+                    object,
+                    object_size,
+                    result.after.drives.len()
                 );
 
                 {
@@ -481,7 +481,7 @@ impl HealTask {
 
                 // If heal failed and remove_corrupted is enabled, delete the corrupted object
                 if self.options.remove_corrupted {
-                    info!("Removing corrupted object: {}/{}", bucket, object);
+                    warn!("Removing corrupted object: {}/{}", bucket, object);
                     if !self.options.dry_run {
                         self.await_with_control(self.storage.delete_object(bucket, object)).await?;
                         info!("Successfully deleted corrupted object: {}/{}", bucket, object);

crates/ahm/src/scanner/data_scanner.rs

@@ -29,7 +29,7 @@ use rustfs_ecstore::{
     self as ecstore, StorageAPI,
     bucket::versioning::VersioningApi,
     bucket::versioning_sys::BucketVersioningSys,
-    data_usage::{aggregate_local_snapshots, compute_bucket_usage, store_data_usage_in_backend},
+    data_usage::{aggregate_local_snapshots, store_data_usage_in_backend},
     disk::{Disk, DiskAPI, DiskStore, RUSTFS_META_BUCKET, WalkDirOptions},
     set_disk::SetDisks,
     store_api::ObjectInfo,
@@ -137,8 +137,6 @@ pub struct Scanner {
     data_usage_stats: Arc<Mutex<HashMap<String, DataUsageInfo>>>,
     /// Last data usage statistics collection time
     last_data_usage_collection: Arc<RwLock<Option<SystemTime>>>,
-    /// Backoff timestamp for heavy fallback collection
-    fallback_backoff_until: Arc<RwLock<Option<SystemTime>>>,
     /// Heal manager for auto-heal integration
     heal_manager: Option<Arc<HealManager>>,
 
@@ -194,7 +192,6 @@ impl Scanner {
             disk_metrics: Arc::new(Mutex::new(HashMap::new())),
             data_usage_stats: Arc::new(Mutex::new(HashMap::new())),
             last_data_usage_collection: Arc::new(RwLock::new(None)),
-            fallback_backoff_until: Arc::new(RwLock::new(None)),
             heal_manager,
             node_scanner,
             stats_aggregator,
@@ -476,8 +473,6 @@ impl Scanner {
             size: usage.total_size as i64,
             delete_marker: !usage.has_live_object && usage.delete_markers_count > 0,
             mod_time: usage.last_modified_ns.and_then(Self::ns_to_offset_datetime),
-            // Set is_latest to true for live objects - required for lifecycle expiration evaluation
-            is_latest: usage.has_live_object,
             ..Default::default()
         }
     }
@@ -605,7 +600,6 @@ impl Scanner {
 
         // Initialize and start the node scanner
         self.node_scanner.initialize_stats().await?;
-        // update object count and size for each bucket
         self.node_scanner.start().await?;
 
         // Set local stats in aggregator
@@ -620,6 +614,21 @@ impl Scanner {
             }
         });
 
+        // Trigger an immediate data usage collection so that admin APIs have fresh data after startup.
+        let scanner = self.clone_for_background();
+        tokio::spawn(async move {
+            let enable_stats = {
+                let cfg = scanner.config.read().await;
+                cfg.enable_data_usage_stats
+            };
+
+            if enable_stats {
+                if let Err(e) = scanner.collect_and_persist_data_usage().await {
+                    warn!("Initial data usage collection failed: {}", e);
+                }
+            }
+        });
+
         Ok(())
     }
 
@@ -884,7 +893,6 @@ impl Scanner {
     /// Collect and persist data usage statistics
     async fn collect_and_persist_data_usage(&self) -> Result<()> {
         info!("Starting data usage collection and persistence");
-        let now = SystemTime::now();
 
         // Get ECStore instance
         let Some(ecstore) = rustfs_ecstore::new_object_layer_fn() else {
@@ -892,10 +900,6 @@ impl Scanner {
             return Ok(());
         };
 
-        // Helper to avoid hammering the storage layer with repeated realtime scans.
-        let mut use_cached_on_backoff = false;
-        let fallback_backoff_secs = Duration::from_secs(300);
-
         // Run local usage scan and aggregate snapshots; fall back to on-demand build when necessary.
         let mut data_usage = match local_scan::scan_and_persist_local_usage(ecstore.clone()).await {
             Ok(outcome) => {
@@ -917,55 +921,16 @@ impl Scanner {
                             "Failed to aggregate local data usage snapshots, falling back to realtime collection: {}",
                             e
                         );
-                        match self.maybe_fallback_collection(now, fallback_backoff_secs, &ecstore).await? {
-                            Some(usage) => usage,
-                            None => {
-                                use_cached_on_backoff = true;
-                                DataUsageInfo::default()
-                            }
-                        }
+                        self.build_data_usage_from_ecstore(&ecstore).await?
                     }
                 }
             }
             Err(e) => {
                 warn!("Local usage scan failed (using realtime collection instead): {}", e);
-                match self.maybe_fallback_collection(now, fallback_backoff_secs, &ecstore).await? {
-                    Some(usage) => usage,
-                    None => {
-                        use_cached_on_backoff = true;
-                        DataUsageInfo::default()
-                    }
-                }
+                self.build_data_usage_from_ecstore(&ecstore).await?
             }
         };
 
-        // If heavy fallback was skipped due to backoff, try to reuse cached stats to avoid empty responses.
-        if use_cached_on_backoff && data_usage.buckets_usage.is_empty() {
-            let cached = {
-                let guard = self.data_usage_stats.lock().await;
-                guard.values().next().cloned()
-            };
-            if let Some(cached_usage) = cached {
-                data_usage = cached_usage;
-            }
-
-            // If there is still no data, try backend before persisting zeros
-            if data_usage.buckets_usage.is_empty() {
-                if let Ok(existing) = rustfs_ecstore::data_usage::load_data_usage_from_backend(ecstore.clone()).await {
-                    if !existing.buckets_usage.is_empty() {
-                        info!("Using existing backend data usage during fallback backoff");
-                        data_usage = existing;
-                    }
-                }
-            }
-
-            // Avoid overwriting valid backend stats with zeros when fallback is throttled
-            if data_usage.buckets_usage.is_empty() {
-                warn!("Skipping data usage persistence: fallback throttled and no cached/backend data available");
-                return Ok(());
-            }
-        }
-
         // Make sure bucket counters reflect aggregated content
         data_usage.buckets_count = data_usage.buckets_usage.len() as u64;
         if data_usage.last_update.is_none() {
@@ -1008,31 +973,8 @@ impl Scanner {
         Ok(())
     }
 
-    async fn maybe_fallback_collection(
-        &self,
-        now: SystemTime,
-        backoff: Duration,
-        ecstore: &Arc<rustfs_ecstore::store::ECStore>,
-    ) -> Result<Option<DataUsageInfo>> {
-        let backoff_until = *self.fallback_backoff_until.read().await;
-        let within_backoff = backoff_until.map(|ts| now < ts).unwrap_or(false);
-
-        if within_backoff {
-            warn!(
-                "Skipping heavy data usage fallback within backoff window (until {:?}); using cached stats if available",
-                backoff_until
-            );
-            return Ok(None);
-        }
-
-        let usage = self.build_data_usage_from_ecstore(ecstore).await?;
-        let mut backoff_guard = self.fallback_backoff_until.write().await;
-        *backoff_guard = Some(now + backoff);
-        Ok(Some(usage))
-    }
-
     /// Build data usage statistics directly from ECStore
-    pub async fn build_data_usage_from_ecstore(&self, ecstore: &Arc<rustfs_ecstore::store::ECStore>) -> Result<DataUsageInfo> {
+    async fn build_data_usage_from_ecstore(&self, ecstore: &Arc<rustfs_ecstore::store::ECStore>) -> Result<DataUsageInfo> {
         let mut data_usage = DataUsageInfo::default();
 
         // Get bucket list
@@ -1045,8 +987,6 @@ impl Scanner {
                 data_usage.last_update = Some(SystemTime::now());
 
                 let mut total_objects = 0u64;
-                let mut total_versions = 0u64;
-                let mut total_delete_markers = 0u64;
                 let mut total_size = 0u64;
 
                 for bucket_info in buckets {
@@ -1054,26 +994,36 @@ impl Scanner {
                         continue; // Skip system buckets
                     }
 
-                    // Use ecstore pagination helper to avoid truncating at 100 objects
-                    let (object_count, bucket_size, versions_count, delete_markers) =
-                        match compute_bucket_usage(ecstore.clone(), &bucket_info.name).await {
-                            Ok(usage) => (usage.objects_count, usage.size, usage.versions_count, usage.delete_markers_count),
-                            Err(e) => {
-                                warn!("Failed to compute bucket usage for {}: {}", bucket_info.name, e);
-                                (0, 0, 0, 0)
-                            }
-                        };
+                    // Try to get actual object count for this bucket
+                    let (object_count, bucket_size) = match ecstore
+                        .clone()
+                        .list_objects_v2(
+                            &bucket_info.name,
+                            "",    // prefix
+                            None,  // continuation_token
+                            None,  // delimiter
+                            100,   // max_keys - small limit for performance
+                            false, // fetch_owner
+                            None,  // start_after
+                        )
+                        .await
+                    {
+                        Ok(result) => {
+                            let count = result.objects.len() as u64;
+                            let size = result.objects.iter().map(|obj| obj.size as u64).sum();
+                            (count, size)
+                        }
+                        Err(_) => (0, 0),
+                    };
 
                     total_objects += object_count;
-                    total_versions += versions_count;
-                    total_delete_markers += delete_markers;
                     total_size += bucket_size;
 
                     let bucket_usage = rustfs_common::data_usage::BucketUsageInfo {
                         size: bucket_size,
                         objects_count: object_count,
-                        versions_count,
-                        delete_markers_count: delete_markers,
+                        versions_count: object_count, // Simplified
+                        delete_markers_count: 0,
                         ..Default::default()
                     };
 
@@ -1083,8 +1033,7 @@ impl Scanner {
 
                 data_usage.objects_total_count = total_objects;
                 data_usage.objects_total_size = total_size;
-                data_usage.versions_total_count = total_versions;
-                data_usage.delete_markers_total_count = total_delete_markers;
+                data_usage.versions_total_count = total_objects;
             }
             Err(e) => {
                 warn!("Failed to list buckets for data usage collection: {}", e);
@@ -2618,7 +2567,6 @@ impl Scanner {
             disk_metrics: Arc::clone(&self.disk_metrics),
             data_usage_stats: Arc::clone(&self.data_usage_stats),
             last_data_usage_collection: Arc::clone(&self.last_data_usage_collection),
-            fallback_backoff_until: Arc::clone(&self.fallback_backoff_until),
             heal_manager: self.heal_manager.clone(),
             node_scanner: Arc::clone(&self.node_scanner),
             stats_aggregator: Arc::clone(&self.stats_aggregator),

crates/ahm/src/scanner/local_scan/mod.rs

@@ -84,9 +84,6 @@ pub async fn scan_and_persist_local_usage(store: Arc<ECStore>) -> Result<LocalSc
                 guard.clone()
             };
 
-            // Use the first local online disk in the set to avoid missing stats when disk 0 is down
-            let mut picked = false;
-
             for (disk_index, disk_opt) in disks.into_iter().enumerate() {
                 let Some(disk) = disk_opt else {
                     continue;
@@ -96,17 +93,11 @@ pub async fn scan_and_persist_local_usage(store: Arc<ECStore>) -> Result<LocalSc
                     continue;
                 }
 
-                if picked {
+                // Count objects once by scanning only disk index zero from each set.
+                if disk_index != 0 {
                     continue;
                 }
 
-                // Skip offline disks; keep looking for an online candidate
-                if !disk.is_online().await {
-                    continue;
-                }
-
-                picked = true;
-
                 let disk_id = match disk.get_disk_id().await.map_err(Error::from)? {
                     Some(id) => id.to_string(),
                     None => {

crates/ahm/src/scanner/node_scanner.rs

@@ -711,7 +711,6 @@ impl NodeScanner {
         // start scanning loop
         let scanner_clone = self.clone_for_background();
         tokio::spawn(async move {
-            // update object count and size for each bucket
             if let Err(e) = scanner_clone.scan_loop_with_resume(None).await {
                 error!("scanning loop failed: {}", e);
             }

crates/ahm/src/scanner/stats_aggregator.rs

@@ -347,8 +347,7 @@ impl DecentralizedStatsAggregator {
 
         // update cache
         *self.cached_stats.write().await = Some(aggregated.clone());
-        // Use the time when aggregation completes as cache timestamp to avoid premature expiry during long runs
-        *self.cache_timestamp.write().await = SystemTime::now();
+        *self.cache_timestamp.write().await = aggregation_timestamp;
 
         Ok(aggregated)
     }
@@ -360,8 +359,7 @@ impl DecentralizedStatsAggregator {
 
         // update cache
         *self.cached_stats.write().await = Some(aggregated.clone());
-        // Cache timestamp should reflect completion time rather than aggregation start
-        *self.cache_timestamp.write().await = SystemTime::now();
+        *self.cache_timestamp.write().await = now;
 
         Ok(aggregated)
     }

crates/ahm/tests/data_usage_fallback_test.rs

@@ -1,97 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#![cfg(test)]
-
-use rustfs_ahm::scanner::data_scanner::Scanner;
-use rustfs_common::data_usage::DataUsageInfo;
-use rustfs_ecstore::GLOBAL_Endpoints;
-use rustfs_ecstore::bucket::metadata_sys::{BucketMetadataSys, GLOBAL_BucketMetadataSys};
-use rustfs_ecstore::endpoints::EndpointServerPools;
-use rustfs_ecstore::store::ECStore;
-use rustfs_ecstore::store_api::{ObjectIO, PutObjReader, StorageAPI};
-use std::sync::Arc;
-use tempfile::TempDir;
-use tokio::sync::RwLock;
-use tokio_util::sync::CancellationToken;
-
-/// Build a minimal single-node ECStore over a temp directory and populate objects.
-async fn create_store_with_objects(count: usize) -> (TempDir, std::sync::Arc<ECStore>) {
-    let temp_dir = TempDir::new().expect("temp dir");
-    let root = temp_dir.path().to_string_lossy().to_string();
-
-    // Create endpoints from the temp dir
-    let (endpoint_pools, _setup) = EndpointServerPools::from_volumes("127.0.0.1:0", vec![root])
-        .await
-        .expect("endpoint pools");
-
-    // Seed globals required by metadata sys if not already set
-    if GLOBAL_Endpoints.get().is_none() {
-        let _ = GLOBAL_Endpoints.set(endpoint_pools.clone());
-    }
-
-    let store = ECStore::new("127.0.0.1:0".parse().unwrap(), endpoint_pools, CancellationToken::new())
-        .await
-        .expect("create store");
-
-    if rustfs_ecstore::global::new_object_layer_fn().is_none() {
-        rustfs_ecstore::global::set_object_layer(store.clone()).await;
-    }
-
-    // Initialize metadata system before bucket operations
-    if GLOBAL_BucketMetadataSys.get().is_none() {
-        let mut sys = BucketMetadataSys::new(store.clone());
-        sys.init(Vec::new()).await;
-        let _ = GLOBAL_BucketMetadataSys.set(Arc::new(RwLock::new(sys)));
-    }
-
-    store
-        .make_bucket("fallback-bucket", &rustfs_ecstore::store_api::MakeBucketOptions::default())
-        .await
-        .expect("make bucket");
-
-    for i in 0..count {
-        let key = format!("obj-{i:04}");
-        let data = format!("payload-{i}");
-        let mut reader = PutObjReader::from_vec(data.into_bytes());
-        store
-            .put_object("fallback-bucket", &key, &mut reader, &rustfs_ecstore::store_api::ObjectOptions::default())
-            .await
-            .expect("put object");
-    }
-
-    (temp_dir, store)
-}
-
-#[tokio::test]
-async fn fallback_builds_full_counts_over_100_objects() {
-    let (_tmp, store) = create_store_with_objects(1000).await;
-    let scanner = Scanner::new(None, None);
-
-    // Directly call the fallback builder to ensure pagination works.
-    let usage: DataUsageInfo = scanner.build_data_usage_from_ecstore(&store).await.expect("fallback usage");
-
-    let bucket = usage.buckets_usage.get("fallback-bucket").expect("bucket usage present");
-
-    assert!(
-        usage.objects_total_count >= 1000,
-        "total objects should be >=1000, got {}",
-        usage.objects_total_count
-    );
-    assert!(
-        bucket.objects_count >= 1000,
-        "bucket objects should be >=1000, got {}",
-        bucket.objects_count
-    );
-}

crates/ahm/tests/heal_bug_fixes_test.rs

@@ -244,14 +244,6 @@ fn test_heal_task_status_atomic_update() {
         async fn list_objects_for_heal(&self, _bucket: &str, _prefix: &str) -> rustfs_ahm::Result<Vec<String>> {
             Ok(vec![])
         }
-        async fn list_objects_for_heal_page(
-            &self,
-            _bucket: &str,
-            _prefix: &str,
-            _continuation_token: Option<&str>,
-        ) -> rustfs_ahm::Result<(Vec<String>, Option<String>, bool)> {
-            Ok((vec![], None, false))
-        }
         async fn get_disk_for_resume(&self, _set_disk_id: &str) -> rustfs_ahm::Result<rustfs_ecstore::disk::DiskStore> {
             Err(rustfs_ahm::Error::other("Not implemented in mock"))
         }

crates/ahm/tests/lifecycle_cache_test.rs

@@ -144,7 +144,7 @@ async fn setup_test_env() -> (Vec<PathBuf>, Arc<ECStore>) {
     let mut wtxn = lmdb_env.write_txn().unwrap();
     let db = match lmdb_env
         .database_options()
-        .name(&format!("bucket_{bucket_name}"))
+        .name(&format!("bucket_{}", bucket_name))
         .types::<I64<BigEndian>, LifecycleContentCodec>()
         .flags(DatabaseFlags::DUP_SORT)
         //.dup_sort_comparator::<>()
@@ -152,7 +152,7 @@ async fn setup_test_env() -> (Vec<PathBuf>, Arc<ECStore>) {
     {
         Ok(db) => db,
         Err(err) => {
-            panic!("lmdb error: {err}");
+            panic!("lmdb error: {}", err);
         }
     };
     let _ = wtxn.commit();
@@ -199,7 +199,7 @@ async fn upload_test_object(ecstore: &Arc<ECStore>, bucket: &str, object: &str,
         .await
         .expect("Failed to upload test object");
 
-    println!("object_info1: {object_info:?}");
+    println!("object_info1: {:?}", object_info);
 
     info!("Uploaded test object: {}/{} ({} bytes)", bucket, object, object_info.size);
 }
@@ -456,7 +456,7 @@ mod serial_tests {
                     }
 
                     let object_info = convert_record_to_object_info(record);
-                    println!("object_info2: {object_info:?}");
+                    println!("object_info2: {:?}", object_info);
                     let mod_time = object_info.mod_time.unwrap_or(OffsetDateTime::now_utc());
                     let expiry_time = rustfs_ecstore::bucket::lifecycle::lifecycle::expected_expiry_time(mod_time, 1);
 
@@ -494,9 +494,9 @@ mod serial_tests {
                             type_,
                             object_name,
                         } = &elm.1;
-                        println!("cache row:{ver_no} {ver_id} {mod_time} {type_:?} {object_name}");
+                        println!("cache row:{} {} {} {:?} {}", ver_no, ver_id, mod_time, type_, object_name);
                     }
-                    println!("row:{row:?}");
+                    println!("row:{:?}", row);
                 }
                 //drop(iter);
                 wtxn.commit().unwrap();

crates/ahm/tests/lifecycle_integration_test.rs

@@ -277,11 +277,11 @@ async fn create_test_tier(server: u32) {
     };
     let mut tier_config_mgr = GLOBAL_TierConfigMgr.write().await;
     if let Err(err) = tier_config_mgr.add(args, false).await {
-        println!("tier_config_mgr add failed, e: {err:?}");
+        println!("tier_config_mgr add failed, e: {:?}", err);
         panic!("tier add failed. {err}");
     }
     if let Err(e) = tier_config_mgr.save().await {
-        println!("tier_config_mgr save failed, e: {e:?}");
+        println!("tier_config_mgr save failed, e: {:?}", e);
         panic!("tier save failed");
     }
     println!("Created test tier: COLDTIER44");
@@ -299,7 +299,7 @@ async fn object_exists(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bo
 #[allow(dead_code)]
 async fn object_is_delete_marker(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
     if let Ok(oi) = (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
-        println!("oi: {oi:?}");
+        println!("oi: {:?}", oi);
         oi.delete_marker
     } else {
         println!("object_is_delete_marker is error");
@@ -311,7 +311,7 @@ async fn object_is_delete_marker(ecstore: &Arc<ECStore>, bucket: &str, object: &
 #[allow(dead_code)]
 async fn object_is_transitioned(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
     if let Ok(oi) = (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
-        println!("oi: {oi:?}");
+        println!("oi: {:?}", oi);
         !oi.transitioned_object.status.is_empty()
     } else {
         println!("object_is_transitioned is error");

crates/appauth/Cargo.toml

@@ -29,7 +29,6 @@ base64-simd = { workspace = true }
 rsa = { workspace = true }
 serde.workspace = true
 serde_json.workspace = true
-rand.workspace = true
 
 [lints]
 workspace = true

crates/appauth/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
-  <a href="https://docs.rustfs.com/">📖 Documentation</a>
+  <a href="https://docs.rustfs.com/en/">📖 Documentation</a>
   · <a href="https://github.com/rustfs/rustfs/issues">🐛 Bug Reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">💬 Discussions</a>
 </p>

crates/appauth/src/token.rs

@@ -12,9 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use rsa::Pkcs1v15Encrypt;
 use rsa::{
-    Pkcs1v15Encrypt, RsaPrivateKey, RsaPublicKey,
+    RsaPrivateKey, RsaPublicKey,
     pkcs8::{DecodePrivateKey, DecodePublicKey},
+    rand_core::OsRng,
 };
 use serde::{Deserialize, Serialize};
 use std::io::{Error, Result};
@@ -31,9 +33,8 @@ pub struct Token {
 /// Returns the encrypted string processed by base64
 pub fn gencode(token: &Token, key: &str) -> Result<String> {
     let data = serde_json::to_vec(token)?;
-    let mut rng = rand::rng();
     let public_key = RsaPublicKey::from_public_key_pem(key).map_err(Error::other)?;
-    let encrypted_data = public_key.encrypt(&mut rng, Pkcs1v15Encrypt, &data).map_err(Error::other)?;
+    let encrypted_data = public_key.encrypt(&mut OsRng, Pkcs1v15Encrypt, &data).map_err(Error::other)?;
     Ok(base64_simd::URL_SAFE_NO_PAD.encode_to_string(&encrypted_data))
 }
 
@@ -75,10 +76,9 @@ mod tests {
         pkcs8::{EncodePrivateKey, EncodePublicKey, LineEnding},
     };
     use std::time::{SystemTime, UNIX_EPOCH};
-
     #[test]
     fn test_gencode_and_parse() {
-        let mut rng = rand::rng();
+        let mut rng = OsRng;
         let bits = 2048;
         let private_key = RsaPrivateKey::new(&mut rng, bits).expect("Failed to generate private key");
         let public_key = RsaPublicKey::from(&private_key);
@@ -101,8 +101,7 @@ mod tests {
 
     #[test]
     fn test_parse_invalid_token() {
-        let mut rng = rand::rng();
-        let private_key_pem = RsaPrivateKey::new(&mut rng, 2048)
+        let private_key_pem = RsaPrivateKey::new(&mut OsRng, 2048)
             .expect("Failed to generate private key")
             .to_pkcs8_pem(LineEnding::LF)
             .unwrap();

crates/audit/Cargo.toml

@@ -29,12 +29,8 @@ categories = ["web-programming", "development-tools", "asynchronous", "api-bindi
 rustfs-targets = { workspace = true }
 rustfs-config = { workspace = true, features = ["audit", "constants"] }
 rustfs-ecstore = { workspace = true }
-async-trait = { workspace = true }
 chrono = { workspace = true }
-const-str = { workspace = true }
 futures = { workspace = true }
-hashbrown = { workspace = true }
-metrics = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
@@ -43,6 +39,5 @@ tracing = { workspace = true, features = ["std", "attributes"] }
 url = { workspace = true }
 rumqttc = { workspace = true }
 
-
 [lints]
 workspace = true

crates/audit/src/entity.rs

@@ -13,10 +13,18 @@
 // limitations under the License.
 
 use chrono::{DateTime, Utc};
-use hashbrown::HashMap;
 use rustfs_targets::EventName;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use std::collections::HashMap;
+
+/// Trait for types that can be serialized to JSON and have a timestamp
+pub trait LogRecord {
+    /// Serialize the record to a JSON string
+    fn to_json(&self) -> String;
+    /// Get the timestamp of the record
+    fn get_timestamp(&self) -> chrono::DateTime<chrono::Utc>;
+}
 
 /// ObjectVersion represents an object version with key and versionId
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
@@ -28,12 +36,19 @@ pub struct ObjectVersion {
 }
 
 impl ObjectVersion {
-    pub fn new(object_name: String, version_id: Option<String>) -> Self {
-        Self { object_name, version_id }
+    /// Set the object name (chainable)
+    pub fn set_object_name(&mut self, name: String) -> &mut Self {
+        self.object_name = name;
+        self
+    }
+    /// Set the version ID (chainable)
+    pub fn set_version_id(&mut self, version_id: Option<String>) -> &mut Self {
+        self.version_id = version_id;
+        self
     }
 }
 
-/// `ApiDetails` contains API information for the audit entry.
+/// ApiDetails contains API information for the audit entry
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ApiDetails {
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -64,86 +79,75 @@ pub struct ApiDetails {
     pub time_to_response_in_ns: Option<String>,
 }
 
-/// Builder for `ApiDetails`.
-#[derive(Default, Clone)]
-pub struct ApiDetailsBuilder(pub ApiDetails);
-
-impl ApiDetailsBuilder {
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    pub fn name(mut self, name: impl Into<String>) -> Self {
-        self.0.name = Some(name.into());
+impl ApiDetails {
+    /// Set API name (chainable)
+    pub fn set_name(&mut self, name: Option<String>) -> &mut Self {
+        self.name = name;
         self
     }
-
-    pub fn bucket(mut self, bucket: impl Into<String>) -> Self {
-        self.0.bucket = Some(bucket.into());
+    /// Set bucket name (chainable)
+    pub fn set_bucket(&mut self, bucket: Option<String>) -> &mut Self {
+        self.bucket = bucket;
         self
     }
-
-    pub fn object(mut self, object: impl Into<String>) -> Self {
-        self.0.object = Some(object.into());
+    /// Set object name (chainable)
+    pub fn set_object(&mut self, object: Option<String>) -> &mut Self {
+        self.object = object;
         self
     }
-
-    pub fn objects(mut self, objects: Vec<ObjectVersion>) -> Self {
-        self.0.objects = Some(objects);
+    /// Set objects list (chainable)
+    pub fn set_objects(&mut self, objects: Option<Vec<ObjectVersion>>) -> &mut Self {
+        self.objects = objects;
         self
     }
-
-    pub fn status(mut self, status: impl Into<String>) -> Self {
-        self.0.status = Some(status.into());
+    /// Set status (chainable)
+    pub fn set_status(&mut self, status: Option<String>) -> &mut Self {
+        self.status = status;
         self
     }
-
-    pub fn status_code(mut self, code: i32) -> Self {
-        self.0.status_code = Some(code);
+    /// Set status code (chainable)
+    pub fn set_status_code(&mut self, code: Option<i32>) -> &mut Self {
+        self.status_code = code;
         self
     }
-
-    pub fn input_bytes(mut self, bytes: i64) -> Self {
-        self.0.input_bytes = Some(bytes);
+    /// Set input bytes (chainable)
+    pub fn set_input_bytes(&mut self, bytes: Option<i64>) -> &mut Self {
+        self.input_bytes = bytes;
         self
     }
-
-    pub fn output_bytes(mut self, bytes: i64) -> Self {
-        self.0.output_bytes = Some(bytes);
+    /// Set output bytes (chainable)
+    pub fn set_output_bytes(&mut self, bytes: Option<i64>) -> &mut Self {
+        self.output_bytes = bytes;
         self
     }
-
-    pub fn header_bytes(mut self, bytes: i64) -> Self {
-        self.0.header_bytes = Some(bytes);
+    /// Set header bytes (chainable)
+    pub fn set_header_bytes(&mut self, bytes: Option<i64>) -> &mut Self {
+        self.header_bytes = bytes;
         self
     }
-
-    pub fn time_to_first_byte(mut self, t: impl Into<String>) -> Self {
-        self.0.time_to_first_byte = Some(t.into());
+    /// Set time to first byte (chainable)
+    pub fn set_time_to_first_byte(&mut self, t: Option<String>) -> &mut Self {
+        self.time_to_first_byte = t;
         self
     }
-
-    pub fn time_to_first_byte_in_ns(mut self, t: impl Into<String>) -> Self {
-        self.0.time_to_first_byte_in_ns = Some(t.into());
+    /// Set time to first byte in nanoseconds (chainable)
+    pub fn set_time_to_first_byte_in_ns(&mut self, t: Option<String>) -> &mut Self {
+        self.time_to_first_byte_in_ns = t;
         self
     }
-
-    pub fn time_to_response(mut self, t: impl Into<String>) -> Self {
-        self.0.time_to_response = Some(t.into());
+    /// Set time to response (chainable)
+    pub fn set_time_to_response(&mut self, t: Option<String>) -> &mut Self {
+        self.time_to_response = t;
         self
     }
-
-    pub fn time_to_response_in_ns(mut self, t: impl Into<String>) -> Self {
-        self.0.time_to_response_in_ns = Some(t.into());
+    /// Set time to response in nanoseconds (chainable)
+    pub fn set_time_to_response_in_ns(&mut self, t: Option<String>) -> &mut Self {
+        self.time_to_response_in_ns = t;
         self
     }
-
-    pub fn build(self) -> ApiDetails {
-        self.0
-    }
 }
 
-/// `AuditEntry` represents an audit log entry.
+/// AuditEntry represents an audit log entry
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct AuditEntry {
     pub version: String,
@@ -151,7 +155,6 @@ pub struct AuditEntry {
     pub deployment_id: Option<String>,
     #[serde(rename = "siteName", skip_serializing_if = "Option::is_none")]
     pub site_name: Option<String>,
-    #[serde(with = "chrono::serde::ts_milliseconds")]
     pub time: DateTime<Utc>,
     pub event: EventName,
     #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
@@ -188,130 +191,200 @@ pub struct AuditEntry {
     pub error: Option<String>,
 }
 
-/// Constructor for `AuditEntry`.
-pub struct AuditEntryBuilder(AuditEntry);
-
-impl AuditEntryBuilder {
-    /// Create a new builder with all required fields.
-    pub fn new(version: impl Into<String>, event: EventName, trigger: impl Into<String>, api: ApiDetails) -> Self {
-        Self(AuditEntry {
-            version: version.into(),
-            time: Utc::now(),
+impl AuditEntry {
+    /// Create a new AuditEntry with required fields
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        version: String,
+        deployment_id: Option<String>,
+        site_name: Option<String>,
+        time: DateTime<Utc>,
+        event: EventName,
+        entry_type: Option<String>,
+        trigger: String,
+        api: ApiDetails,
+    ) -> Self {
+        AuditEntry {
+            version,
+            deployment_id,
+            site_name,
+            time,
             event,
-            trigger: trigger.into(),
+            entry_type,
+            trigger,
             api,
-            ..Default::default()
-        })
+            remote_host: None,
+            request_id: None,
+            user_agent: None,
+            req_path: None,
+            req_host: None,
+            req_node: None,
+            req_claims: None,
+            req_query: None,
+            req_header: None,
+            resp_header: None,
+            tags: None,
+            access_key: None,
+            parent_user: None,
+            error: None,
+        }
     }
 
-    // event
-    pub fn version(mut self, version: impl Into<String>) -> Self {
-        self.0.version = version.into();
+    /// Set version (chainable)
+    pub fn set_version(&mut self, version: String) -> &mut Self {
+        self.version = version;
+        self
+    }
+    /// Set deployment ID (chainable)
+    pub fn set_deployment_id(&mut self, id: Option<String>) -> &mut Self {
+        self.deployment_id = id;
+        self
+    }
+    /// Set site name (chainable)
+    pub fn set_site_name(&mut self, name: Option<String>) -> &mut Self {
+        self.site_name = name;
+        self
+    }
+    /// Set time (chainable)
+    pub fn set_time(&mut self, time: DateTime<Utc>) -> &mut Self {
+        self.time = time;
+        self
+    }
+    /// Set event (chainable)
+    pub fn set_event(&mut self, event: EventName) -> &mut Self {
+        self.event = event;
+        self
+    }
+    /// Set entry type (chainable)
+    pub fn set_entry_type(&mut self, entry_type: Option<String>) -> &mut Self {
+        self.entry_type = entry_type;
+        self
+    }
+    /// Set trigger (chainable)
+    pub fn set_trigger(&mut self, trigger: String) -> &mut Self {
+        self.trigger = trigger;
+        self
+    }
+    /// Set API details (chainable)
+    pub fn set_api(&mut self, api: ApiDetails) -> &mut Self {
+        self.api = api;
+        self
+    }
+    /// Set remote host (chainable)
+    pub fn set_remote_host(&mut self, host: Option<String>) -> &mut Self {
+        self.remote_host = host;
+        self
+    }
+    /// Set request ID (chainable)
+    pub fn set_request_id(&mut self, id: Option<String>) -> &mut Self {
+        self.request_id = id;
+        self
+    }
+    /// Set user agent (chainable)
+    pub fn set_user_agent(&mut self, agent: Option<String>) -> &mut Self {
+        self.user_agent = agent;
+        self
+    }
+    /// Set request path (chainable)
+    pub fn set_req_path(&mut self, path: Option<String>) -> &mut Self {
+        self.req_path = path;
+        self
+    }
+    /// Set request host (chainable)
+    pub fn set_req_host(&mut self, host: Option<String>) -> &mut Self {
+        self.req_host = host;
+        self
+    }
+    /// Set request node (chainable)
+    pub fn set_req_node(&mut self, node: Option<String>) -> &mut Self {
+        self.req_node = node;
+        self
+    }
+    /// Set request claims (chainable)
+    pub fn set_req_claims(&mut self, claims: Option<HashMap<String, Value>>) -> &mut Self {
+        self.req_claims = claims;
+        self
+    }
+    /// Set request query (chainable)
+    pub fn set_req_query(&mut self, query: Option<HashMap<String, String>>) -> &mut Self {
+        self.req_query = query;
+        self
+    }
+    /// Set request header (chainable)
+    pub fn set_req_header(&mut self, header: Option<HashMap<String, String>>) -> &mut Self {
+        self.req_header = header;
+        self
+    }
+    /// Set response header (chainable)
+    pub fn set_resp_header(&mut self, header: Option<HashMap<String, String>>) -> &mut Self {
+        self.resp_header = header;
+        self
+    }
+    /// Set tags (chainable)
+    pub fn set_tags(&mut self, tags: Option<HashMap<String, Value>>) -> &mut Self {
+        self.tags = tags;
+        self
+    }
+    /// Set access key (chainable)
+    pub fn set_access_key(&mut self, key: Option<String>) -> &mut Self {
+        self.access_key = key;
+        self
+    }
+    /// Set parent user (chainable)
+    pub fn set_parent_user(&mut self, user: Option<String>) -> &mut Self {
+        self.parent_user = user;
+        self
+    }
+    /// Set error message (chainable)
+    pub fn set_error(&mut self, error: Option<String>) -> &mut Self {
+        self.error = error;
         self
     }
 
-    pub fn event(mut self, event: EventName) -> Self {
-        self.0.event = event;
-        self
-    }
-
-    pub fn api(mut self, api_details: ApiDetails) -> Self {
-        self.0.api = api_details;
-        self
-    }
-
-    pub fn deployment_id(mut self, id: impl Into<String>) -> Self {
-        self.0.deployment_id = Some(id.into());
-        self
-    }
-
-    pub fn site_name(mut self, name: impl Into<String>) -> Self {
-        self.0.site_name = Some(name.into());
-        self
-    }
-
-    pub fn time(mut self, time: DateTime<Utc>) -> Self {
-        self.0.time = time;
-        self
-    }
-
-    pub fn entry_type(mut self, entry_type: impl Into<String>) -> Self {
-        self.0.entry_type = Some(entry_type.into());
-        self
-    }
-
-    pub fn remote_host(mut self, host: impl Into<String>) -> Self {
-        self.0.remote_host = Some(host.into());
-        self
-    }
-
-    pub fn request_id(mut self, id: impl Into<String>) -> Self {
-        self.0.request_id = Some(id.into());
-        self
-    }
-
-    pub fn user_agent(mut self, agent: impl Into<String>) -> Self {
-        self.0.user_agent = Some(agent.into());
-        self
-    }
-
-    pub fn req_path(mut self, path: impl Into<String>) -> Self {
-        self.0.req_path = Some(path.into());
-        self
-    }
-
-    pub fn req_host(mut self, host: impl Into<String>) -> Self {
-        self.0.req_host = Some(host.into());
-        self
-    }
-
-    pub fn req_node(mut self, node: impl Into<String>) -> Self {
-        self.0.req_node = Some(node.into());
-        self
-    }
-
-    pub fn req_claims(mut self, claims: HashMap<String, Value>) -> Self {
-        self.0.req_claims = Some(claims);
-        self
-    }
-
-    pub fn req_query(mut self, query: HashMap<String, String>) -> Self {
-        self.0.req_query = Some(query);
-        self
-    }
-
-    pub fn req_header(mut self, header: HashMap<String, String>) -> Self {
-        self.0.req_header = Some(header);
-        self
-    }
-
-    pub fn resp_header(mut self, header: HashMap<String, String>) -> Self {
-        self.0.resp_header = Some(header);
-        self
-    }
-
-    pub fn tags(mut self, tags: HashMap<String, Value>) -> Self {
-        self.0.tags = Some(tags);
-        self
-    }
-
-    pub fn access_key(mut self, key: impl Into<String>) -> Self {
-        self.0.access_key = Some(key.into());
-        self
-    }
-
-    pub fn parent_user(mut self, user: impl Into<String>) -> Self {
-        self.0.parent_user = Some(user.into());
-        self
-    }
-
-    pub fn error(mut self, error: impl Into<String>) -> Self {
-        self.0.error = Some(error.into());
-        self
-    }
-
-    /// Construct the final `AuditEntry`.
-    pub fn build(self) -> AuditEntry {
-        self.0
+    /// Build AuditEntry from context or parameters (example, can be extended)
+    pub fn from_context(
+        version: String,
+        deployment_id: Option<String>,
+        time: DateTime<Utc>,
+        event: EventName,
+        trigger: String,
+        api: ApiDetails,
+        tags: Option<HashMap<String, Value>>,
+    ) -> Self {
+        AuditEntry {
+            version,
+            deployment_id,
+            site_name: None,
+            time,
+            event,
+            entry_type: None,
+            trigger,
+            api,
+            remote_host: None,
+            request_id: None,
+            user_agent: None,
+            req_path: None,
+            req_host: None,
+            req_node: None,
+            req_claims: None,
+            req_query: None,
+            req_header: None,
+            resp_header: None,
+            tags,
+            access_key: None,
+            parent_user: None,
+            error: None,
+        }
+    }
+}
+
+impl LogRecord for AuditEntry {
+    /// Serialize AuditEntry to JSON string
+    fn to_json(&self) -> String {
+        serde_json::to_string(self).unwrap_or_else(|_| String::from("{}"))
+    }
+    /// Get the timestamp of the audit entry
+    fn get_timestamp(&self) -> DateTime<Utc> {
+        self.time
     }
 }

crates/audit/src/error.rs

@@ -21,7 +21,7 @@ pub type AuditResult<T> = Result<T, AuditError>;
 #[derive(Error, Debug)]
 pub enum AuditError {
     #[error("Configuration error: {0}")]
-    Configuration(String, #[source] Option<Box<dyn std::error::Error + Send + Sync>>),
+    Configuration(String),
 
     #[error("config not loaded")]
     ConfigNotLoaded,
@@ -35,14 +35,11 @@ pub enum AuditError {
     #[error("System already initialized")]
     AlreadyInitialized,
 
-    #[error("Storage not available: {0}")]
-    StorageNotAvailable(String),
-
     #[error("Failed to save configuration: {0}")]
-    SaveConfig(#[source] Box<dyn std::error::Error + Send + Sync>),
+    SaveConfig(String),
 
     #[error("Failed to load configuration: {0}")]
-    LoadConfig(#[source] Box<dyn std::error::Error + Send + Sync>),
+    LoadConfig(String),
 
     #[error("Serialization error: {0}")]
     Serialization(#[from] serde_json::Error),
@@ -52,4 +49,7 @@ pub enum AuditError {
 
     #[error("Join error: {0}")]
     Join(#[from] tokio::task::JoinError),
+
+    #[error("Server storage not initialized: {0}")]
+    ServerNotInitialized(String),
 }

crates/audit/src/factory.rs

@@ -1,223 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::AuditEntry;
-use async_trait::async_trait;
-use hashbrown::HashSet;
-use rumqttc::QoS;
-use rustfs_config::audit::{AUDIT_MQTT_KEYS, AUDIT_WEBHOOK_KEYS, ENV_AUDIT_MQTT_KEYS, ENV_AUDIT_WEBHOOK_KEYS};
-use rustfs_config::{
-    AUDIT_DEFAULT_DIR, DEFAULT_LIMIT, MQTT_BROKER, MQTT_KEEP_ALIVE_INTERVAL, MQTT_PASSWORD, MQTT_QOS, MQTT_QUEUE_DIR,
-    MQTT_QUEUE_LIMIT, MQTT_RECONNECT_INTERVAL, MQTT_TOPIC, MQTT_USERNAME, WEBHOOK_AUTH_TOKEN, WEBHOOK_CLIENT_CERT,
-    WEBHOOK_CLIENT_KEY, WEBHOOK_ENDPOINT, WEBHOOK_QUEUE_DIR, WEBHOOK_QUEUE_LIMIT,
-};
-use rustfs_ecstore::config::KVS;
-use rustfs_targets::{
-    Target,
-    error::TargetError,
-    target::{mqtt::MQTTArgs, webhook::WebhookArgs},
-};
-use std::time::Duration;
-use tracing::{debug, warn};
-use url::Url;
-
-/// Trait for creating targets from configuration
-#[async_trait]
-pub trait TargetFactory: Send + Sync {
-    /// Creates a target from configuration
-    async fn create_target(&self, id: String, config: &KVS) -> Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError>;
-
-    /// Validates target configuration
-    fn validate_config(&self, id: &str, config: &KVS) -> Result<(), TargetError>;
-
-    /// Returns a set of valid configuration field names for this target type.
-    /// This is used to filter environment variables.
-    fn get_valid_fields(&self) -> HashSet<String>;
-
-    /// Returns a set of valid configuration env field names for this target type.
-    /// This is used to filter environment variables.
-    fn get_valid_env_fields(&self) -> HashSet<String>;
-}
-
-/// Factory for creating Webhook targets
-pub struct WebhookTargetFactory;
-
-#[async_trait]
-impl TargetFactory for WebhookTargetFactory {
-    async fn create_target(&self, id: String, config: &KVS) -> Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError> {
-        // All config values are now read directly from the merged `config` KVS.
-        let endpoint = config
-            .lookup(WEBHOOK_ENDPOINT)
-            .ok_or_else(|| TargetError::Configuration("Missing webhook endpoint".to_string()))?;
-        let endpoint_url = Url::parse(&endpoint)
-            .map_err(|e| TargetError::Configuration(format!("Invalid endpoint URL: {e} (value: '{endpoint}')")))?;
-
-        let args = WebhookArgs {
-            enable: true, // If we are here, it's already enabled.
-            endpoint: endpoint_url,
-            auth_token: config.lookup(WEBHOOK_AUTH_TOKEN).unwrap_or_default(),
-            queue_dir: config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string()),
-            queue_limit: config
-                .lookup(WEBHOOK_QUEUE_LIMIT)
-                .and_then(|v| v.parse::<u64>().ok())
-                .unwrap_or(DEFAULT_LIMIT),
-            client_cert: config.lookup(WEBHOOK_CLIENT_CERT).unwrap_or_default(),
-            client_key: config.lookup(WEBHOOK_CLIENT_KEY).unwrap_or_default(),
-            target_type: rustfs_targets::target::TargetType::AuditLog,
-        };
-
-        let target = rustfs_targets::target::webhook::WebhookTarget::new(id, args)?;
-        Ok(Box::new(target))
-    }
-
-    fn validate_config(&self, _id: &str, config: &KVS) -> Result<(), TargetError> {
-        // Validation also uses the merged `config` KVS directly.
-        let endpoint = config
-            .lookup(WEBHOOK_ENDPOINT)
-            .ok_or_else(|| TargetError::Configuration("Missing webhook endpoint".to_string()))?;
-        debug!("endpoint: {}", endpoint);
-        let parsed_endpoint = endpoint.trim();
-        Url::parse(parsed_endpoint)
-            .map_err(|e| TargetError::Configuration(format!("Invalid endpoint URL: {e} (value: '{parsed_endpoint}')")))?;
-
-        let client_cert = config.lookup(WEBHOOK_CLIENT_CERT).unwrap_or_default();
-        let client_key = config.lookup(WEBHOOK_CLIENT_KEY).unwrap_or_default();
-
-        if client_cert.is_empty() != client_key.is_empty() {
-            return Err(TargetError::Configuration(
-                "Both client_cert and client_key must be specified together".to_string(),
-            ));
-        }
-
-        let queue_dir = config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string());
-        if !queue_dir.is_empty() && !std::path::Path::new(&queue_dir).is_absolute() {
-            return Err(TargetError::Configuration("Webhook queue directory must be an absolute path".to_string()));
-        }
-
-        Ok(())
-    }
-
-    fn get_valid_fields(&self) -> HashSet<String> {
-        AUDIT_WEBHOOK_KEYS.iter().map(|s| s.to_string()).collect()
-    }
-
-    fn get_valid_env_fields(&self) -> HashSet<String> {
-        ENV_AUDIT_WEBHOOK_KEYS.iter().map(|s| s.to_string()).collect()
-    }
-}
-
-/// Factory for creating MQTT targets
-pub struct MQTTTargetFactory;
-
-#[async_trait]
-impl TargetFactory for MQTTTargetFactory {
-    async fn create_target(&self, id: String, config: &KVS) -> Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError> {
-        let broker = config
-            .lookup(MQTT_BROKER)
-            .ok_or_else(|| TargetError::Configuration("Missing MQTT broker".to_string()))?;
-        let broker_url = Url::parse(&broker)
-            .map_err(|e| TargetError::Configuration(format!("Invalid broker URL: {e} (value: '{broker}')")))?;
-
-        let topic = config
-            .lookup(MQTT_TOPIC)
-            .ok_or_else(|| TargetError::Configuration("Missing MQTT topic".to_string()))?;
-
-        let args = MQTTArgs {
-            enable: true, // Assumed enabled.
-            broker: broker_url,
-            topic,
-            qos: config
-                .lookup(MQTT_QOS)
-                .and_then(|v| v.parse::<u8>().ok())
-                .map(|q| match q {
-                    0 => QoS::AtMostOnce,
-                    1 => QoS::AtLeastOnce,
-                    2 => QoS::ExactlyOnce,
-                    _ => QoS::AtLeastOnce,
-                })
-                .unwrap_or(QoS::AtLeastOnce),
-            username: config.lookup(MQTT_USERNAME).unwrap_or_default(),
-            password: config.lookup(MQTT_PASSWORD).unwrap_or_default(),
-            max_reconnect_interval: config
-                .lookup(MQTT_RECONNECT_INTERVAL)
-                .and_then(|v| v.parse::<u64>().ok())
-                .map(Duration::from_secs)
-                .unwrap_or_else(|| Duration::from_secs(5)),
-            keep_alive: config
-                .lookup(MQTT_KEEP_ALIVE_INTERVAL)
-                .and_then(|v| v.parse::<u64>().ok())
-                .map(Duration::from_secs)
-                .unwrap_or_else(|| Duration::from_secs(30)),
-            queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string()),
-            queue_limit: config
-                .lookup(MQTT_QUEUE_LIMIT)
-                .and_then(|v| v.parse::<u64>().ok())
-                .unwrap_or(DEFAULT_LIMIT),
-            target_type: rustfs_targets::target::TargetType::AuditLog,
-        };
-
-        let target = rustfs_targets::target::mqtt::MQTTTarget::new(id, args)?;
-        Ok(Box::new(target))
-    }
-
-    fn validate_config(&self, _id: &str, config: &KVS) -> Result<(), TargetError> {
-        let broker = config
-            .lookup(MQTT_BROKER)
-            .ok_or_else(|| TargetError::Configuration("Missing MQTT broker".to_string()))?;
-        let url = Url::parse(&broker)
-            .map_err(|e| TargetError::Configuration(format!("Invalid broker URL: {e} (value: '{broker}')")))?;
-
-        match url.scheme() {
-            "tcp" | "ssl" | "ws" | "wss" | "mqtt" | "mqtts" => {}
-            _ => {
-                return Err(TargetError::Configuration("Unsupported broker URL scheme".to_string()));
-            }
-        }
-
-        if config.lookup(MQTT_TOPIC).is_none() {
-            return Err(TargetError::Configuration("Missing MQTT topic".to_string()));
-        }
-
-        if let Some(qos_str) = config.lookup(MQTT_QOS) {
-            let qos = qos_str
-                .parse::<u8>()
-                .map_err(|_| TargetError::Configuration("Invalid QoS value".to_string()))?;
-            if qos > 2 {
-                return Err(TargetError::Configuration("QoS must be 0, 1, or 2".to_string()));
-            }
-        }
-
-        let queue_dir = config.lookup(MQTT_QUEUE_DIR).unwrap_or_default();
-        if !queue_dir.is_empty() {
-            if !std::path::Path::new(&queue_dir).is_absolute() {
-                return Err(TargetError::Configuration("MQTT queue directory must be an absolute path".to_string()));
-            }
-            if let Some(qos_str) = config.lookup(MQTT_QOS) {
-                if qos_str == "0" {
-                    warn!("Using queue_dir with QoS 0 may result in event loss");
-                }
-            }
-        }
-
-        Ok(())
-    }
-
-    fn get_valid_fields(&self) -> HashSet<String> {
-        AUDIT_MQTT_KEYS.iter().map(|s| s.to_string()).collect()
-    }
-
-    fn get_valid_env_fields(&self) -> HashSet<String> {
-        ENV_AUDIT_MQTT_KEYS.iter().map(|s| s.to_string()).collect()
-    }
-}

crates/audit/src/global.rs

@@ -15,7 +15,7 @@
 use crate::{AuditEntry, AuditResult, AuditSystem};
 use rustfs_ecstore::config::Config;
 use std::sync::{Arc, OnceLock};
-use tracing::{debug, error, trace, warn};
+use tracing::{error, warn};
 
 /// Global audit system instance
 static AUDIT_SYSTEM: OnceLock<Arc<AuditSystem>> = OnceLock::new();
@@ -30,19 +30,6 @@ pub fn audit_system() -> Option<Arc<AuditSystem>> {
     AUDIT_SYSTEM.get().cloned()
 }
 
-/// A helper macro for executing closures if the global audit system is initialized.
-/// If not initialized, log a warning and return `Ok(())`.
-macro_rules! with_audit_system {
-    ($async_closure:expr) => {
-        if let Some(system) = audit_system() {
-            (async move { $async_closure(system).await }).await
-        } else {
-            warn!("Audit system not initialized, operation skipped.");
-            Ok(())
-        }
-    };
-}
-
 /// Start the global audit system with configuration
 pub async fn start_audit_system(config: Config) -> AuditResult<()> {
     let system = init_audit_system();
@@ -51,17 +38,32 @@ pub async fn start_audit_system(config: Config) -> AuditResult<()> {
 
 /// Stop the global audit system
 pub async fn stop_audit_system() -> AuditResult<()> {
-    with_audit_system!(|system: Arc<AuditSystem>| async move { system.close().await })
+    if let Some(system) = audit_system() {
+        system.close().await
+    } else {
+        warn!("Audit system not initialized, cannot stop");
+        Ok(())
+    }
 }
 
 /// Pause the global audit system
 pub async fn pause_audit_system() -> AuditResult<()> {
-    with_audit_system!(|system: Arc<AuditSystem>| async move { system.pause().await })
+    if let Some(system) = audit_system() {
+        system.pause().await
+    } else {
+        warn!("Audit system not initialized, cannot pause");
+        Ok(())
+    }
 }
 
 /// Resume the global audit system
 pub async fn resume_audit_system() -> AuditResult<()> {
-    with_audit_system!(|system: Arc<AuditSystem>| async move { system.resume().await })
+    if let Some(system) = audit_system() {
+        system.resume().await
+    } else {
+        warn!("Audit system not initialized, cannot resume");
+        Ok(())
+    }
 }
 
 /// Dispatch an audit log entry to all targets
@@ -70,23 +72,23 @@ pub async fn dispatch_audit_log(entry: Arc<AuditEntry>) -> AuditResult<()> {
         if system.is_running().await {
             system.dispatch(entry).await
         } else {
-            // The system is initialized but not running (for example, it is suspended). Silently discard log entries based on original logic.
-            // For debugging purposes, it can be useful to add a trace log here.
-            trace!("Audit system is not running, dropping audit entry.");
+            // System not running, just drop the log entry without error
             Ok(())
         }
     } else {
-        // The system is not initialized at all. This is a more important state.
-        // It might be better to return an error or log a warning.
-        debug!("Audit system not initialized, dropping audit entry.");
-        // If this should be a hard failure, you can return Err(AuditError::NotInitialized("..."))
+        // System not initialized, just drop the log entry without error
         Ok(())
     }
 }
 
 /// Reload the global audit system configuration
 pub async fn reload_audit_config(config: Config) -> AuditResult<()> {
-    with_audit_system!(|system: Arc<AuditSystem>| async move { system.reload_config(config).await })
+    if let Some(system) = audit_system() {
+        system.reload_config(config).await
+    } else {
+        warn!("Audit system not initialized, cannot reload config");
+        Ok(())
+    }
 }
 
 /// Check if the global audit system is running

crates/audit/src/lib.rs

@@ -20,13 +20,12 @@
 
 pub mod entity;
 pub mod error;
-pub mod factory;
 pub mod global;
 pub mod observability;
 pub mod registry;
 pub mod system;
 
-pub use entity::{ApiDetails, AuditEntry, ObjectVersion};
+pub use entity::{ApiDetails, AuditEntry, LogRecord, ObjectVersion};
 pub use error::{AuditError, AuditResult};
 pub use global::*;
 pub use observability::{AuditMetrics, AuditMetricsReport, PerformanceValidation};

crates/audit/src/observability.rs

@@ -21,47 +21,12 @@
 //! - Error rate monitoring
 //! - Queue depth monitoring
 
-use metrics::{counter, describe_counter, describe_gauge, describe_histogram, gauge, histogram};
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, OnceLock};
 use std::time::{Duration, Instant};
 use tokio::sync::RwLock;
 use tracing::info;
 
-const RUSTFS_AUDIT_METRICS_NAMESPACE: &str = "rustfs.audit.";
-
-const M_AUDIT_EVENTS_TOTAL: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "events.total");
-const M_AUDIT_EVENTS_FAILED: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "events.failed");
-const M_AUDIT_DISPATCH_NS: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "dispatch.ns");
-const M_AUDIT_EPS: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "eps");
-const M_AUDIT_TARGET_OPS: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "target.ops");
-const M_AUDIT_CONFIG_RELOADS: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "config.reloads");
-const M_AUDIT_SYSTEM_STARTS: &str = const_str::concat!(RUSTFS_AUDIT_METRICS_NAMESPACE, "system.starts");
-
-const L_RESULT: &str = "result";
-const L_STATUS: &str = "status";
-
-const V_SUCCESS: &str = "success";
-const V_FAILURE: &str = "failure";
-
-/// One-time registration of indicator meta information
-/// This function ensures that metric descriptors are registered only once.
-pub fn init_observability_metrics() {
-    static METRICS_DESC_INIT: OnceLock<()> = OnceLock::new();
-    METRICS_DESC_INIT.get_or_init(|| {
-        // Event/Time-consuming
-        describe_counter!(M_AUDIT_EVENTS_TOTAL, "Total audit events (labeled by result).");
-        describe_counter!(M_AUDIT_EVENTS_FAILED, "Total failed audit events.");
-        describe_histogram!(M_AUDIT_DISPATCH_NS, "Dispatch time per event (ns).");
-        describe_gauge!(M_AUDIT_EPS, "Events per second since last reset.");
-
-        // Target operation/system event
-        describe_counter!(M_AUDIT_TARGET_OPS, "Total target operations (labeled by status).");
-        describe_counter!(M_AUDIT_CONFIG_RELOADS, "Total configuration reloads.");
-        describe_counter!(M_AUDIT_SYSTEM_STARTS, "Total system starts.");
-    });
-}
-
 /// Metrics collector for audit system observability
 #[derive(Debug)]
 pub struct AuditMetrics {
@@ -91,7 +56,6 @@ impl Default for AuditMetrics {
 impl AuditMetrics {
     /// Creates a new metrics collector
     pub fn new() -> Self {
-        init_observability_metrics();
         Self {
             total_events_processed: AtomicU64::new(0),
             total_events_failed: AtomicU64::new(0),
@@ -104,28 +68,11 @@ impl AuditMetrics {
         }
     }
 
-    // Suggestion: Call this auxiliary function in the existing "Successful Event Recording" method body to complete the instrumentation
-    #[inline]
-    fn emit_event_success_metrics(&self, dispatch_time: Duration) {
-        // count + histogram
-        counter!(M_AUDIT_EVENTS_TOTAL, L_RESULT => V_SUCCESS).increment(1);
-        histogram!(M_AUDIT_DISPATCH_NS).record(dispatch_time.as_nanos() as f64);
-    }
-
-    // Suggestion: Call this auxiliary function in the existing "Failure Event Recording" method body to complete the instrumentation
-    #[inline]
-    fn emit_event_failure_metrics(&self, dispatch_time: Duration) {
-        counter!(M_AUDIT_EVENTS_TOTAL, L_RESULT => V_FAILURE).increment(1);
-        counter!(M_AUDIT_EVENTS_FAILED).increment(1);
-        histogram!(M_AUDIT_DISPATCH_NS).record(dispatch_time.as_nanos() as f64);
-    }
-
     /// Records a successful event dispatch
     pub fn record_event_success(&self, dispatch_time: Duration) {
         self.total_events_processed.fetch_add(1, Ordering::Relaxed);
         self.total_dispatch_time_ns
             .fetch_add(dispatch_time.as_nanos() as u64, Ordering::Relaxed);
-        self.emit_event_success_metrics(dispatch_time);
     }
 
     /// Records a failed event dispatch
@@ -133,32 +80,27 @@ impl AuditMetrics {
         self.total_events_failed.fetch_add(1, Ordering::Relaxed);
         self.total_dispatch_time_ns
             .fetch_add(dispatch_time.as_nanos() as u64, Ordering::Relaxed);
-        self.emit_event_failure_metrics(dispatch_time);
     }
 
     /// Records a successful target operation
     pub fn record_target_success(&self) {
         self.target_success_count.fetch_add(1, Ordering::Relaxed);
-        counter!(M_AUDIT_TARGET_OPS, L_STATUS => V_SUCCESS).increment(1);
     }
 
     /// Records a failed target operation
     pub fn record_target_failure(&self) {
         self.target_failure_count.fetch_add(1, Ordering::Relaxed);
-        counter!(M_AUDIT_TARGET_OPS, L_STATUS => V_FAILURE).increment(1);
     }
 
     /// Records a configuration reload
     pub fn record_config_reload(&self) {
         self.config_reload_count.fetch_add(1, Ordering::Relaxed);
-        counter!(M_AUDIT_CONFIG_RELOADS).increment(1);
         info!("Audit configuration reloaded");
     }
 
     /// Records a system start
     pub fn record_system_start(&self) {
         self.system_start_count.fetch_add(1, Ordering::Relaxed);
-        counter!(M_AUDIT_SYSTEM_STARTS).increment(1);
         info!("Audit system started");
     }
 
@@ -168,14 +110,11 @@ impl AuditMetrics {
         let elapsed = reset_time.elapsed();
         let total_events = self.total_events_processed.load(Ordering::Relaxed) + self.total_events_failed.load(Ordering::Relaxed);
 
-        let eps = if elapsed.as_secs_f64() > 0.0 {
+        if elapsed.as_secs_f64() > 0.0 {
             total_events as f64 / elapsed.as_secs_f64()
         } else {
             0.0
-        };
-        // EPS is reported in gauge
-        gauge!(M_AUDIT_EPS).set(eps);
-        eps
+        }
     }
 
     /// Gets the average dispatch latency in milliseconds
@@ -227,8 +166,6 @@ impl AuditMetrics {
         let mut reset_time = self.last_reset_time.write().await;
         *reset_time = Instant::now();
 
-        // Reset EPS to zero after reset
-        gauge!(M_AUDIT_EPS).set(0.0);
         info!("Audit metrics reset");
     }
 

crates/audit/src/registry.rs

@@ -12,26 +12,29 @@
 //  See the License for the specific language governing permissions and
 //  limitations under the License.
 
-use crate::{
-    AuditEntry, AuditError, AuditResult,
-    factory::{MQTTTargetFactory, TargetFactory, WebhookTargetFactory},
+use crate::{AuditEntry, AuditError, AuditResult};
+use futures::{StreamExt, stream::FuturesUnordered};
+use rustfs_config::{
+    DEFAULT_DELIMITER, ENABLE_KEY, ENV_PREFIX, MQTT_BROKER, MQTT_KEEP_ALIVE_INTERVAL, MQTT_PASSWORD, MQTT_QOS, MQTT_QUEUE_DIR,
+    MQTT_QUEUE_LIMIT, MQTT_RECONNECT_INTERVAL, MQTT_TOPIC, MQTT_USERNAME, WEBHOOK_AUTH_TOKEN, WEBHOOK_BATCH_SIZE,
+    WEBHOOK_CLIENT_CERT, WEBHOOK_CLIENT_KEY, WEBHOOK_ENDPOINT, WEBHOOK_HTTP_TIMEOUT, WEBHOOK_MAX_RETRY, WEBHOOK_QUEUE_DIR,
+    WEBHOOK_QUEUE_LIMIT, WEBHOOK_RETRY_INTERVAL, audit::AUDIT_ROUTE_PREFIX,
 };
-use futures::StreamExt;
-use futures::stream::FuturesUnordered;
-use hashbrown::{HashMap, HashSet};
-use rustfs_config::{DEFAULT_DELIMITER, ENABLE_KEY, ENV_PREFIX, EnableState, audit::AUDIT_ROUTE_PREFIX};
 use rustfs_ecstore::config::{Config, KVS};
-use rustfs_targets::{Target, TargetError, target::ChannelTargetType};
-use std::str::FromStr;
+use rustfs_targets::{
+    Target, TargetError,
+    target::{ChannelTargetType, TargetType, mqtt::MQTTArgs, webhook::WebhookArgs},
+};
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
+use std::time::Duration;
 use tracing::{debug, error, info, warn};
+use url::Url;
 
 /// Registry for managing audit targets
 pub struct AuditRegistry {
     /// Storage for created targets
     targets: HashMap<String, Box<dyn Target<AuditEntry> + Send + Sync>>,
-    /// Factories for creating targets
-    factories: HashMap<String, Box<dyn TargetFactory>>,
 }
 
 impl Default for AuditRegistry {
@@ -43,207 +46,162 @@ impl Default for AuditRegistry {
 impl AuditRegistry {
     /// Creates a new AuditRegistry
     pub fn new() -> Self {
-        let mut registry = AuditRegistry {
-            factories: HashMap::new(),
-            targets: HashMap::new(),
-        };
-
-        // Register built-in factories
-        registry.register(ChannelTargetType::Webhook.as_str(), Box::new(WebhookTargetFactory));
-        registry.register(ChannelTargetType::Mqtt.as_str(), Box::new(MQTTTargetFactory));
-
-        registry
+        Self { targets: HashMap::new() }
     }
 
-    /// Registers a new factory for a target type
-    ///
-    /// # Arguments
-    /// * `target_type` - The type of the target (e.g., "webhook", "mqtt").
-    /// * `factory` - The factory instance to create targets of this type.
-    pub fn register(&mut self, target_type: &str, factory: Box<dyn TargetFactory>) {
-        self.factories.insert(target_type.to_string(), factory);
-    }
-
-    /// Creates a target of the specified type with the given ID and configuration
-    ///
-    /// # Arguments
-    /// * `target_type` - The type of the target (e.g., "webhook", "mqtt").
-    /// * `id` - The identifier for the target instance.
-    /// * `config` - The configuration key-value store for the target.
-    ///
-    /// # Returns
-    /// * `Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError>` - The created target or an error.
-    pub async fn create_target(
-        &self,
-        target_type: &str,
-        id: String,
-        config: &KVS,
-    ) -> Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError> {
-        let factory = self
-            .factories
-            .get(target_type)
-            .ok_or_else(|| TargetError::Configuration(format!("Unknown target type: {target_type}")))?;
-
-        // Validate configuration before creating target
-        factory.validate_config(&id, config)?;
-
-        // Create target
-        factory.create_target(id, config).await
-    }
-
-    /// Creates all targets from a configuration
-    /// Create all notification targets from system configuration and environment variables.
+    /// Creates all audit targets from system configuration and environment variables.
     /// This method processes the creation of each target concurrently as follows:
-    /// 1. Iterate through all registered target types (e.g. webhooks, mqtt).
-    /// 2. For each type, resolve its configuration in the configuration file and environment variables.
+    /// 1. Iterate through supported target types (webhook, mqtt).
+    /// 2. For each type, resolve its configuration from file and environment variables.
     /// 3. Identify all target instance IDs that need to be created.
-    /// 4. Combine the default configuration, file configuration, and environment variable configuration for each instance.
-    /// 5. If the instance is enabled, create an asynchronous task for it to instantiate.
-    /// 6. Concurrency executes all creation tasks and collects results.
-    pub async fn create_audit_targets_from_config(
-        &self,
+    /// 4. Merge configurations with precedence: ENV > file instance > file default.
+    /// 5. Create async tasks for enabled instances.
+    /// 6. Execute tasks concurrently and collect successful targets.
+    /// 7. Persist successful configurations back to system storage.
+    pub async fn create_targets_from_config(
+        &mut self,
         config: &Config,
     ) -> AuditResult<Vec<Box<dyn Target<AuditEntry> + Send + Sync>>> {
         // Collect only environment variables with the relevant prefix to reduce memory usage
         let all_env: Vec<(String, String)> = std::env::vars().filter(|(key, _)| key.starts_with(ENV_PREFIX)).collect();
+
         // A collection of asynchronous tasks for concurrently executing target creation
         let mut tasks = FuturesUnordered::new();
-        // let final_config = config.clone(); // Clone a configuration for aggregating the final result
+        // let final_config = config.clone();
+
         // Record the defaults for each segment so that the segment can eventually be rebuilt
         let mut section_defaults: HashMap<String, KVS> = HashMap::new();
-        // 1. Traverse all registered plants and process them by target type
-        for (target_type, factory) in &self.factories {
-            tracing::Span::current().record("target_type", target_type.as_str());
-            info!("Start working on target types...");
+
+        // Supported target types for audit
+        let target_types = vec![ChannelTargetType::Webhook.as_str(), ChannelTargetType::Mqtt.as_str()];
+
+        // 1. Traverse all target types and process them
+        for target_type in target_types {
+            let span = tracing::Span::current();
+            span.record("target_type", target_type);
+            info!(target_type = %target_type, "Starting audit target type processing");
 
             // 2. Prepare the configuration source
-            // 2.1. Get the configuration segment in the file, e.g. 'audit_webhook'
             let section_name = format!("{AUDIT_ROUTE_PREFIX}{target_type}").to_lowercase();
             let file_configs = config.0.get(&section_name).cloned().unwrap_or_default();
-            // 2.2. Get the default configuration for that type
             let default_cfg = file_configs.get(DEFAULT_DELIMITER).cloned().unwrap_or_default();
-            debug!(?default_cfg, "Get the default configuration");
+            debug!(?default_cfg, "Retrieved default configuration");
 
             // Save defaults for eventual write back
             section_defaults.insert(section_name.clone(), default_cfg.clone());
 
-            // *** Optimization point 1: Get all legitimate fields of the current target type ***
-            let valid_fields = factory.get_valid_fields();
-            debug!(?valid_fields, "Get the legitimate configuration fields");
+            // Get valid fields for the target type
+            let valid_fields = match target_type {
+                "webhook" => get_webhook_valid_fields(),
+                "mqtt" => get_mqtt_valid_fields(),
+                _ => {
+                    warn!(target_type = %target_type, "Unknown target type, skipping");
+                    continue;
+                }
+            };
+            debug!(?valid_fields, "Retrieved valid configuration fields");
 
             // 3. Resolve instance IDs and configuration overrides from environment variables
             let mut instance_ids_from_env = HashSet::new();
-            // 3.1. Instance discovery: Based on the '..._ENABLE_INSTANCEID' format
-            let enable_prefix =
-                format!("{ENV_PREFIX}{AUDIT_ROUTE_PREFIX}{target_type}{DEFAULT_DELIMITER}{ENABLE_KEY}{DEFAULT_DELIMITER}")
-                    .to_uppercase();
-            for (key, value) in &all_env {
-                if EnableState::from_str(value).ok().map(|s| s.is_enabled()).unwrap_or(false) {
-                    if let Some(id) = key.strip_prefix(&enable_prefix) {
-                        if !id.is_empty() {
-                            instance_ids_from_env.insert(id.to_lowercase());
-                        }
-                    }
-                }
-            }
-
-            // 3.2. Parse all relevant environment variable configurations
-            // 3.2.1. Build environment variable prefixes such as 'RUSTFS_AUDIT_WEBHOOK_'
-            let env_prefix = format!("{ENV_PREFIX}{AUDIT_ROUTE_PREFIX}{target_type}{DEFAULT_DELIMITER}").to_uppercase();
-            // 3.2.2. 'env_overrides' is used to store configurations parsed from environment variables in the format: {instance id -> {field -> value}}
             let mut env_overrides: HashMap<String, HashMap<String, String>> = HashMap::new();
-            for (key, value) in &all_env {
-                if let Some(rest) = key.strip_prefix(&env_prefix) {
-                    // Use rsplitn to split from the right side to properly extract the INSTANCE_ID at the end
-                    // Format: <FIELD_NAME>_<INSTANCE_ID> or <FIELD_NAME>
-                    let mut parts = rest.rsplitn(2, DEFAULT_DELIMITER);
 
-                    // The first part from the right is INSTANCE_ID
-                    let instance_id_part = parts.next().unwrap_or(DEFAULT_DELIMITER);
-                    // The remaining part is FIELD_NAME
-                    let field_name_part = parts.next();
+            for (env_key, env_value) in &all_env {
+                let audit_prefix = format!("{ENV_PREFIX}{AUDIT_ROUTE_PREFIX}{target_type}").to_uppercase();
+                if !env_key.starts_with(&audit_prefix) {
+                    continue;
+                }
 
-                    let (field_name, instance_id) = match field_name_part {
-                        // Case 1: The format is <FIELD_NAME>_<INSTANCE_ID>
-                        // e.g., rest = "ENDPOINT_PRIMARY" -> field_name="ENDPOINT", instance_id="PRIMARY"
-                        Some(field) => (field.to_lowercase(), instance_id_part.to_lowercase()),
-                        // Case 2: The format is <FIELD_NAME> (without INSTANCE_ID)
-                        // e.g., rest = "ENABLE" -> field_name="ENABLE", instance_id="" (Universal configuration `_ DEFAULT_DELIMITER`)
-                        None => (instance_id_part.to_lowercase(), DEFAULT_DELIMITER.to_string()),
-                    };
+                let suffix = &env_key[audit_prefix.len()..];
+                if suffix.is_empty() {
+                    continue;
+                }
 
-                    // *** Optimization point 2: Verify whether the parsed field_name is legal ***
-                    if !field_name.is_empty() && valid_fields.contains(&field_name) {
-                        debug!(
-                            instance_id = %if instance_id.is_empty() { DEFAULT_DELIMITER } else { &instance_id },
-                            %field_name,
-                            %value,
-                            "Parsing to environment variables"
-                        );
-                        env_overrides
-                            .entry(instance_id)
-                            .or_default()
-                            .insert(field_name, value.clone());
+                // Parse field and instance from suffix (FIELD_INSTANCE or FIELD)
+                let (field_name, instance_id) = if let Some(last_underscore) = suffix.rfind('_') {
+                    let potential_field = &suffix[1..last_underscore]; // Skip leading _
+                    let potential_instance = &suffix[last_underscore + 1..];
+
+                    // Check if the part before the last underscore is a valid field
+                    if valid_fields.contains(&potential_field.to_lowercase()) {
+                        (potential_field.to_lowercase(), potential_instance.to_lowercase())
                     } else {
-                        // Ignore illegal field names
-                        warn!(
-                            field_name = %field_name,
-                            "Ignore environment variable fields, not found in the list of valid fields for target type {}",
-                            target_type
-                        );
+                        // Treat the entire suffix as field name with default instance
+                        (suffix[1..].to_lowercase(), DEFAULT_DELIMITER.to_string())
                     }
+                } else {
+                    // No underscore, treat as field with default instance
+                    (suffix[1..].to_lowercase(), DEFAULT_DELIMITER.to_string())
+                };
+
+                if valid_fields.contains(&field_name) {
+                    if instance_id != DEFAULT_DELIMITER {
+                        instance_ids_from_env.insert(instance_id.clone());
+                    }
+                    env_overrides
+                        .entry(instance_id)
+                        .or_default()
+                        .insert(field_name, env_value.clone());
+                } else {
+                    debug!(
+                        env_key = %env_key,
+                        field_name = %field_name,
+                        "Ignoring environment variable field not found in valid fields for target type {}",
+                        target_type
+                    );
                 }
             }
-            debug!(?env_overrides, "Complete the environment variable analysis");
+            debug!(?env_overrides, "Completed environment variable analysis");
 
             // 4. Determine all instance IDs that need to be processed
             let mut all_instance_ids: HashSet<String> =
                 file_configs.keys().filter(|k| *k != DEFAULT_DELIMITER).cloned().collect();
             all_instance_ids.extend(instance_ids_from_env);
-            debug!(?all_instance_ids, "Determine all instance IDs");
+            debug!(?all_instance_ids, "Determined all instance IDs");
 
             // 5. Merge configurations and create tasks for each instance
             for id in all_instance_ids {
-                // 5.1. Merge configuration, priority: Environment variables > File instance configuration > File default configuration
+                // 5.1. Merge configuration, priority: Environment variables > File instance > File default
                 let mut merged_config = default_cfg.clone();
-                // Instance-specific configuration in application files
+
+                // Apply file instance configuration if available
                 if let Some(file_instance_cfg) = file_configs.get(&id) {
                     merged_config.extend(file_instance_cfg.clone());
                 }
-                // Application instance-specific environment variable configuration
+
+                // Apply environment variable overrides
                 if let Some(env_instance_cfg) = env_overrides.get(&id) {
-                    // Convert HashMap<String, String> to KVS
                     let mut kvs_from_env = KVS::new();
                     for (k, v) in env_instance_cfg {
                         kvs_from_env.insert(k.clone(), v.clone());
                     }
                     merged_config.extend(kvs_from_env);
                 }
-                debug!(instance_id = %id, ?merged_config, "Complete configuration merge");
+                debug!(instance_id = %id, ?merged_config, "Completed configuration merge");
 
                 // 5.2. Check if the instance is enabled
                 let enabled = merged_config
                     .lookup(ENABLE_KEY)
-                    .map(|v| {
-                        EnableState::from_str(v.as_str())
-                            .ok()
-                            .map(|s| s.is_enabled())
-                            .unwrap_or(false)
-                    })
+                    .map(|v| parse_enable_value(&v))
                     .unwrap_or(false);
 
                 if enabled {
-                    info!(instance_id = %id, "Target is enabled, ready to create a task");
-                    // 5.3. Create asynchronous tasks for enabled instances
-                    let target_type_clone = target_type.clone();
-                    let tid = id.clone();
-                    let merged_config_arc = Arc::new(merged_config);
-                    tasks.push(async move {
-                        let result = factory.create_target(tid.clone(), &merged_config_arc).await;
-                        (target_type_clone, tid, result, Arc::clone(&merged_config_arc))
+                    info!(instance_id = %id, "Creating audit target");
+
+                    // Create task for concurrent execution
+                    let target_type_clone = target_type.to_string();
+                    let id_clone = id.clone();
+                    let merged_config_arc = Arc::new(merged_config.clone());
+                    let task = tokio::spawn(async move {
+                        let result = create_audit_target(&target_type_clone, &id_clone, &merged_config_arc).await;
+                        (target_type_clone, id_clone, result, merged_config_arc)
                     });
+
+                    tasks.push(task);
+
+                    // Update final config with successful instance
+                    // final_config.0.entry(section_name.clone()).or_default().insert(id, merged_config);
                 } else {
-                    info!(instance_id = %id, "Skip the disabled target and will be removed from the final configuration");
+                    info!(instance_id = %id, "Skipping disabled audit target, will be removed from final configuration");
                     // Remove disabled target from final configuration
                     // final_config.0.entry(section_name.clone()).or_default().remove(&id);
                 }
@@ -253,28 +211,30 @@ impl AuditRegistry {
         // 6. Concurrently execute all creation tasks and collect results
         let mut successful_targets = Vec::new();
         let mut successful_configs = Vec::new();
-        while let Some((target_type, id, result, final_config)) = tasks.next().await {
-            match result {
-                Ok(target) => {
-                    info!(target_type = %target_type, instance_id = %id, "Create a target successfully");
-                    successful_targets.push(target);
-                    successful_configs.push((target_type, id, final_config));
-                }
+        while let Some(task_result) = tasks.next().await {
+            match task_result {
+                Ok((target_type, id, result, kvs_arc)) => match result {
+                    Ok(target) => {
+                        info!(target_type = %target_type, instance_id = %id, "Created audit target successfully");
+                        successful_targets.push(target);
+                        successful_configs.push((target_type, id, kvs_arc));
+                    }
+                    Err(e) => {
+                        error!(target_type = %target_type, instance_id = %id, error = %e, "Failed to create audit target");
+                    }
+                },
                 Err(e) => {
-                    error!(target_type = %target_type, instance_id = %id, error = %e, "Failed to create a target");
+                    error!(error = %e, "Task execution failed");
                 }
             }
         }
 
-        // 7. Aggregate new configuration and write back to system configuration
+        // Rebuild in pieces based on "default items + successful instances" and overwrite writeback to ensure that deleted/disabled instances will not be "resurrected"
         if !successful_configs.is_empty() || !section_defaults.is_empty() {
-            info!(
-                "Prepare to update {} successfully created target configurations to the system configuration...",
-                successful_configs.len()
-            );
+            info!("Prepare to rebuild and save target configurations to the system configuration...");
 
+            // Aggregate successful instances into segments
             let mut successes_by_section: HashMap<String, HashMap<String, KVS>> = HashMap::new();
-
             for (target_type, id, kvs) in successful_configs {
                 let section_name = format!("{AUDIT_ROUTE_PREFIX}{target_type}").to_lowercase();
                 successes_by_section
@@ -284,99 +244,76 @@ impl AuditRegistry {
             }
 
             let mut new_config = config.clone();
+
             // Collection of segments that need to be processed: Collect all segments where default items exist or where successful instances exist
             let mut sections: HashSet<String> = HashSet::new();
             sections.extend(section_defaults.keys().cloned());
             sections.extend(successes_by_section.keys().cloned());
 
-            for section in sections {
-                let mut section_map: std::collections::HashMap<String, KVS> = std::collections::HashMap::new();
-                // Add default item
-                if let Some(default_kvs) = section_defaults.get(&section) {
-                    if !default_kvs.is_empty() {
-                        section_map.insert(DEFAULT_DELIMITER.to_string(), default_kvs.clone());
+            for section_name in sections {
+                let mut section_map: HashMap<String, KVS> = HashMap::new();
+
+                // The default entry (if present) is written back to `_`
+                if let Some(default_cfg) = section_defaults.get(&section_name) {
+                    if !default_cfg.is_empty() {
+                        section_map.insert(DEFAULT_DELIMITER.to_string(), default_cfg.clone());
                     }
                 }
 
-                // Add successful instance item
-                if let Some(instances) = successes_by_section.get(&section) {
+                // Successful instance write back
+                if let Some(instances) = successes_by_section.get(&section_name) {
                     for (id, kvs) in instances {
                         section_map.insert(id.clone(), kvs.clone());
                     }
                 }
 
-                // Empty breaks are removed and non-empty breaks are replaced entirely.
+                // Empty segments are removed and non-empty segments are replaced as a whole.
                 if section_map.is_empty() {
-                    new_config.0.remove(&section);
+                    new_config.0.remove(&section_name);
                 } else {
-                    new_config.0.insert(section, section_map);
+                    new_config.0.insert(section_name, section_map);
                 }
             }
 
-            let Some(store) = rustfs_ecstore::global::new_object_layer_fn() else {
-                return Err(AuditError::StorageNotAvailable(
+            // 7. Save the new configuration to the system
+            let Some(store) = rustfs_ecstore::new_object_layer_fn() else {
+                return Err(AuditError::ServerNotInitialized(
                     "Failed to save target configuration: server storage not initialized".to_string(),
                 ));
             };
 
             match rustfs_ecstore::config::com::save_server_config(store, &new_config).await {
-                Ok(_) => {
-                    info!("The new configuration was saved to the system successfully.")
-                }
+                Ok(_) => info!("New audit configuration saved to system successfully"),
                 Err(e) => {
-                    error!("Failed to save the new configuration: {}", e);
-                    return Err(AuditError::SaveConfig(Box::new(e)));
+                    error!(error = %e, "Failed to save new audit configuration");
+                    return Err(AuditError::SaveConfig(e.to_string()));
                 }
             }
         }
-
-        info!(count = successful_targets.len(), "All target processing completed");
         Ok(successful_targets)
     }
 
     /// Adds a target to the registry
-    ///
-    /// # Arguments
-    /// * `id` - The identifier for the target.
-    /// * `target` - The target instance to be added.
     pub fn add_target(&mut self, id: String, target: Box<dyn Target<AuditEntry> + Send + Sync>) {
         self.targets.insert(id, target);
     }
 
     /// Removes a target from the registry
-    ///
-    /// # Arguments
-    /// * `id` - The identifier for the target to be removed.
-    ///
-    /// # Returns
-    /// * `Option<Box<dyn Target<AuditEntry> + Send + Sync>>` - The removed target if it existed.
     pub fn remove_target(&mut self, id: &str) -> Option<Box<dyn Target<AuditEntry> + Send + Sync>> {
         self.targets.remove(id)
     }
 
     /// Gets a target from the registry
-    ///
-    /// # Arguments
-    /// * `id` - The identifier for the target to be retrieved.
-    ///
-    /// # Returns
-    /// * `Option<&(dyn Target<AuditEntry> + Send + Sync)>` - The target if it exists.
     pub fn get_target(&self, id: &str) -> Option<&(dyn Target<AuditEntry> + Send + Sync)> {
         self.targets.get(id).map(|t| t.as_ref())
     }
 
     /// Lists all target IDs
-    ///
-    /// # Returns
-    /// * `Vec<String>` - A vector of all target IDs in the registry.
     pub fn list_targets(&self) -> Vec<String> {
         self.targets.keys().cloned().collect()
     }
 
     /// Closes all targets and clears the registry
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure.
     pub async fn close_all(&mut self) -> AuditResult<()> {
         let mut errors = Vec::new();
 
@@ -394,3 +331,152 @@ impl AuditRegistry {
         Ok(())
     }
 }
+
+/// Creates an audit target based on type and configuration
+async fn create_audit_target(
+    target_type: &str,
+    id: &str,
+    config: &KVS,
+) -> Result<Box<dyn Target<AuditEntry> + Send + Sync>, TargetError> {
+    match target_type {
+        val if val == ChannelTargetType::Webhook.as_str() => {
+            let args = parse_webhook_args(id, config)?;
+            let target = rustfs_targets::target::webhook::WebhookTarget::new(id.to_string(), args)?;
+            Ok(Box::new(target))
+        }
+        val if val == ChannelTargetType::Mqtt.as_str() => {
+            let args = parse_mqtt_args(id, config)?;
+            let target = rustfs_targets::target::mqtt::MQTTTarget::new(id.to_string(), args)?;
+            Ok(Box::new(target))
+        }
+        _ => Err(TargetError::Configuration(format!("Unknown target type: {target_type}"))),
+    }
+}
+
+/// Gets valid field names for webhook configuration
+fn get_webhook_valid_fields() -> HashSet<String> {
+    vec![
+        ENABLE_KEY.to_string(),
+        WEBHOOK_ENDPOINT.to_string(),
+        WEBHOOK_AUTH_TOKEN.to_string(),
+        WEBHOOK_CLIENT_CERT.to_string(),
+        WEBHOOK_CLIENT_KEY.to_string(),
+        WEBHOOK_BATCH_SIZE.to_string(),
+        WEBHOOK_QUEUE_LIMIT.to_string(),
+        WEBHOOK_QUEUE_DIR.to_string(),
+        WEBHOOK_MAX_RETRY.to_string(),
+        WEBHOOK_RETRY_INTERVAL.to_string(),
+        WEBHOOK_HTTP_TIMEOUT.to_string(),
+    ]
+    .into_iter()
+    .collect()
+}
+
+/// Gets valid field names for MQTT configuration
+fn get_mqtt_valid_fields() -> HashSet<String> {
+    vec![
+        ENABLE_KEY.to_string(),
+        MQTT_BROKER.to_string(),
+        MQTT_TOPIC.to_string(),
+        MQTT_USERNAME.to_string(),
+        MQTT_PASSWORD.to_string(),
+        MQTT_QOS.to_string(),
+        MQTT_KEEP_ALIVE_INTERVAL.to_string(),
+        MQTT_RECONNECT_INTERVAL.to_string(),
+        MQTT_QUEUE_DIR.to_string(),
+        MQTT_QUEUE_LIMIT.to_string(),
+    ]
+    .into_iter()
+    .collect()
+}
+
+/// Parses webhook arguments from KVS configuration
+fn parse_webhook_args(_id: &str, config: &KVS) -> Result<WebhookArgs, TargetError> {
+    let endpoint = config
+        .lookup(WEBHOOK_ENDPOINT)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| TargetError::Configuration("webhook endpoint is required".to_string()))?;
+
+    let endpoint_url =
+        Url::parse(&endpoint).map_err(|e| TargetError::Configuration(format!("invalid webhook endpoint URL: {e}")))?;
+
+    let args = WebhookArgs {
+        enable: true, // Already validated as enabled
+        endpoint: endpoint_url,
+        auth_token: config.lookup(WEBHOOK_AUTH_TOKEN).unwrap_or_default(),
+        queue_dir: config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or_default(),
+        queue_limit: config
+            .lookup(WEBHOOK_QUEUE_LIMIT)
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(100000),
+        client_cert: config.lookup(WEBHOOK_CLIENT_CERT).unwrap_or_default(),
+        client_key: config.lookup(WEBHOOK_CLIENT_KEY).unwrap_or_default(),
+        target_type: TargetType::AuditLog,
+    };
+
+    args.validate()?;
+    Ok(args)
+}
+
+/// Parses MQTT arguments from KVS configuration  
+fn parse_mqtt_args(_id: &str, config: &KVS) -> Result<MQTTArgs, TargetError> {
+    let broker = config
+        .lookup(MQTT_BROKER)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| TargetError::Configuration("MQTT broker is required".to_string()))?;
+
+    let broker_url = Url::parse(&broker).map_err(|e| TargetError::Configuration(format!("invalid MQTT broker URL: {e}")))?;
+
+    let topic = config
+        .lookup(MQTT_TOPIC)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| TargetError::Configuration("MQTT topic is required".to_string()))?;
+
+    let qos = config
+        .lookup(MQTT_QOS)
+        .and_then(|s| s.parse::<u8>().ok())
+        .and_then(|q| match q {
+            0 => Some(rumqttc::QoS::AtMostOnce),
+            1 => Some(rumqttc::QoS::AtLeastOnce),
+            2 => Some(rumqttc::QoS::ExactlyOnce),
+            _ => None,
+        })
+        .unwrap_or(rumqttc::QoS::AtLeastOnce);
+
+    let args = MQTTArgs {
+        enable: true, // Already validated as enabled
+        broker: broker_url,
+        topic,
+        qos,
+        username: config.lookup(MQTT_USERNAME).unwrap_or_default(),
+        password: config.lookup(MQTT_PASSWORD).unwrap_or_default(),
+        max_reconnect_interval: parse_duration(&config.lookup(MQTT_RECONNECT_INTERVAL).unwrap_or_else(|| "5s".to_string()))
+            .unwrap_or(Duration::from_secs(5)),
+        keep_alive: parse_duration(&config.lookup(MQTT_KEEP_ALIVE_INTERVAL).unwrap_or_else(|| "60s".to_string()))
+            .unwrap_or(Duration::from_secs(60)),
+        queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or_default(),
+        queue_limit: config.lookup(MQTT_QUEUE_LIMIT).and_then(|s| s.parse().ok()).unwrap_or(100000),
+        target_type: TargetType::AuditLog,
+    };
+
+    args.validate()?;
+    Ok(args)
+}
+
+/// Parses enable value from string
+fn parse_enable_value(value: &str) -> bool {
+    matches!(value.to_lowercase().as_str(), "1" | "on" | "true" | "yes")
+}
+
+/// Parses duration from string (e.g., "3s", "5m")
+fn parse_duration(s: &str) -> Option<Duration> {
+    if let Some(stripped) = s.strip_suffix('s') {
+        stripped.parse::<u64>().ok().map(Duration::from_secs)
+    } else if let Some(stripped) = s.strip_suffix('m') {
+        stripped.parse::<u64>().ok().map(|m| Duration::from_secs(m * 60))
+    } else if let Some(stripped) = s.strip_suffix("ms") {
+        stripped.parse::<u64>().ok().map(Duration::from_millis)
+    } else {
+        s.parse::<u64>().ok().map(Duration::from_secs)
+    }
+}

crates/audit/src/system.rs

@@ -58,14 +58,8 @@ impl AuditSystem {
     }
 
     /// Starts the audit system with the given configuration
-    ///
-    /// # Arguments
-    /// * `config` - The configuration to use for starting the audit system
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn start(&self, config: Config) -> AuditResult<()> {
-        let state = self.state.write().await;
+        let mut state = self.state.write().await;
 
         match *state {
             AuditSystemState::Running => {
@@ -78,6 +72,7 @@ impl AuditSystem {
             _ => {}
         }
 
+        *state = AuditSystemState::Starting;
         drop(state);
 
         info!("Starting audit system");
@@ -93,19 +88,8 @@ impl AuditSystem {
 
         // Create targets from configuration
         let mut registry = self.registry.lock().await;
-        match registry.create_audit_targets_from_config(&config).await {
+        match registry.create_targets_from_config(&config).await {
             Ok(targets) => {
-                if targets.is_empty() {
-                    info!("No enabled audit targets found, keeping audit system stopped");
-                    drop(registry);
-                    return Ok(());
-                }
-
-                {
-                    let mut state = self.state.write().await;
-                    *state = AuditSystemState::Starting;
-                }
-
                 info!(target_count = targets.len(), "Created audit targets successfully");
 
                 // Initialize all targets
@@ -149,9 +133,6 @@ impl AuditSystem {
     }
 
     /// Pauses the audit system
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn pause(&self) -> AuditResult<()> {
         let mut state = self.state.write().await;
 
@@ -165,14 +146,11 @@ impl AuditSystem {
                 warn!("Audit system is already paused");
                 Ok(())
             }
-            _ => Err(AuditError::Configuration("Cannot pause audit system in current state".to_string(), None)),
+            _ => Err(AuditError::Configuration("Cannot pause audit system in current state".to_string())),
         }
     }
 
     /// Resumes the audit system
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn resume(&self) -> AuditResult<()> {
         let mut state = self.state.write().await;
 
@@ -186,14 +164,11 @@ impl AuditSystem {
                 warn!("Audit system is already running");
                 Ok(())
             }
-            _ => Err(AuditError::Configuration("Cannot resume audit system in current state".to_string(), None)),
+            _ => Err(AuditError::Configuration("Cannot resume audit system in current state".to_string())),
         }
     }
 
     /// Stops the audit system and closes all targets
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn close(&self) -> AuditResult<()> {
         let mut state = self.state.write().await;
 
@@ -238,20 +213,11 @@ impl AuditSystem {
     }
 
     /// Checks if the audit system is running
-    ///
-    /// # Returns
-    /// * `bool` - True if running, false otherwise
     pub async fn is_running(&self) -> bool {
         matches!(*self.state.read().await, AuditSystemState::Running)
     }
 
     /// Dispatches an audit log entry to all active targets
-    ///
-    /// # Arguments
-    /// * `entry` - The audit log entry to dispatch
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn dispatch(&self, entry: Arc<AuditEntry>) -> AuditResult<()> {
         let start_time = std::time::Instant::now();
 
@@ -343,13 +309,6 @@ impl AuditSystem {
         Ok(())
     }
 
-    /// Dispatches a batch of audit log entries to all active targets
-    ///
-    /// # Arguments
-    /// * `entries` - A vector of audit log entries to dispatch
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn dispatch_batch(&self, entries: Vec<Arc<AuditEntry>>) -> AuditResult<()> {
         let start_time = std::time::Instant::now();
 
@@ -417,13 +376,7 @@ impl AuditSystem {
         Ok(())
     }
 
-    /// Starts the audit stream processing for a target with batching and retry logic
-    /// # Arguments
-    /// * `store` - The store from which to read audit entries
-    /// * `target` - The target to which audit entries will be sent
-    ///
-    /// This function spawns a background task that continuously reads audit entries from the provided store
-    /// and attempts to send them to the specified target. It implements retry logic with exponential backoff
+    // New: Audit flow background tasks, based on send_from_store, including retries and exponential backoffs
     fn start_audit_stream_with_batching(
         &self,
         store: Box<dyn Store<EntityTarget<AuditEntry>, Error = StoreError, Key = Key> + Send>,
@@ -499,12 +452,6 @@ impl AuditSystem {
     }
 
     /// Enables a specific target
-    ///
-    /// # Arguments
-    /// * `target_id` - The ID of the target to enable
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn enable_target(&self, target_id: &str) -> AuditResult<()> {
         // This would require storing enabled/disabled state per target
         // For now, just check if target exists
@@ -513,17 +460,11 @@ impl AuditSystem {
             info!(target_id = %target_id, "Target enabled");
             Ok(())
         } else {
-            Err(AuditError::Configuration(format!("Target not found: {target_id}"), None))
+            Err(AuditError::Configuration(format!("Target not found: {target_id}")))
         }
     }
 
     /// Disables a specific target
-    ///
-    /// # Arguments
-    /// * `target_id` - The ID of the target to disable
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn disable_target(&self, target_id: &str) -> AuditResult<()> {
         // This would require storing enabled/disabled state per target
         // For now, just check if target exists
@@ -532,17 +473,11 @@ impl AuditSystem {
             info!(target_id = %target_id, "Target disabled");
             Ok(())
         } else {
-            Err(AuditError::Configuration(format!("Target not found: {target_id}"), None))
+            Err(AuditError::Configuration(format!("Target not found: {target_id}")))
         }
     }
 
     /// Removes a target from the system
-    ///
-    /// # Arguments
-    /// * `target_id` - The ID of the target to remove
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn remove_target(&self, target_id: &str) -> AuditResult<()> {
         let mut registry = self.registry.lock().await;
         if let Some(target) = registry.remove_target(target_id) {
@@ -552,18 +487,11 @@ impl AuditSystem {
             info!(target_id = %target_id, "Target removed");
             Ok(())
         } else {
-            Err(AuditError::Configuration(format!("Target not found: {target_id}"), None))
+            Err(AuditError::Configuration(format!("Target not found: {target_id}")))
         }
     }
 
     /// Updates or inserts a target
-    ///
-    /// # Arguments
-    /// * `target_id` - The ID of the target to upsert
-    /// * `target` - The target instance to insert or update
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn upsert_target(&self, target_id: String, target: Box<dyn Target<AuditEntry> + Send + Sync>) -> AuditResult<()> {
         let mut registry = self.registry.lock().await;
 
@@ -585,33 +513,18 @@ impl AuditSystem {
     }
 
     /// Lists all targets
-    ///
-    /// # Returns
-    /// * `Vec<String>` - List of target IDs
     pub async fn list_targets(&self) -> Vec<String> {
         let registry = self.registry.lock().await;
         registry.list_targets()
     }
 
     /// Gets information about a specific target
-    ///
-    /// # Arguments
-    /// * `target_id` - The ID of the target to retrieve
-    ///
-    /// # Returns
-    /// * `Option<String>` - Target ID if found
     pub async fn get_target(&self, target_id: &str) -> Option<String> {
         let registry = self.registry.lock().await;
         registry.get_target(target_id).map(|target| target.id().to_string())
     }
 
     /// Reloads configuration and updates targets
-    ///
-    /// # Arguments
-    /// * `new_config` - The new configuration to load
-    ///
-    /// # Returns
-    /// * `AuditResult<()>` - Result indicating success or failure
     pub async fn reload_config(&self, new_config: Config) -> AuditResult<()> {
         info!("Reloading audit system configuration");
 
@@ -631,7 +544,7 @@ impl AuditSystem {
         }
 
         // Create new targets from updated configuration
-        match registry.create_audit_targets_from_config(&new_config).await {
+        match registry.create_targets_from_config(&new_config).await {
             Ok(targets) => {
                 info!(target_count = targets.len(), "Reloaded audit targets successfully");
 
@@ -671,22 +584,16 @@ impl AuditSystem {
     }
 
     /// Gets current audit system metrics
-    ///
-    /// # Returns
-    /// * `AuditMetricsReport` - Current metrics report
     pub async fn get_metrics(&self) -> observability::AuditMetricsReport {
         observability::get_metrics_report().await
     }
 
     /// Validates system performance against requirements
-    ///
-    /// # Returns
-    /// * `PerformanceValidation` - Performance validation results
     pub async fn validate_performance(&self) -> observability::PerformanceValidation {
         observability::validate_performance().await
     }
 
-    /// Resets all metrics to initial state
+    /// Resets all metrics
     pub async fn reset_metrics(&self) {
         observability::reset_metrics().await;
     }

crates/audit/tests/integration_test.rs

@@ -43,16 +43,16 @@ async fn test_config_parsing_webhook() {
     audit_webhook_section.insert("_".to_string(), default_kvs);
     config.0.insert("audit_webhook".to_string(), audit_webhook_section);
 
-    let registry = AuditRegistry::new();
+    let mut registry = AuditRegistry::new();
 
     // This should not fail even if server storage is not initialized
     // as it's an integration test
-    let result = registry.create_audit_targets_from_config(&config).await;
+    let result = registry.create_targets_from_config(&config).await;
 
     // We expect this to fail due to server storage not being initialized
     // but the parsing should work correctly
     match result {
-        Err(AuditError::StorageNotAvailable(_)) => {
+        Err(AuditError::ServerNotInitialized(_)) => {
             // This is expected in test environment
         }
         Err(e) => {

crates/audit/tests/performance_test.rs

@@ -44,7 +44,7 @@ async fn test_audit_system_startup_performance() {
 #[tokio::test]
 async fn test_concurrent_target_creation() {
     // Test that multiple targets can be created concurrently
-    let registry = AuditRegistry::new();
+    let mut registry = AuditRegistry::new();
 
     // Create config with multiple webhook instances
     let mut config = rustfs_ecstore::config::Config(std::collections::HashMap::new());
@@ -63,7 +63,7 @@ async fn test_concurrent_target_creation() {
     let start = Instant::now();
 
     // This will fail due to server storage not being initialized, but we can measure timing
-    let result = registry.create_audit_targets_from_config(&config).await;
+    let result = registry.create_targets_from_config(&config).await;
     let elapsed = start.elapsed();
 
     println!("Concurrent target creation took: {elapsed:?}");
@@ -73,7 +73,7 @@ async fn test_concurrent_target_creation() {
 
     // Verify it fails with expected error (server not initialized)
     match result {
-        Err(AuditError::StorageNotAvailable(_)) => {
+        Err(AuditError::ServerNotInitialized(_)) => {
             // Expected in test environment
         }
         Err(e) => {
@@ -103,17 +103,17 @@ async fn test_audit_log_dispatch_performance() {
     use std::collections::HashMap;
     let id = 1;
 
-    let mut req_header = hashbrown::HashMap::new();
+    let mut req_header = HashMap::new();
     req_header.insert("authorization".to_string(), format!("Bearer test-token-{id}"));
     req_header.insert("content-type".to_string(), "application/octet-stream".to_string());
 
-    let mut resp_header = hashbrown::HashMap::new();
+    let mut resp_header = HashMap::new();
     resp_header.insert("x-response".to_string(), "ok".to_string());
 
-    let mut tags = hashbrown::HashMap::new();
+    let mut tags = HashMap::new();
     tags.insert(format!("tag-{id}"), json!("sample"));
 
-    let mut req_query = hashbrown::HashMap::new();
+    let mut req_query = HashMap::new();
     req_query.insert("id".to_string(), id.to_string());
 
     let api_details = ApiDetails {

crates/audit/tests/system_integration_test.rs

@@ -35,7 +35,7 @@ async fn test_complete_audit_system_lifecycle() {
 
     // Should fail in test environment but state handling should work
     match start_result {
-        Err(AuditError::StorageNotAvailable(_)) => {
+        Err(AuditError::ServerNotInitialized(_)) => {
             // Expected in test environment
             assert_eq!(system.get_state().await, system::AuditSystemState::Stopped);
         }
@@ -135,7 +135,7 @@ async fn test_global_audit_functions() {
 
 #[tokio::test]
 async fn test_config_parsing_with_multiple_instances() {
-    let registry = AuditRegistry::new();
+    let mut registry = AuditRegistry::new();
 
     // Create config with multiple webhook instances
     let mut config = Config(HashMap::new());
@@ -164,11 +164,11 @@ async fn test_config_parsing_with_multiple_instances() {
     config.0.insert("audit_webhook".to_string(), webhook_section);
 
     // Try to create targets from config
-    let result = registry.create_audit_targets_from_config(&config).await;
+    let result = registry.create_targets_from_config(&config).await;
 
     // Should fail due to server storage not initialized, but parsing should work
     match result {
-        Err(AuditError::StorageNotAvailable(_)) => {
+        Err(AuditError::ServerNotInitialized(_)) => {
             // Expected - parsing worked but save failed
         }
         Err(e) => {
@@ -182,6 +182,48 @@ async fn test_config_parsing_with_multiple_instances() {
     }
 }
 
+// #[tokio::test]
+// async fn test_environment_variable_precedence() {
+//     // Test that environment variables override config file settings
+//     // This test validates the ENV > file instance > file default precedence
+//     // Set some test environment variables
+//     std::env::set_var("RUSTFS_AUDIT_WEBHOOK_ENABLE_TEST", "on");
+//     std::env::set_var("RUSTFS_AUDIT_WEBHOOK_ENDPOINT_TEST", "http://env.example.com/audit");
+//     std::env::set_var("RUSTFS_AUDIT_WEBHOOK_AUTH_TOKEN_TEST", "env-token");
+//     let mut registry = AuditRegistry::new();
+//
+//     // Create config that should be overridden by env vars
+//     let mut config = Config(HashMap::new());
+//     let mut webhook_section = HashMap::new();
+//
+//     let mut test_kvs = KVS::new();
+//     test_kvs.insert("enable".to_string(), "off".to_string()); // Should be overridden
+//     test_kvs.insert("endpoint".to_string(), "http://file.example.com/audit".to_string()); // Should be overridden
+//     test_kvs.insert("batch_size".to_string(), "10".to_string()); // Should remain from file
+//     webhook_section.insert("test".to_string(), test_kvs);
+//
+//     config.0.insert("audit_webhook".to_string(), webhook_section);
+//
+//     // Try to create targets - should use env vars for endpoint/enable, file for batch_size
+//     let result = registry.create_targets_from_config(&config).await;
+//     // Clean up env vars
+//     std::env::remove_var("RUSTFS_AUDIT_WEBHOOK_ENABLE_TEST");
+//     std::env::remove_var("RUSTFS_AUDIT_WEBHOOK_ENDPOINT_TEST");
+//     std::env::remove_var("RUSTFS_AUDIT_WEBHOOK_AUTH_TOKEN_TEST");
+//     // Should fail due to server storage, but precedence logic should work
+//     match result {
+//         Err(AuditError::ServerNotInitialized(_)) => {
+//             // Expected - precedence parsing worked but save failed
+//         }
+//         Err(e) => {
+//             println!("Environment precedence test error: {}", e);
+//         }
+//         Ok(_) => {
+//             println!("Unexpected success in environment precedence test");
+//         }
+//     }
+// }
+
 #[test]
 fn test_target_type_validation() {
     use rustfs_targets::target::TargetType;
@@ -273,18 +315,19 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
     use chrono::Utc;
     use rustfs_targets::EventName;
     use serde_json::json;
+    use std::collections::HashMap;
 
-    let mut req_header = hashbrown::HashMap::new();
+    let mut req_header = HashMap::new();
     req_header.insert("authorization".to_string(), format!("Bearer test-token-{id}"));
     req_header.insert("content-type".to_string(), "application/octet-stream".to_string());
 
-    let mut resp_header = hashbrown::HashMap::new();
+    let mut resp_header = HashMap::new();
     resp_header.insert("x-response".to_string(), "ok".to_string());
 
-    let mut tags = hashbrown::HashMap::new();
+    let mut tags = HashMap::new();
     tags.insert(format!("tag-{id}"), json!("sample"));
 
-    let mut req_query = hashbrown::HashMap::new();
+    let mut req_query = HashMap::new();
     req_query.insert("id".to_string(), id.to_string());
 
     let api_details = ApiDetails {

crates/common/Cargo.toml

@@ -39,4 +39,3 @@ path-clean = { workspace = true }
 rmp-serde = { workspace = true }
 async-trait = { workspace = true }
 s3s = { workspace = true }
-tracing = { workspace = true }

crates/common/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
-  <a href="https://docs.rustfs.com/">📖 Documentation</a>
+  <a href="https://docs.rustfs.com/en/">📖 Documentation</a>
   · <a href="https://github.com/rustfs/rustfs/issues">🐛 Bug Reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">💬 Discussions</a>
 </p>

crates/common/src/globals.rs

@@ -19,37 +19,12 @@ use std::sync::LazyLock;
 use tokio::sync::RwLock;
 use tonic::transport::Channel;
 
-pub static GLOBAL_LOCAL_NODE_NAME: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
-pub static GLOBAL_RUSTFS_HOST: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
-pub static GLOBAL_RUSTFS_PORT: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("9000".to_string()));
-pub static GLOBAL_RUSTFS_ADDR: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
-pub static GLOBAL_CONN_MAP: LazyLock<RwLock<HashMap<String, Channel>>> = LazyLock::new(|| RwLock::new(HashMap::new()));
+pub static GLOBAL_Local_Node_Name: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
+pub static GLOBAL_Rustfs_Host: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
+pub static GLOBAL_Rustfs_Port: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("9000".to_string()));
+pub static GLOBAL_Rustfs_Addr: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
+pub static GLOBAL_Conn_Map: LazyLock<RwLock<HashMap<String, Channel>>> = LazyLock::new(|| RwLock::new(HashMap::new()));
 
 pub async fn set_global_addr(addr: &str) {
-    *GLOBAL_RUSTFS_ADDR.write().await = addr.to_string();
-}
-
-/// Evict a stale/dead connection from the global connection cache.
-/// This is critical for cluster recovery when a node dies unexpectedly (e.g., power-off).
-/// By removing the cached connection, subsequent requests will establish a fresh connection.
-pub async fn evict_connection(addr: &str) {
-    let removed = GLOBAL_CONN_MAP.write().await.remove(addr);
-    if removed.is_some() {
-        tracing::warn!("Evicted stale connection from cache: {}", addr);
-    }
-}
-
-/// Check if a connection exists in the cache for the given address.
-pub async fn has_cached_connection(addr: &str) -> bool {
-    GLOBAL_CONN_MAP.read().await.contains_key(addr)
-}
-
-/// Clear all cached connections. Useful for full cluster reset/recovery.
-pub async fn clear_all_connections() {
-    let mut map = GLOBAL_CONN_MAP.write().await;
-    let count = map.len();
-    map.clear();
-    if count > 0 {
-        tracing::warn!("Cleared {} cached connections from global map", count);
-    }
+    *GLOBAL_Rustfs_Addr.write().await = addr.to_string();
 }

crates/common/src/heal_channel.rs

@@ -85,90 +85,12 @@ impl Display for DriveState {
     }
 }
 
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-#[repr(u8)]
+#[derive(Clone, Copy, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
 pub enum HealScanMode {
-    Unknown = 0,
+    Unknown,
     #[default]
-    Normal = 1,
-    Deep = 2,
-}
-
-impl Serialize for HealScanMode {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        serializer.serialize_u8(*self as u8)
-    }
-}
-
-impl<'de> Deserialize<'de> for HealScanMode {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        struct HealScanModeVisitor;
-
-        impl<'de> serde::de::Visitor<'de> for HealScanModeVisitor {
-            type Value = HealScanMode;
-
-            fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
-                formatter.write_str("an integer between 0 and 2")
-            }
-
-            fn visit_u8<E>(self, value: u8) -> Result<Self::Value, E>
-            where
-                E: serde::de::Error,
-            {
-                match value {
-                    0 => Ok(HealScanMode::Unknown),
-                    1 => Ok(HealScanMode::Normal),
-                    2 => Ok(HealScanMode::Deep),
-                    _ => Err(E::custom(format!("invalid HealScanMode value: {value}"))),
-                }
-            }
-
-            fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E>
-            where
-                E: serde::de::Error,
-            {
-                if value > u8::MAX as u64 {
-                    return Err(E::custom(format!("HealScanMode value too large: {value}")));
-                }
-                self.visit_u8(value as u8)
-            }
-
-            fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E>
-            where
-                E: serde::de::Error,
-            {
-                if value < 0 || value > u8::MAX as i64 {
-                    return Err(E::custom(format!("invalid HealScanMode value: {value}")));
-                }
-                self.visit_u8(value as u8)
-            }
-
-            fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
-            where
-                E: serde::de::Error,
-            {
-                // Try parsing as number string first (for URL-encoded values)
-                if let Ok(num) = value.parse::<u8>() {
-                    return self.visit_u8(num);
-                }
-                // Try parsing as named string
-                match value {
-                    "Unknown" | "unknown" => Ok(HealScanMode::Unknown),
-                    "Normal" | "normal" => Ok(HealScanMode::Normal),
-                    "Deep" | "deep" => Ok(HealScanMode::Deep),
-                    _ => Err(E::custom(format!("invalid HealScanMode string: {value}"))),
-                }
-            }
-        }
-
-        deserializer.deserialize_any(HealScanModeVisitor)
-    }
+    Normal,
+    Deep,
 }
 
 #[derive(Clone, Copy, Debug, Default, Serialize, Deserialize)]
@@ -184,9 +106,7 @@ pub struct HealOpts {
     pub update_parity: bool,
     #[serde(rename = "nolock")]
     pub no_lock: bool,
-    #[serde(rename = "pool", default)]
     pub pool: Option<usize>,
-    #[serde(rename = "set", default)]
     pub set: Option<usize>,
 }
 

crates/config/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
-  <a href="https://docs.rustfs.com/">📖 Documentation</a>
+  <a href="https://docs.rustfs.com/en/">📖 Documentation</a>
   · <a href="https://github.com/rustfs/rustfs/issues">🐛 Bug Reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">💬 Discussions</a>
 </p>

crates/config/src/audit/mod.rs

@@ -29,7 +29,7 @@ pub const AUDIT_PREFIX: &str = "audit";
 pub const AUDIT_ROUTE_PREFIX: &str = const_str::concat!(AUDIT_PREFIX, DEFAULT_DELIMITER);
 
 pub const AUDIT_WEBHOOK_SUB_SYS: &str = "audit_webhook";
-pub const AUDIT_MQTT_SUB_SYS: &str = "audit_mqtt";
+pub const AUDIT_MQTT_SUB_SYS: &str = "mqtt_webhook";
 
 pub const AUDIT_STORE_EXTENSION: &str = ".audit";
 #[allow(dead_code)]

crates/config/src/constants/app.rs

@@ -25,7 +25,7 @@ pub const VERSION: &str = "1.0.0";
 
 /// Default configuration logger level
 /// Default value: error
-/// Environment variable: RUSTFS_OBS_LOGGER_LEVEL
+/// Environment variable: RUSTFS_LOG_LEVEL
 pub const DEFAULT_LOG_LEVEL: &str = "error";
 
 /// Default configuration use stdout
@@ -145,7 +145,7 @@ pub const DEFAULT_LOG_ROTATION_TIME: &str = "hour";
 /// It is used to keep the logs of the application.
 /// Default value: 30
 /// Environment variable: RUSTFS_OBS_LOG_KEEP_FILES
-pub const DEFAULT_LOG_KEEP_FILES: usize = 30;
+pub const DEFAULT_LOG_KEEP_FILES: u16 = 30;
 
 /// Default log local logging enabled for rustfs
 /// This is the default log local logging enabled for rustfs.

crates/config/src/constants/body_limits.rs

@@ -1,56 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Request body size limits for admin API endpoints
-//!
-//! These limits prevent DoS attacks through unbounded memory allocation
-//! while allowing legitimate use cases.
-
-/// Maximum size for standard admin API request bodies (1 MB)
-/// Used for: user creation/update, policies, tier config, KMS config, events, groups, service accounts
-/// Rationale: Admin API payloads are typically JSON/XML configs under 100KB.
-/// AWS IAM policy limit is 6KB-10KB. 1MB provides generous headroom.
-pub const MAX_ADMIN_REQUEST_BODY_SIZE: usize = 1024 * 1024; // 1 MB
-
-/// Maximum size for IAM import/export operations (10 MB)
-/// Used for: IAM entity imports/exports containing multiple users, policies, groups
-/// Rationale: ZIP archives with hundreds of IAM entities. 10MB allows ~10,000 small configs.
-pub const MAX_IAM_IMPORT_SIZE: usize = 10 * 1024 * 1024; // 10 MB
-
-/// Maximum size for bucket metadata import operations (100 MB)
-/// Used for: Bucket metadata import containing configurations for many buckets
-/// Rationale: Large deployments may have thousands of buckets with various configs.
-/// 100MB allows importing metadata for ~10,000 buckets with reasonable configs.
-pub const MAX_BUCKET_METADATA_IMPORT_SIZE: usize = 100 * 1024 * 1024; // 100 MB
-
-/// Maximum size for healing operation requests (1 MB)
-/// Used for: Healing parameters and configuration
-/// Rationale: Healing requests contain bucket/object paths and options. Should be small.
-pub const MAX_HEAL_REQUEST_SIZE: usize = 1024 * 1024; // 1 MB
-
-/// Maximum size for S3 client response bodies (10 MB)
-/// Used for: Reading responses from remote S3-compatible services (ACL, attributes, lists)
-/// Rationale: Responses from external services should be bounded.
-/// Large responses (>10MB) indicate misconfiguration or potential attack.
-/// Typical responses: ACL XML < 10KB, List responses < 1MB
-///
-/// Rationale: Responses from external S3-compatible services should be bounded.
-/// - ACL XML responses: typically < 10KB
-/// - Object attributes: typically < 100KB
-/// - List responses: typically < 1MB (1000 objects with metadata)
-/// - Location/error responses: typically < 10KB
-///
-/// 10MB provides generous headroom for legitimate responses while preventing
-/// memory exhaustion from malicious or misconfigured remote services.
-pub const MAX_S3_CLIENT_RESPONSE_SIZE: usize = 10 * 1024 * 1024; // 10 MB

crates/config/src/constants/compress.rs

@@ -1,61 +0,0 @@
-//  Copyright 2024 RustFS Team
-//
-//  Licensed under the Apache License, Version 2.0 (the "License");
-//  you may not use this file except in compliance with the License.
-//  You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-//  Unless required by applicable law or agreed to in writing, software
-//  distributed under the License is distributed on an "AS IS" BASIS,
-//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-//  See the License for the specific language governing permissions and
-//  limitations under the License.
-
-//! HTTP Response Compression Configuration
-//!
-//! This module provides configuration options for HTTP response compression.
-//! By default, compression is disabled (aligned with MinIO behavior).
-//! When enabled via `RUSTFS_COMPRESS_ENABLE=on`, compression can be configured
-//! to apply only to specific file extensions, MIME types, and minimum file sizes.
-
-/// Environment variable to enable/disable HTTP response compression
-/// Default: off (disabled)
-/// Values: on, off, true, false, yes, no, 1, 0
-/// Example: RUSTFS_COMPRESS_ENABLE=on
-pub const ENV_COMPRESS_ENABLE: &str = "RUSTFS_COMPRESS_ENABLE";
-
-/// Default compression enable state
-/// Aligned with MinIO behavior - compression is disabled by default
-pub const DEFAULT_COMPRESS_ENABLE: bool = false;
-
-/// Environment variable for file extensions that should be compressed
-/// Comma-separated list of file extensions (with or without leading dot)
-/// Default: "" (empty, meaning use MIME type matching only)
-/// Example: RUSTFS_COMPRESS_EXTENSIONS=.txt,.log,.csv,.json,.xml,.html,.css,.js
-pub const ENV_COMPRESS_EXTENSIONS: &str = "RUSTFS_COMPRESS_EXTENSIONS";
-
-/// Default file extensions for compression
-/// Empty by default - relies on MIME type matching
-pub const DEFAULT_COMPRESS_EXTENSIONS: &str = "";
-
-/// Environment variable for MIME types that should be compressed
-/// Comma-separated list of MIME types, supports wildcard (*) for subtypes
-/// Default: "text/*,application/json,application/xml,application/javascript"
-/// Example: RUSTFS_COMPRESS_MIME_TYPES=text/*,application/json,application/xml
-pub const ENV_COMPRESS_MIME_TYPES: &str = "RUSTFS_COMPRESS_MIME_TYPES";
-
-/// Default MIME types for compression
-/// Includes common text-based content types that benefit from compression
-pub const DEFAULT_COMPRESS_MIME_TYPES: &str = "text/*,application/json,application/xml,application/javascript";
-
-/// Environment variable for minimum file size to apply compression
-/// Files smaller than this size will not be compressed
-/// Default: 1000 (bytes)
-/// Example: RUSTFS_COMPRESS_MIN_SIZE=1000
-pub const ENV_COMPRESS_MIN_SIZE: &str = "RUSTFS_COMPRESS_MIN_SIZE";
-
-/// Default minimum file size for compression (in bytes)
-/// Files smaller than 1000 bytes typically don't benefit from compression
-/// and the compression overhead may outweigh the benefits
-pub const DEFAULT_COMPRESS_MIN_SIZE: u64 = 1000;

crates/config/src/constants/env.rs

@@ -16,8 +16,7 @@ pub const DEFAULT_DELIMITER: &str = "_";
 pub const ENV_PREFIX: &str = "RUSTFS_";
 pub const ENV_WORD_DELIMITER: &str = "_";
 
-pub const EVENT_DEFAULT_DIR: &str = "/opt/rustfs/events"; // Default directory for event store
-pub const AUDIT_DEFAULT_DIR: &str = "/opt/rustfs/audit"; // Default directory for audit store
+pub const DEFAULT_DIR: &str = "/opt/rustfs/events"; // Default directory for event store
 pub const DEFAULT_LIMIT: u64 = 100000; // Default store limit
 
 /// Standard config keys and values.

crates/config/src/constants/heal.rs

@@ -1,88 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/// Environment variable name that enables or disables auto-heal functionality.
-/// - Purpose: Control whether the system automatically performs heal operations.
-/// - Valid values: "true" or "false" (case insensitive).
-/// - Semantics: When set to "true", auto-heal is enabled and the system will automatically attempt to heal detected issues; when set to "false", auto-heal is disabled and healing must be triggered manually.
-/// - Example: `export RUSTFS_HEAL_AUTO_HEAL_ENABLE=true`
-/// - Note: Enabling auto-heal can improve system resilience by automatically addressing issues, but may increase resource usage; evaluate based on your operational requirements.
-pub const ENV_HEAL_AUTO_HEAL_ENABLE: &str = "RUSTFS_HEAL_AUTO_HEAL_ENABLE";
-
-/// Environment variable name that specifies the heal queue size.
-///
-/// - Purpose: Set the maximum number of heal requests that can be queued.
-/// - Unit: number of requests (usize).
-/// - Valid values: any positive integer.
-/// - Semantics: When the heal queue reaches this size, new heal requests may be rejected or blocked until space is available; tune according to expected heal workload and system capacity.
-/// - Example: `export RUSTFS_HEAL_QUEUE_SIZE=10000`
-/// - Note: A larger queue size can accommodate bursts of heal requests but may increase memory usage.
-pub const ENV_HEAL_QUEUE_SIZE: &str = "RUSTFS_HEAL_QUEUE_SIZE";
-/// Environment variable name that specifies the heal interval in seconds.
-/// - Purpose: Define the time interval between successive heal operations.
-/// - Unit: seconds (u64).
-/// - Valid values: any positive integer.
-/// - Semantics: This interval controls how frequently the heal manager checks for and processes heal requests; shorter intervals lead to more responsive healing but may increase system load.
-/// - Example: `export RUSTFS_HEAL_INTERVAL_SECS=10`
-/// - Note: Choose an interval that balances healing responsiveness with overall system performance.
-pub const ENV_HEAL_INTERVAL_SECS: &str = "RUSTFS_HEAL_INTERVAL_SECS";
-
-/// Environment variable name that specifies the heal task timeout in seconds.
-/// - Purpose: Set the maximum duration allowed for a heal task to complete.
-/// - Unit: seconds (u64).
-/// - Valid values: any positive integer.
-/// - Semantics: If a heal task exceeds this timeout, it may be aborted or retried; tune according to the expected duration of heal operations and system performance characteristics.
-/// - Example: `export RUSTFS_HEAL_TASK_TIMEOUT_SECS=300`
-/// - Note: Setting an appropriate timeout helps prevent long-running heal tasks from impacting system stability.
-pub const ENV_HEAL_TASK_TIMEOUT_SECS: &str = "RUSTFS_HEAL_TASK_TIMEOUT_SECS";
-
-/// Environment variable name that specifies the maximum number of concurrent heal operations.
-/// - Purpose: Limit the number of heal operations that can run simultaneously.
-/// - Unit: number of operations (usize).
-/// - Valid values: any positive integer.
-/// - Semantics: This limit helps control resource usage during healing; tune according to system capacity and expected heal workload.
-/// - Example: `export RUSTFS_HEAL_MAX_CONCURRENT_HEALS=4`
-/// - Note: A higher concurrency limit can speed up healing but may lead to resource contention.
-pub const ENV_HEAL_MAX_CONCURRENT_HEALS: &str = "RUSTFS_HEAL_MAX_CONCURRENT_HEALS";
-
-/// Default value for enabling authentication for heal operations if not specified in the environment variable.
-/// - Value: true (authentication enabled).
-/// - Rationale: Enabling authentication by default enhances security for heal operations.
-/// - Adjustments: Users may disable this feature via the `RUSTFS_HEAL_AUTO_HEAL_ENABLE` environment variable based on their security requirements.
-pub const DEFAULT_HEAL_AUTO_HEAL_ENABLE: bool = true;
-
-/// Default heal queue size if not specified in the environment variable.
-///
-/// - Value: 10,000 requests.
-/// - Rationale: This default size balances the need to handle typical heal workloads without excessive memory consumption.
-/// - Adjustments: Users may modify this value via the `RUSTFS_HEAL_QUEUE_SIZE` environment variable based on their specific use cases and system capabilities.
-pub const DEFAULT_HEAL_QUEUE_SIZE: usize = 10_000;
-
-/// Default heal interval in seconds if not specified in the environment variable.
-/// - Value: 10 seconds.
-/// - Rationale: This default interval provides a reasonable balance between healing responsiveness and system load for most deployments.
-/// - Adjustments: Users may modify this value via the `RUSTFS_HEAL_INTERVAL_SECS` environment variable based on their specific healing requirements and system performance.
-pub const DEFAULT_HEAL_INTERVAL_SECS: u64 = 10;
-
-/// Default heal task timeout in seconds if not specified in the environment variable.
-/// - Value: 300 seconds (5 minutes).
-/// - Rationale: This default timeout allows sufficient time for most heal operations to complete while preventing excessively long-running tasks.
-/// - Adjustments: Users may modify this value via the `RUSTFS_HEAL_TASK_TIMEOUT_SECS` environment variable based on their specific heal operation characteristics and system performance.
-pub const DEFAULT_HEAL_TASK_TIMEOUT_SECS: u64 = 300; // 5 minutes
-
-/// Default maximum number of concurrent heal operations if not specified in the environment variable.
-/// - Value: 4 concurrent heal operations.
-/// - Rationale: This default concurrency limit helps balance healing speed with resource usage, preventing system overload.
-/// - Adjustments: Users may modify this value via the `RUSTFS_HEAL_MAX_CONCURRENT_HEALS` environment variable based on their system capacity and expected heal workload.
-pub const DEFAULT_HEAL_MAX_CONCURRENT_HEALS: usize = 4;

crates/config/src/constants/mod.rs

@@ -13,12 +13,8 @@
 // limitations under the License.
 
 pub(crate) mod app;
-pub(crate) mod body_limits;
-pub(crate) mod compress;
 pub(crate) mod console;
 pub(crate) mod env;
-pub(crate) mod heal;
-pub(crate) mod object;
 pub(crate) mod profiler;
 pub(crate) mod runtime;
 pub(crate) mod targets;

crates/config/src/constants/object.rs

@@ -1,169 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/// Environment variable name to toggle object-level in-memory caching.
-///
-/// - Purpose: Enable or disable the object-level in-memory cache (moka).
-/// - Acceptable values: `"true"` / `"false"` (case-insensitive) or a boolean typed config.
-/// - Semantics: When enabled, the system keeps fully-read objects in memory to reduce backend requests; when disabled, reads bypass the object cache.
-/// - Example: `export RUSTFS_OBJECT_CACHE_ENABLE=true`
-/// - Note: Evaluate together with `RUSTFS_OBJECT_CACHE_CAPACITY_MB`, TTL/TTI and concurrency thresholds to balance memory usage and throughput.
-pub const ENV_OBJECT_CACHE_ENABLE: &str = "RUSTFS_OBJECT_CACHE_ENABLE";
-
-/// Environment variable name that specifies the object cache capacity in megabytes.
-///
-/// - Purpose: Set the maximum total capacity of the object cache (in MB).
-/// - Unit: MB (1 MB = 1_048_576 bytes).
-/// - Valid values: any positive integer (0 may indicate disabled or alternative handling).
-/// - Semantics: When the moka cache reaches this capacity, eviction policies will remove entries; tune according to available memory and object size distribution.
-/// - Example: `export RUSTFS_OBJECT_CACHE_CAPACITY_MB=512`
-/// - Note: Actual memory usage will be slightly higher due to object headers and indexing overhead.
-pub const ENV_OBJECT_CACHE_CAPACITY_MB: &str = "RUSTFS_OBJECT_CACHE_CAPACITY_MB";
-
-/// Environment variable name for maximum object size eligible for caching in megabytes.
-///
-/// - Purpose: Define the upper size limit for individual objects to be considered for caching.
-/// - Unit: MB (1 MB = 1_048_576 bytes).
-/// - Valid values: any positive integer; objects larger than this size will not be cached.
-/// - Semantics: Prevents caching of excessively large objects that could monopolize cache capacity; tune based on typical object size distribution.
-/// - Example: `export RUSTFS_OBJECT_CACHE_MAX_OBJECT_SIZE_MB=50`
-/// - Note: Setting this too low may reduce cache effectiveness; setting it too high may lead to inefficient memory usage.
-pub const ENV_OBJECT_CACHE_MAX_OBJECT_SIZE_MB: &str = "RUSTFS_OBJECT_CACHE_MAX_OBJECT_SIZE_MB";
-
-/// Environment variable name for object cache TTL (time-to-live) in seconds.
-///
-/// - Purpose: Specify the maximum lifetime of a cached entry from the moment it is written.
-/// - Unit: seconds (u64).
-/// - Semantics: TTL acts as a hard upper bound; entries older than TTL are considered expired and removed by periodic cleanup.
-/// - Example: `export RUSTFS_OBJECT_CACHE_TTL_SECS=300`
-/// - Note: TTL and TTI both apply; either policy can cause eviction.
-pub const ENV_OBJECT_CACHE_TTL_SECS: &str = "RUSTFS_OBJECT_CACHE_TTL_SECS";
-
-/// Environment variable name for object cache TTI (time-to-idle) in seconds.
-///
-/// - Purpose: Specify how long an entry may remain in cache without being accessed before it is evicted.
-/// - Unit: seconds (u64).
-/// - Semantics: TTI helps remove one-time or infrequently used entries; frequent accesses reset idle timers but do not extend beyond TTL unless additional logic exists.
-/// - Example: `export RUSTFS_OBJECT_CACHE_TTI_SECS=120`
-/// - Note: Works together with TTL to keep the cache populated with actively used objects.
-pub const ENV_OBJECT_CACHE_TTI_SECS: &str = "RUSTFS_OBJECT_CACHE_TTI_SECS";
-
-/// Environment variable name for threshold of "hot" object hit count used to extend life.
-///
-/// - Purpose: Define a hit-count threshold to mark objects as "hot" so they may be treated preferentially near expiration.
-/// - Valid values: positive integer (usize).
-/// - Semantics: Objects reaching this hit count can be considered for relaxed eviction to avoid thrashing hot items.
-/// - Example: `export RUSTFS_OBJECT_HOT_MIN_HITS_TO_EXTEND=5`
-/// - Note: This is an optional enhancement and requires cache-layer statistics and extension logic to take effect.
-pub const ENV_OBJECT_HOT_MIN_HITS_TO_EXTEND: &str = "RUSTFS_OBJECT_HOT_MIN_HITS_TO_EXTEND";
-
-/// Environment variable name for high concurrency threshold used in adaptive buffering.
-///
-/// - Purpose: When concurrent request count exceeds this threshold, the system enters a "high concurrency" optimization mode to reduce per-request buffer sizes.
-/// - Unit: request count (usize).
-/// - Semantics: High concurrency mode reduces per-request buffers (e.g., to a fraction of base size) to protect overall memory and fairness.
-/// - Example: `export RUSTFS_OBJECT_HIGH_CONCURRENCY_THRESHOLD=8`
-/// - Note: This affects buffering and I/O behavior, not cache capacity directly.
-pub const ENV_OBJECT_HIGH_CONCURRENCY_THRESHOLD: &str = "RUSTFS_OBJECT_HIGH_CONCURRENCY_THRESHOLD";
-
-/// Environment variable name for medium concurrency threshold used in adaptive buffering.
-///
-/// - Purpose: Define the boundary for "medium concurrency" where more moderate buffer adjustments apply.
-/// - Unit: request count (usize).
-/// - Semantics: In the medium range, buffers are reduced moderately to balance throughput and memory efficiency.
-/// - Example: `export RUSTFS_OBJECT_MEDIUM_CONCURRENCY_THRESHOLD=4`
-/// - Note: Tune this value based on target workload and hardware.
-pub const ENV_OBJECT_MEDIUM_CONCURRENCY_THRESHOLD: &str = "RUSTFS_OBJECT_MEDIUM_CONCURRENCY_THRESHOLD";
-
-/// Environment variable name for maximum concurrent disk reads for object operations.
-/// - Purpose: Limit the number of concurrent disk read operations for object reads to prevent I/O saturation.
-/// - Unit: request count (usize).
-/// - Semantics: Throttling disk reads helps maintain overall system responsiveness under load.
-/// - Example: `export RUSTFS_OBJECT_MAX_CONCURRENT_DISK_READS=16`
-/// - Note: This setting may interact with OS-level I/O scheduling and should be tuned based on hardware capabilities.
-pub const ENV_OBJECT_MAX_CONCURRENT_DISK_READS: &str = "RUSTFS_OBJECT_MAX_CONCURRENT_DISK_READS";
-
-/// Default: object caching is disabled.
-///
-/// - Semantics: Safe default to avoid unexpected memory usage or cache consistency concerns when not explicitly enabled.
-/// - Default is set to false (disabled).
-pub const DEFAULT_OBJECT_CACHE_ENABLE: bool = false;
-
-/// Default object cache capacity in MB.
-///
-/// - Default: 100 MB (can be overridden by `RUSTFS_OBJECT_CACHE_CAPACITY_MB`).
-/// - Note: Choose a conservative default to reduce memory pressure in development/testing.
-pub const DEFAULT_OBJECT_CACHE_CAPACITY_MB: u64 = 100;
-
-/// Default maximum object size eligible for caching in MB.
-///
-/// - Default: 10 MB (can be overridden by `RUSTFS_OBJECT_CACHE_MAX_OBJECT_SIZE_MB`).
-/// - Note: Balances caching effectiveness with memory usage.
-pub const DEFAULT_OBJECT_CACHE_MAX_OBJECT_SIZE_MB: usize = 10;
-
-/// Maximum concurrent requests before applying aggressive optimization.
-///
-/// When concurrent requests exceed this threshold (>8), the system switches to
-/// aggressive memory optimization mode, reducing buffer sizes to 40% of base size
-/// to prevent memory exhaustion and ensure fair resource allocation.
-///
-/// This helps maintain system stability under high load conditions.
-/// Default is set to 8 concurrent requests.
-pub const DEFAULT_OBJECT_HIGH_CONCURRENCY_THRESHOLD: usize = 8;
-
-/// Medium concurrency threshold for buffer size adjustment.
-///
-/// At this level (3-4 requests), buffers are reduced to 75% of base size to
-/// balance throughput and memory efficiency as load increases.
-///
-/// This helps maintain performance without overly aggressive memory reduction.
-///
-/// Default is set to 4 concurrent requests.
-pub const DEFAULT_OBJECT_MEDIUM_CONCURRENCY_THRESHOLD: usize = 4;
-
-/// Maximum concurrent disk reads for object operations.
-/// Limits the number of simultaneous disk read operations to prevent I/O saturation.
-///
-/// A higher value may improve throughput on high-performance storage,
-/// but could also lead to increased latency if the disk becomes overloaded.
-///
-/// Default is set to 64 concurrent reads.
-pub const DEFAULT_OBJECT_MAX_CONCURRENT_DISK_READS: usize = 64;
-
-/// Time-to-live for cached objects (5 minutes = 300 seconds).
-///
-/// After this duration, cached objects are automatically expired by Moka's
-/// background cleanup process, even if they haven't been accessed. This prevents
-/// stale data from consuming cache capacity indefinitely.
-///
-/// Default is set to 300 seconds.
-pub const DEFAULT_OBJECT_CACHE_TTL_SECS: u64 = 300;
-
-/// Time-to-idle for cached objects (2 minutes = 120 seconds).
-///
-/// Objects that haven't been accessed for this duration are automatically evicted,
-/// even if their TTL hasn't expired. This ensures cache is populated with actively
-/// used objects and clears out one-time reads efficiently.
-///
-/// Default is set to 120 seconds.
-pub const DEFAULT_OBJECT_CACHE_TTI_SECS: u64 = 120;
-
-/// Minimum hit count to extend object lifetime beyond TTL.
-///
-/// "Hot" objects that have been accessed at least this many times are treated
-/// specially - they can survive longer in cache even as they approach TTL expiration.
-/// This prevents frequently accessed objects from being evicted prematurely.
-///
-/// Default is set to 5 hits.
-pub const DEFAULT_OBJECT_HOT_MIN_HITS_TO_EXTEND: usize = 5;

crates/config/src/constants/profiler.rs

@@ -12,39 +12,30 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-/// Profiler related environment variable names and default values
 pub const ENV_ENABLE_PROFILING: &str = "RUSTFS_ENABLE_PROFILING";
 
 // CPU profiling
 pub const ENV_CPU_MODE: &str = "RUSTFS_PROF_CPU_MODE"; // off|continuous|periodic
-/// Frequency of CPU profiling samples
 pub const ENV_CPU_FREQ: &str = "RUSTFS_PROF_CPU_FREQ";
-/// Interval between CPU profiling sessions (for periodic mode)
 pub const ENV_CPU_INTERVAL_SECS: &str = "RUSTFS_PROF_CPU_INTERVAL_SECS";
-/// Duration of each CPU profiling session (for periodic mode)
 pub const ENV_CPU_DURATION_SECS: &str = "RUSTFS_PROF_CPU_DURATION_SECS";
 
-/// Memory profiling (jemalloc)
+// Memory profiling (jemalloc)
 pub const ENV_MEM_PERIODIC: &str = "RUSTFS_PROF_MEM_PERIODIC";
-/// Interval between memory profiling snapshots (for periodic mode)
 pub const ENV_MEM_INTERVAL_SECS: &str = "RUSTFS_PROF_MEM_INTERVAL_SECS";
 
-/// Output directory
+// Output directory
 pub const ENV_OUTPUT_DIR: &str = "RUSTFS_PROF_OUTPUT_DIR";
 
-/// Defaults for profiler settings
+// Defaults
 pub const DEFAULT_ENABLE_PROFILING: bool = false;
-/// CPU profiling
+
 pub const DEFAULT_CPU_MODE: &str = "off";
-/// Frequency of CPU profiling samples
 pub const DEFAULT_CPU_FREQ: usize = 100;
-/// Interval between CPU profiling sessions (for periodic mode)
 pub const DEFAULT_CPU_INTERVAL_SECS: u64 = 300;
-/// Duration of each CPU profiling session (for periodic mode)
 pub const DEFAULT_CPU_DURATION_SECS: u64 = 60;
-/// Memory profiling (jemalloc)
+
 pub const DEFAULT_MEM_PERIODIC: bool = false;
-/// Interval between memory profiling snapshots (for periodic mode)
 pub const DEFAULT_MEM_INTERVAL_SECS: u64 = 300;
-/// Output directory
+
 pub const DEFAULT_OUTPUT_DIR: &str = ".";

crates/config/src/lib.rs

@@ -17,18 +17,10 @@ pub mod constants;
 #[cfg(feature = "constants")]
 pub use constants::app::*;
 #[cfg(feature = "constants")]
-pub use constants::body_limits::*;
-#[cfg(feature = "constants")]
-pub use constants::compress::*;
-#[cfg(feature = "constants")]
 pub use constants::console::*;
 #[cfg(feature = "constants")]
 pub use constants::env::*;
 #[cfg(feature = "constants")]
-pub use constants::heal::*;
-#[cfg(feature = "constants")]
-pub use constants::object::*;
-#[cfg(feature = "constants")]
 pub use constants::profiler::*;
 #[cfg(feature = "constants")]
 pub use constants::runtime::*;

crates/config/src/notify/mod.rs

@@ -24,33 +24,13 @@ pub use webhook::*;
 
 use crate::DEFAULT_DELIMITER;
 
-/// Default target identifier for notifications,
-/// Used in notification system when no specific target is provided,
-/// Represents the default target stream or endpoint for notifications when no specific target is provided.
+// --- Configuration Constants ---
 pub const DEFAULT_TARGET: &str = "1";
-/// Notification prefix for routing and identification,
-/// Used in notification system,
-/// This prefix is utilized in constructing routes and identifiers related to notifications within the system.
+
 pub const NOTIFY_PREFIX: &str = "notify";
 
-/// Notification route prefix combining the notification prefix and default delimiter
-/// Combines the notification prefix with the default delimiter
-/// Used in notification system for defining routes related to notifications.
-/// Example: "notify:/"
 pub const NOTIFY_ROUTE_PREFIX: &str = const_str::concat!(NOTIFY_PREFIX, DEFAULT_DELIMITER);
 
-/// Name of the environment variable that configures target stream concurrency.
-/// Controls how many target streams are processed in parallel by the notification system.
-/// Defaults to [`DEFAULT_NOTIFY_TARGET_STREAM_CONCURRENCY`] if not set.
-/// Example: `RUSTFS_NOTIFY_TARGET_STREAM_CONCURRENCY=20`.
-pub const ENV_NOTIFY_TARGET_STREAM_CONCURRENCY: &str = "RUSTFS_NOTIFY_TARGET_STREAM_CONCURRENCY";
-
-/// Default concurrency for target stream processing in the notification system
-/// This value is used if the environment variable `RUSTFS_NOTIFY_TARGET_STREAM_CONCURRENCY` is not set.
-/// It defines how many target streams can be processed in parallel by the notification system at any given time.
-/// Adjust this value based on your system's capabilities and expected load.
-pub const DEFAULT_NOTIFY_TARGET_STREAM_CONCURRENCY: usize = 20;
-
 #[allow(dead_code)]
 pub const NOTIFY_SUB_SYSTEMS: &[&str] = &[NOTIFY_MQTT_SUB_SYS, NOTIFY_WEBHOOK_SUB_SYS];
 

crates/config/src/notify/store.rs

@@ -15,5 +15,5 @@
 pub const DEFAULT_EXT: &str = ".unknown"; // Default file extension
 pub const COMPRESS_EXT: &str = ".snappy"; // Extension for compressed files
 
-/// NOTIFY_STORE_EXTENSION - file extension of an event file in store
-pub const NOTIFY_STORE_EXTENSION: &str = ".event";
+/// STORE_EXTENSION - file extension of an event file in store
+pub const STORE_EXTENSION: &str = ".event";

crates/config/src/observability/metrics.rs

@@ -1,19 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/// Metrics collection interval in milliseconds for system metrics (CPU, memory, disk, network).
-pub const DEFAULT_METRICS_SYSTEM_INTERVAL_MS: u64 = 30000;
-
-/// Environment variable for setting the metrics collection interval for system metrics.
-pub const ENV_OBS_METRICS_SYSTEM_INTERVAL_MS: &str = "RUSTFS_OBS_METRICS_SYSTEM_INTERVAL_MS";

crates/config/src/observability/mod.rs

@@ -14,13 +14,7 @@
 
 // Observability Keys
 
-mod metrics;
-pub use metrics::*;
-
 pub const ENV_OBS_ENDPOINT: &str = "RUSTFS_OBS_ENDPOINT";
-pub const ENV_OBS_TRACE_ENDPOINT: &str = "RUSTFS_OBS_TRACE_ENDPOINT";
-pub const ENV_OBS_METRIC_ENDPOINT: &str = "RUSTFS_OBS_METRIC_ENDPOINT";
-pub const ENV_OBS_LOG_ENDPOINT: &str = "RUSTFS_OBS_LOG_ENDPOINT";
 pub const ENV_OBS_USE_STDOUT: &str = "RUSTFS_OBS_USE_STDOUT";
 pub const ENV_OBS_SAMPLE_RATIO: &str = "RUSTFS_OBS_SAMPLE_RATIO";
 pub const ENV_OBS_METER_INTERVAL: &str = "RUSTFS_OBS_METER_INTERVAL";
@@ -71,9 +65,6 @@ mod tests {
     #[test]
     fn test_env_keys() {
         assert_eq!(ENV_OBS_ENDPOINT, "RUSTFS_OBS_ENDPOINT");
-        assert_eq!(ENV_OBS_TRACE_ENDPOINT, "RUSTFS_OBS_TRACE_ENDPOINT");
-        assert_eq!(ENV_OBS_METRIC_ENDPOINT, "RUSTFS_OBS_METRIC_ENDPOINT");
-        assert_eq!(ENV_OBS_LOG_ENDPOINT, "RUSTFS_OBS_LOG_ENDPOINT");
         assert_eq!(ENV_OBS_USE_STDOUT, "RUSTFS_OBS_USE_STDOUT");
         assert_eq!(ENV_OBS_SAMPLE_RATIO, "RUSTFS_OBS_SAMPLE_RATIO");
         assert_eq!(ENV_OBS_METER_INTERVAL, "RUSTFS_OBS_METER_INTERVAL");

crates/crypto/Cargo.toml

@@ -29,8 +29,8 @@ documentation = "https://docs.rs/rustfs-crypto/latest/rustfs_crypto/"
 workspace = true
 
 [dependencies]
-aes-gcm = { workspace = true, optional = true }
-argon2 = { workspace = true, optional = true }
+aes-gcm = { workspace = true, features = ["std"], optional = true }
+argon2 = { workspace = true, features = ["std"], optional = true }
 cfg-if = { workspace = true }
 chacha20poly1305 = { workspace = true, optional = true }
 jsonwebtoken = { workspace = true }

crates/crypto/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/rustfs/rustfs/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/rustfs/rustfs/actions/workflows/ci.yml/badge.svg" /></a>
-  <a href="https://docs.rustfs.com/">📖 Documentation</a>
+  <a href="https://docs.rustfs.com/en/">📖 Documentation</a>
   · <a href="https://github.com/rustfs/rustfs/issues">🐛 Bug Reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">💬 Discussions</a>
 </p>

crates/crypto/src/encdec/decrypt.rs

@@ -19,37 +19,127 @@ pub fn decrypt_data(password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Erro
     use aes_gcm::{Aes256Gcm, KeyInit as _};
     use chacha20poly1305::ChaCha20Poly1305;
 
+    // 32: salt
+    // 1: id
+    // 12: nonce
     const HEADER_LENGTH: usize = 45;
     if data.len() < HEADER_LENGTH {
         return Err(Error::ErrUnexpectedHeader);
     }
 
-    let (salt, id, nonce_slice) = (&data[..32], ID::try_from(data[32])?, &data[33..45]);
-    let body = &data[HEADER_LENGTH..];
+    let (salt, id, nonce) = (&data[..32], ID::try_from(data[32])?, &data[33..45]);
+    let data = &data[HEADER_LENGTH..];
 
     match id {
         ID::Argon2idChaCHa20Poly1305 => {
             let key = id.get_key(password, salt)?;
-            decrypt(ChaCha20Poly1305::new_from_slice(&key)?, nonce_slice, body)
+            decrypt(ChaCha20Poly1305::new_from_slice(&key)?, nonce, data)
         }
         _ => {
             let key = id.get_key(password, salt)?;
-            decrypt(Aes256Gcm::new_from_slice(&key)?, nonce_slice, body)
+            decrypt(Aes256Gcm::new_from_slice(&key)?, nonce, data)
         }
     }
 }
 
+// use argon2::{Argon2, PasswordHasher};
+// use argon2::password_hash::{SaltString};
+// use aes_gcm::{Aes256Gcm, Key, Nonce}; // For AES-GCM
+// use chacha20poly1305::{ChaCha20Poly1305, Key as ChaChaKey, Nonce as ChaChaNonce}; // For ChaCha20
+// use pbkdf2::pbkdf2;
+// use sha2::Sha256;
+// use std::io::{self, Read};
+// use thiserror::Error;
+
+// #[derive(Debug, Error)]
+// pub enum DecryptError {
+//     #[error("unexpected header")]
+//     UnexpectedHeader,
+//     #[error("invalid encryption algorithm ID")]
+//     InvalidAlgorithmId,
+//     #[error("IO error")]
+//     Io(#[from] io::Error),
+//     #[error("decryption error")]
+//     DecryptionError,
+// }
+
+// pub fn decrypt_data2<R: Read>(password: &str, mut data: R) -> Result<Vec<u8>, DecryptError> {
+//     // Parse the stream header
+//     let mut hdr = [0u8; 32 + 1 + 8];
+//     if data.read_exact(&mut hdr).is_err() {
+//         return Err(DecryptError::UnexpectedHeader);
+//     }
+
+//     let salt = &hdr[0..32];
+//     let id = hdr[32];
+//     let nonce = &hdr[33..41];
+
+//     let key = match id {
+//         // Argon2id + AES-GCM
+//         0x01 => {
+//             let salt = SaltString::encode_b64(salt).map_err(|_| DecryptError::DecryptionError)?;
+//             let argon2 = Argon2::default();
+//             let hashed_key = argon2.hash_password(password.as_bytes(), &salt)
+//                 .map_err(|_| DecryptError::DecryptionError)?;
+//             hashed_key.hash.unwrap().as_bytes().to_vec()
+//         }
+//         // Argon2id + ChaCha20Poly1305
+//         0x02 => {
+//             let salt = SaltString::encode_b64(salt).map_err(|_| DecryptError::DecryptionError)?;
+//             let argon2 = Argon2::default();
+//             let hashed_key = argon2.hash_password(password.as_bytes(), &salt)
+//                 .map_err(|_| DecryptError::DecryptionError)?;
+//             hashed_key.hash.unwrap().as_bytes().to_vec()
+//         }
+//         // PBKDF2 + AES-GCM
+//         // 0x03 => {
+//         //     let mut key = [0u8; 32];
+//         //     pbkdf2::<Sha256>(password.as_bytes(), salt, 10000, &mut key);
+//         //     key.to_vec()
+//         // }
+//         _ => return Err(DecryptError::InvalidAlgorithmId),
+//     };
+
+//     // Decrypt data using the corresponding cipher
+//     let mut encrypted_data = Vec::new();
+//     data.read_to_end(&mut encrypted_data)?;
+
+//     let plaintext = match id {
+//         0x01 => {
+//             let cipher = Aes256Gcm::new(Key::from_slice(&key));
+//             let nonce = Nonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         0x02 => {
+//             let cipher = ChaCha20Poly1305::new(ChaChaKey::from_slice(&key));
+//             let nonce = ChaChaNonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         0x03 => {
+
+//             let cipher = Aes256Gcm::new(Key::from_slice(&key));
+//             let nonce = Nonce::from_slice(nonce);
+//             cipher
+//                 .decrypt(nonce, encrypted_data.as_ref())
+//                 .map_err(|_| DecryptError::DecryptionError)?
+//         }
+//         _ => return Err(DecryptError::InvalidAlgorithmId),
+//     };
+
+//     Ok(plaintext)
+// }
+
 #[cfg(any(test, feature = "crypto"))]
 #[inline]
 fn decrypt<T: aes_gcm::aead::Aead>(stream: T, nonce: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {
     use crate::error::Error;
-    use aes_gcm::AeadCore;
-    use aes_gcm::aead::array::Array;
-    use core::convert::TryFrom;
-
-    let nonce_arr: Array<u8, <T as AeadCore>::NonceSize> =
-        Array::try_from(nonce).map_err(|_| Error::ErrDecryptFailed(aes_gcm::aead::Error))?;
-    stream.decrypt(&nonce_arr, data).map_err(Error::ErrDecryptFailed)
+    stream
+        .decrypt(aes_gcm::Nonce::from_slice(nonce), data)
+        .map_err(Error::ErrDecryptFailed)
 }
 
 #[cfg(not(any(test, feature = "crypto")))]

crates/crypto/src/encdec/encrypt.rs

@@ -43,7 +43,7 @@ pub fn encrypt_data(password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Erro
         if native_aes() {
             encrypt(Aes256Gcm::new_from_slice(&key)?, &salt, id, data)
         } else {
-            encrypt(chacha20poly1305::ChaCha20Poly1305::new_from_slice(&key)?, &salt, id, data)
+            encrypt(ChaCha20Poly1305::new_from_slice(&key)?, &salt, id, data)
         }
     }
 }
@@ -56,19 +56,16 @@ fn encrypt<T: aes_gcm::aead::Aead>(
     data: &[u8],
 ) -> Result<Vec<u8>, crate::Error> {
     use crate::error::Error;
-    use aes_gcm::AeadCore;
-    use aes_gcm::aead::array::Array;
-    use rand::RngCore;
+    use aes_gcm::aead::rand_core::OsRng;
 
-    let mut nonce: Array<u8, <T as AeadCore>::NonceSize> = Array::default();
-    rand::rng().fill_bytes(&mut nonce);
+    let nonce = T::generate_nonce(&mut OsRng);
 
     let encryptor = stream.encrypt(&nonce, data).map_err(Error::ErrEncryptFailed)?;
 
     let mut ciphertext = Vec::with_capacity(salt.len() + 1 + nonce.len() + encryptor.len());
     ciphertext.extend_from_slice(salt);
     ciphertext.push(id as u8);
-    ciphertext.extend_from_slice(&nonce);
+    ciphertext.extend_from_slice(nonce.as_slice());
     ciphertext.extend_from_slice(&encryptor);
 
     Ok(ciphertext)

crates/e2e_test/Cargo.toml

@@ -25,7 +25,6 @@ workspace = true
 
 [dependencies]
 rustfs-ecstore.workspace = true
-rustfs-common.workspace = true
 flatbuffers.workspace = true
 futures.workspace = true
 rustfs-lock.workspace = true
@@ -50,4 +49,4 @@ uuid = { workspace = true }
 base64 = { workspace = true }
 rand = { workspace = true }
 chrono = { workspace = true }
-md5 = { workspace = true }
+md5 = { workspace = true }

crates/e2e_test/src/common.rs

@@ -327,8 +327,7 @@ pub async fn execute_awscurl(
 
     if !output.status.success() {
         let stderr = String::from_utf8_lossy(&output.stderr);
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        return Err(format!("awscurl failed: stderr='{stderr}', stdout='{stdout}'").into());
+        return Err(format!("awscurl failed: {stderr}").into());
     }
 
     let response = String::from_utf8_lossy(&output.stdout).to_string();
@@ -353,13 +352,3 @@ pub async fn awscurl_get(
 ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
     execute_awscurl(url, "GET", None, access_key, secret_key).await
 }
-
-/// Helper function for PUT requests
-pub async fn awscurl_put(
-    url: &str,
-    body: &str,
-    access_key: &str,
-    secret_key: &str,
-) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
-    execute_awscurl(url, "PUT", Some(body), access_key, secret_key).await
-}

crates/e2e_test/src/content_encoding_test.rs

@@ -1,85 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! End-to-end test for Content-Encoding header handling
-//!
-//! Tests that the Content-Encoding header is correctly stored during PUT
-//! and returned in GET/HEAD responses. This is important for clients that
-//! upload pre-compressed content and rely on the header for decompression.
-
-#[cfg(test)]
-mod tests {
-    use crate::common::{RustFSTestEnvironment, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use serial_test::serial;
-    use tracing::info;
-
-    /// Verify Content-Encoding header roundtrips through PUT, GET, and HEAD operations
-    #[tokio::test]
-    #[serial]
-    async fn test_content_encoding_roundtrip() {
-        init_logging();
-        info!("Starting Content-Encoding roundtrip test");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
-        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "content-encoding-test";
-        let key = "logs/app.log.zst";
-        let content = b"2024-01-15 10:23:45 INFO Application started\n2024-01-15 10:23:46 DEBUG Loading config\n";
-
-        client
-            .create_bucket()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("Failed to create bucket");
-
-        info!("Uploading object with Content-Encoding: zstd");
-        client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .content_type("text/plain")
-            .content_encoding("zstd")
-            .body(ByteStream::from_static(content))
-            .send()
-            .await
-            .expect("PUT failed");
-
-        info!("Verifying GET response includes Content-Encoding");
-        let get_resp = client.get_object().bucket(bucket).key(key).send().await.expect("GET failed");
-
-        assert_eq!(get_resp.content_encoding(), Some("zstd"), "GET should return Content-Encoding: zstd");
-        assert_eq!(get_resp.content_type(), Some("text/plain"), "GET should return correct Content-Type");
-
-        let body = get_resp.body.collect().await.unwrap().into_bytes();
-        assert_eq!(body.as_ref(), content, "Body content mismatch");
-
-        info!("Verifying HEAD response includes Content-Encoding");
-        let head_resp = client
-            .head_object()
-            .bucket(bucket)
-            .key(key)
-            .send()
-            .await
-            .expect("HEAD failed");
-
-        assert_eq!(head_resp.content_encoding(), Some("zstd"), "HEAD should return Content-Encoding: zstd");
-        assert_eq!(head_resp.content_type(), Some("text/plain"), "HEAD should return correct Content-Type");
-
-        env.stop_server();
-    }
-}

crates/e2e_test/src/data_usage_test.rs

@@ -1,73 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use aws_sdk_s3::primitives::ByteStream;
-use rustfs_common::data_usage::DataUsageInfo;
-use serial_test::serial;
-
-use crate::common::{RustFSTestEnvironment, TEST_BUCKET, awscurl_get, init_logging};
-
-/// Regression test for data usage accuracy (issue #1012).
-/// Launches rustfs, writes 1000 objects, then asserts admin data usage reports the full count.
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server and requires awscurl; enable when running full E2E"]
-async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let client = env.create_s3_client();
-
-    // Create bucket and upload objects
-    client.create_bucket().bucket(TEST_BUCKET).send().await?;
-
-    for i in 0..1000 {
-        let key = format!("obj-{i:04}");
-        client
-            .put_object()
-            .bucket(TEST_BUCKET)
-            .key(key)
-            .body(ByteStream::from_static(b"hello-world"))
-            .send()
-            .await?;
-    }
-
-    // Query admin data usage API
-    let url = format!("{}/rustfs/admin/v3/datausageinfo", env.url);
-    let resp = awscurl_get(&url, &env.access_key, &env.secret_key).await?;
-    let usage: DataUsageInfo = serde_json::from_str(&resp)?;
-
-    // Assert total object count and per-bucket count are not truncated
-    let bucket_usage = usage
-        .buckets_usage
-        .get(TEST_BUCKET)
-        .cloned()
-        .expect("bucket usage should exist");
-
-    assert!(
-        usage.objects_total_count >= 1000,
-        "total object count should be at least 1000, got {}",
-        usage.objects_total_count
-    );
-    assert!(
-        bucket_usage.objects_count >= 1000,
-        "bucket object count should be at least 1000, got {}",
-        bucket_usage.objects_count
-    );
-
-    env.stop_server();
-    Ok(())
-}

crates/e2e_test/src/lib.rs

@@ -18,22 +18,6 @@ mod reliant;
 #[cfg(test)]
 pub mod common;
 
-// Data usage regression tests
-#[cfg(test)]
-mod data_usage_test;
-
 // KMS-specific test modules
 #[cfg(test)]
 mod kms;
-
-// Special characters in path test modules
-#[cfg(test)]
-mod special_chars_test;
-
-// Content-Encoding header preservation test
-#[cfg(test)]
-mod content_encoding_test;
-
-// Policy variables tests
-#[cfg(test)]
-mod policy;

crates/e2e_test/src/policy/README.md

@@ -1,39 +0,0 @@
-# RustFS Policy Variables Tests
-
-This directory contains comprehensive end-to-end tests for AWS IAM policy variables in RustFS.
-
-## Test Overview
-
-The tests cover the following AWS policy variable scenarios:
-
-1. **Single-value variables** - Basic variable resolution like `${aws:username}`
-2. **Multi-value variables** - Variables that can have multiple values
-3. **Variable concatenation** - Combining variables with static text like `prefix-${aws:username}-suffix`
-4. **Nested variables** - Complex nested variable patterns like `${${aws:username}-test}`
-5. **Deny scenarios** - Testing deny policies with variables
-
-## Prerequisites
-
-- RustFS server binary
-- `awscurl` utility for admin API calls
-- AWS SDK for Rust (included in the project)
-
-## Running Tests
-
-### Run All Policy Tests Using Unified Test Runner
-
-```bash
-# Run all policy tests with comprehensive reporting
-# Note: Requires a RustFS server running on localhost:9000
-cargo test -p e2e_test policy::test_runner::test_policy_full_suite -- --nocapture --ignored  --test-threads=1
-
-# Run only critical policy tests
-cargo test -p e2e_test policy::test_runner::test_policy_critical_suite -- --nocapture --ignored --test-threads=1
-```
-
-### Run All Policy Tests
-
-```bash
-# From the project root directory
-cargo test -p e2e_test policy:: -- --nocapture --ignored --test-threads=1
-```

crates/e2e_test/src/policy/mod.rs

@@ -1,22 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Policy-specific tests for RustFS
-//!
-//! This module provides comprehensive tests for AWS IAM policy variables
-//! including single-value, multi-value, and nested variable scenarios.
-
-mod policy_variables_test;
-mod test_env;
-mod test_runner;

crates/e2e_test/src/policy/policy_variables_test.rs

@@ -1,798 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Tests for AWS IAM policy variables with single-value, multi-value, and nested scenarios
-
-use crate::common::{awscurl_put, init_logging};
-use crate::policy::test_env::PolicyTestEnvironment;
-use aws_sdk_s3::primitives::ByteStream;
-use serial_test::serial;
-use tracing::info;
-
-/// Helper function to create a regular user with given credentials
-async fn create_user(
-    env: &PolicyTestEnvironment,
-    username: &str,
-    password: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let create_user_body = serde_json::json!({
-        "secretKey": password,
-        "status": "enabled"
-    })
-    .to_string();
-
-    let create_user_url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, username);
-    awscurl_put(&create_user_url, &create_user_body, &env.access_key, &env.secret_key).await?;
-    Ok(())
-}
-
-/// Helper function to create an STS user with given credentials
-async fn create_sts_user(
-    env: &PolicyTestEnvironment,
-    username: &str,
-    password: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // For STS, we create a regular user first, then use it to assume roles
-    create_user(env, username, password).await?;
-    Ok(())
-}
-
-/// Helper function to create and attach a policy
-async fn create_and_attach_policy(
-    env: &PolicyTestEnvironment,
-    policy_name: &str,
-    username: &str,
-    policy_document: serde_json::Value,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let policy_string = policy_document.to_string();
-
-    // Create policy
-    let add_policy_url = format!("{}/rustfs/admin/v3/add-canned-policy?name={}", env.url, policy_name);
-    awscurl_put(&add_policy_url, &policy_string, &env.access_key, &env.secret_key).await?;
-
-    // Attach policy to user
-    let attach_policy_url = format!(
-        "{}/rustfs/admin/v3/set-user-or-group-policy?policyName={}&userOrGroup={}&isGroup=false",
-        env.url, policy_name, username
-    );
-    awscurl_put(&attach_policy_url, "", &env.access_key, &env.secret_key).await?;
-    Ok(())
-}
-
-/// Helper function to clean up test resources
-async fn cleanup_user_and_policy(env: &PolicyTestEnvironment, username: &str, policy_name: &str) {
-    // Create admin client for cleanup
-    let admin_client = env.create_s3_client(&env.access_key, &env.secret_key);
-
-    // Delete buckets that might have been created by this user
-    let bucket_patterns = [
-        format!("{username}-test-bucket"),
-        format!("{username}-bucket1"),
-        format!("{username}-bucket2"),
-        format!("{username}-bucket3"),
-        format!("prefix-{username}-suffix"),
-        format!("{username}-test"),
-        format!("{username}-sts-bucket"),
-        format!("{username}-service-bucket"),
-        "private-test-bucket".to_string(), // For deny test
-    ];
-
-    // Try to delete objects and buckets
-    for bucket_name in &bucket_patterns {
-        let _ = admin_client
-            .delete_object()
-            .bucket(bucket_name)
-            .key("test-object.txt")
-            .send()
-            .await;
-        let _ = admin_client
-            .delete_object()
-            .bucket(bucket_name)
-            .key("test-sts-object.txt")
-            .send()
-            .await;
-        let _ = admin_client
-            .delete_object()
-            .bucket(bucket_name)
-            .key("test-service-object.txt")
-            .send()
-            .await;
-        let _ = admin_client.delete_bucket().bucket(bucket_name).send().await;
-    }
-
-    // Remove user
-    let remove_user_url = format!("{}/rustfs/admin/v3/remove-user?accessKey={}", env.url, username);
-    let _ = awscurl_put(&remove_user_url, "", &env.access_key, &env.secret_key).await;
-
-    // Remove policy
-    let remove_policy_url = format!("{}/rustfs/admin/v3/remove-canned-policy?name={}", env.url, policy_name);
-    let _ = awscurl_put(&remove_policy_url, "", &env.access_key, &env.secret_key).await;
-}
-
-/// Test AWS policy variables with single-value scenarios
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_single_value() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_single_value_impl().await
-}
-
-/// Implementation function for single-value policy variables test
-pub async fn test_aws_policy_variables_single_value_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables single-value test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_single_value_impl_with_env(&env).await
-}
-
-/// Implementation function for single-value policy variables test with shared environment
-pub async fn test_aws_policy_variables_single_value_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user
-    let test_user = "testuser1";
-    let test_password = "testpassword123";
-    let policy_name = "test-single-value-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    let create_user_body = serde_json::json!({
-        "secretKey": test_password,
-        "status": "enabled"
-    })
-    .to_string();
-
-    let create_user_url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, test_user);
-    awscurl_put(&create_user_url, &create_user_body, &env.access_key, &env.secret_key).await?;
-
-    // Create policy with single-value AWS variables
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": [format!("arn:aws:s3:::{}-*", "${aws:username}")]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListBucket"],
-                "Resource": [format!("arn:aws:s3:::{}-*", "${aws:username}")]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:PutObject", "s3:GetObject"],
-                "Resource": [format!("arn:aws:s3:::{}-*/*", "${aws:username}")]
-            }
-        ]
-    })
-    .to_string();
-
-    let add_policy_url = format!("{}/rustfs/admin/v3/add-canned-policy?name={}", env.url, policy_name);
-    awscurl_put(&add_policy_url, &policy_document, &env.access_key, &env.secret_key).await?;
-
-    // Attach policy to user
-    let attach_policy_url = format!(
-        "{}/rustfs/admin/v3/set-user-or-group-policy?policyName={}&userOrGroup={}&isGroup=false",
-        env.url, policy_name, test_user
-    );
-    awscurl_put(&attach_policy_url, "", &env.access_key, &env.secret_key).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Test 1: User should be able to list buckets (allowed by policy)
-    info!("Test 1: User listing buckets");
-    let list_result = test_client.list_buckets().send().await;
-    if let Err(e) = list_result {
-        cleanup().await;
-        return Err(format!("User should be able to list buckets: {e}").into());
-    }
-
-    // Test 2: User should be able to create bucket matching username pattern
-    info!("Test 2: User creating bucket matching pattern");
-    let bucket_name = format!("{test_user}-test-bucket");
-    let create_result = test_client.create_bucket().bucket(&bucket_name).send().await;
-    if let Err(e) = create_result {
-        cleanup().await;
-        return Err(format!("User should be able to create bucket matching username pattern: {e}").into());
-    }
-
-    // Test 3: User should be able to list objects in their own bucket
-    info!("Test 3: User listing objects in their bucket");
-    let list_objects_result = test_client.list_objects_v2().bucket(&bucket_name).send().await;
-    if let Err(e) = list_objects_result {
-        cleanup().await;
-        return Err(format!("User should be able to list objects in their own bucket: {e}").into());
-    }
-
-    // Test 4: User should be able to put object in their own bucket
-    info!("Test 4: User putting object in their bucket");
-    let put_result = test_client
-        .put_object()
-        .bucket(&bucket_name)
-        .key("test-object.txt")
-        .body(ByteStream::from_static(b"Hello, Policy Variables!"))
-        .send()
-        .await;
-    if let Err(e) = put_result {
-        cleanup().await;
-        return Err(format!("User should be able to put object in their own bucket: {e}").into());
-    }
-
-    // Test 5: User should be able to get object from their own bucket
-    info!("Test 5: User getting object from their bucket");
-    let get_result = test_client
-        .get_object()
-        .bucket(&bucket_name)
-        .key("test-object.txt")
-        .send()
-        .await;
-    if let Err(e) = get_result {
-        cleanup().await;
-        return Err(format!("User should be able to get object from their own bucket: {e}").into());
-    }
-
-    // Test 6: User should NOT be able to create bucket NOT matching username pattern
-    info!("Test 6: User attempting to create bucket NOT matching pattern");
-    let other_bucket_name = "other-user-bucket";
-    let create_other_result = test_client.create_bucket().bucket(other_bucket_name).send().await;
-    if create_other_result.is_ok() {
-        cleanup().await;
-        return Err("User should NOT be able to create bucket NOT matching username pattern".into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables single-value test completed successfully");
-    Ok(())
-}
-
-/// Test AWS policy variables with multi-value scenarios
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_multi_value() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_multi_value_impl().await
-}
-
-/// Implementation function for multi-value policy variables test
-pub async fn test_aws_policy_variables_multi_value_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables multi-value test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_multi_value_impl_with_env(&env).await
-}
-
-/// Implementation function for multi-value policy variables test with shared environment
-pub async fn test_aws_policy_variables_multi_value_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user
-    let test_user = "testuser2";
-    let test_password = "testpassword123";
-    let policy_name = "test-multi-value-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    // Create user
-    create_user(env, test_user, test_password).await?;
-
-    // Create policy with multi-value AWS variables
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": [
-                    format!("arn:aws:s3:::{}-bucket1", "${aws:username}"),
-                    format!("arn:aws:s3:::{}-bucket2", "${aws:username}"),
-                    format!("arn:aws:s3:::{}-bucket3", "${aws:username}")
-                ]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListBucket"],
-                "Resource": [
-                    format!("arn:aws:s3:::{}-bucket1", "${aws:username}"),
-                    format!("arn:aws:s3:::{}-bucket2", "${aws:username}"),
-                    format!("arn:aws:s3:::{}-bucket3", "${aws:username}")
-                ]
-            }
-        ]
-    });
-
-    create_and_attach_policy(env, policy_name, test_user, policy_document).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    // Test 1: User should be able to create buckets matching any of the multi-value patterns
-    info!("Test 1: User creating first bucket matching multi-value pattern");
-    let bucket1_name = format!("{test_user}-bucket1");
-    let create_result1 = test_client.create_bucket().bucket(&bucket1_name).send().await;
-    if let Err(e) = create_result1 {
-        cleanup().await;
-        return Err(format!("User should be able to create first bucket matching multi-value pattern: {e}").into());
-    }
-
-    info!("Test 2: User creating second bucket matching multi-value pattern");
-    let bucket2_name = format!("{test_user}-bucket2");
-    let create_result2 = test_client.create_bucket().bucket(&bucket2_name).send().await;
-    if let Err(e) = create_result2 {
-        cleanup().await;
-        return Err(format!("User should be able to create second bucket matching multi-value pattern: {e}").into());
-    }
-
-    info!("Test 3: User creating third bucket matching multi-value pattern");
-    let bucket3_name = format!("{test_user}-bucket3");
-    let create_result3 = test_client.create_bucket().bucket(&bucket3_name).send().await;
-    if let Err(e) = create_result3 {
-        cleanup().await;
-        return Err(format!("User should be able to create third bucket matching multi-value pattern: {e}").into());
-    }
-
-    // Test 4: User should NOT be able to create bucket NOT matching any multi-value pattern
-    info!("Test 4: User attempting to create bucket NOT matching any pattern");
-    let other_bucket_name = format!("{test_user}-other-bucket");
-    let create_other_result = test_client.create_bucket().bucket(&other_bucket_name).send().await;
-    if create_other_result.is_ok() {
-        cleanup().await;
-        return Err("User should NOT be able to create bucket NOT matching any multi-value pattern".into());
-    }
-
-    // Test 5: User should be able to list objects in their allowed buckets
-    info!("Test 5: User listing objects in allowed buckets");
-    let list_objects_result1 = test_client.list_objects_v2().bucket(&bucket1_name).send().await;
-    if let Err(e) = list_objects_result1 {
-        cleanup().await;
-        return Err(format!("User should be able to list objects in first allowed bucket: {e}").into());
-    }
-
-    let list_objects_result2 = test_client.list_objects_v2().bucket(&bucket2_name).send().await;
-    if let Err(e) = list_objects_result2 {
-        cleanup().await;
-        return Err(format!("User should be able to list objects in second allowed bucket: {e}").into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables multi-value test completed successfully");
-    Ok(())
-}
-
-/// Test AWS policy variables with variable concatenation
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_concatenation() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_concatenation_impl().await
-}
-
-/// Implementation function for concatenation policy variables test
-pub async fn test_aws_policy_variables_concatenation_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables concatenation test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_concatenation_impl_with_env(&env).await
-}
-
-/// Implementation function for concatenation policy variables test with shared environment
-pub async fn test_aws_policy_variables_concatenation_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user
-    let test_user = "testuser3";
-    let test_password = "testpassword123";
-    let policy_name = "test-concatenation-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    // Create user
-    create_user(env, test_user, test_password).await?;
-
-    // Create policy with variable concatenation
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": [format!("arn:aws:s3:::prefix-{}-suffix", "${aws:username}")]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListBucket"],
-                "Resource": [format!("arn:aws:s3:::prefix-{}-suffix", "${aws:username}")]
-            }
-        ]
-    });
-
-    create_and_attach_policy(env, policy_name, test_user, policy_document).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    // Add a small delay to allow policy to propagate
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Test: User should be able to create bucket matching concatenated pattern
-    info!("Test: User creating bucket matching concatenated pattern");
-    let bucket_name = format!("prefix-{test_user}-suffix");
-    let create_result = test_client.create_bucket().bucket(&bucket_name).send().await;
-    if let Err(e) = create_result {
-        cleanup().await;
-        return Err(format!("User should be able to create bucket matching concatenated pattern: {e}").into());
-    }
-
-    // Test: User should be able to list objects in the concatenated pattern bucket
-    info!("Test: User listing objects in concatenated pattern bucket");
-    let list_objects_result = test_client.list_objects_v2().bucket(&bucket_name).send().await;
-    if let Err(e) = list_objects_result {
-        cleanup().await;
-        return Err(format!("User should be able to list objects in concatenated pattern bucket: {e}").into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables concatenation test completed successfully");
-    Ok(())
-}
-
-/// Test AWS policy variables with nested scenarios
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_nested() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_nested_impl().await
-}
-
-/// Implementation function for nested policy variables test
-pub async fn test_aws_policy_variables_nested_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables nested test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_nested_impl_with_env(&env).await
-}
-
-/// Test AWS policy variables with STS temporary credentials
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_sts() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_sts_impl().await
-}
-
-/// Implementation function for STS policy variables test
-pub async fn test_aws_policy_variables_sts_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables STS test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_sts_impl_with_env(&env).await
-}
-
-/// Implementation function for nested policy variables test with shared environment
-pub async fn test_aws_policy_variables_nested_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user
-    let test_user = "testuser4";
-    let test_password = "testpassword123";
-    let policy_name = "test-nested-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    // Create user
-    create_user(env, test_user, test_password).await?;
-
-    // Create policy with nested variables - this tests complex variable resolution
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": ["arn:aws:s3:::${${aws:username}-test}"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListBucket"],
-                "Resource": ["arn:aws:s3:::${${aws:username}-test}"]
-            }
-        ]
-    });
-
-    create_and_attach_policy(env, policy_name, test_user, policy_document).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    // Add a small delay to allow policy to propagate
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Test nested variable resolution
-    info!("Test: Nested variable resolution");
-
-    // Create bucket with expected resolved name
-    let expected_bucket = format!("{test_user}-test");
-
-    // Attempt to create bucket with resolved name
-    let create_result = test_client.create_bucket().bucket(&expected_bucket).send().await;
-
-    // Verify bucket creation succeeds (nested variable resolved correctly)
-    if let Err(e) = create_result {
-        cleanup().await;
-        return Err(format!("User should be able to create bucket with nested variable: {e}").into());
-    }
-
-    // Verify bucket creation fails with unresolved variable
-    let unresolved_bucket = format!("${{}}-test {test_user}");
-    let create_unresolved = test_client.create_bucket().bucket(&unresolved_bucket).send().await;
-
-    if create_unresolved.is_ok() {
-        cleanup().await;
-        return Err("User should NOT be able to create bucket with unresolved variable".into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables nested test completed successfully");
-    Ok(())
-}
-
-/// Implementation function for STS policy variables test with shared environment
-pub async fn test_aws_policy_variables_sts_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user for STS
-    let test_user = "testuser-sts";
-    let test_password = "testpassword123";
-    let policy_name = "test-sts-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    // Create STS user
-    create_sts_user(env, test_user, test_password).await?;
-
-    // Create policy with STS-compatible variables
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": [format!("arn:aws:s3:::{}-sts-bucket", "${aws:username}")]
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListBucket", "s3:PutObject", "s3:GetObject"],
-                "Resource": [format!("arn:aws:s3:::{}-sts-bucket/*", "${aws:username}")]
-            }
-        ]
-    });
-
-    create_and_attach_policy(env, policy_name, test_user, policy_document).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    // Add a small delay to allow policy to propagate
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Test: User should be able to create bucket matching STS pattern
-    info!("Test: User creating bucket matching STS pattern");
-    let bucket_name = format!("{test_user}-sts-bucket");
-    let create_result = test_client.create_bucket().bucket(&bucket_name).send().await;
-    if let Err(e) = create_result {
-        cleanup().await;
-        return Err(format!("User should be able to create STS bucket: {e}").into());
-    }
-
-    // Test: User should be able to put object in STS bucket
-    info!("Test: User putting object in STS bucket");
-    let put_result = test_client
-        .put_object()
-        .bucket(&bucket_name)
-        .key("test-sts-object.txt")
-        .body(ByteStream::from_static(b"STS Test Object"))
-        .send()
-        .await;
-    if let Err(e) = put_result {
-        cleanup().await;
-        return Err(format!("User should be able to put object in STS bucket: {e}").into());
-    }
-
-    // Test: User should be able to get object from STS bucket
-    info!("Test: User getting object from STS bucket");
-    let get_result = test_client
-        .get_object()
-        .bucket(&bucket_name)
-        .key("test-sts-object.txt")
-        .send()
-        .await;
-    if let Err(e) = get_result {
-        cleanup().await;
-        return Err(format!("User should be able to get object from STS bucket: {e}").into());
-    }
-
-    // Test: User should be able to list objects in STS bucket
-    info!("Test: User listing objects in STS bucket");
-    let list_result = test_client.list_objects_v2().bucket(&bucket_name).send().await;
-    if let Err(e) = list_result {
-        cleanup().await;
-        return Err(format!("User should be able to list objects in STS bucket: {e}").into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables STS test completed successfully");
-    Ok(())
-}
-
-/// Test AWS policy variables with deny scenarios
-#[tokio::test(flavor = "multi_thread")]
-#[serial]
-#[ignore = "Starts a rustfs server; enable when running full E2E"]
-pub async fn test_aws_policy_variables_deny() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    test_aws_policy_variables_deny_impl().await
-}
-
-/// Implementation function for deny policy variables test
-pub async fn test_aws_policy_variables_deny_impl() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    info!("Starting AWS policy variables deny test");
-
-    let env = PolicyTestEnvironment::with_address("127.0.0.1:9000").await?;
-
-    test_aws_policy_variables_deny_impl_with_env(&env).await
-}
-
-/// Implementation function for deny policy variables test with shared environment
-pub async fn test_aws_policy_variables_deny_impl_with_env(
-    env: &PolicyTestEnvironment,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    // Create test user
-    let test_user = "testuser5";
-    let test_password = "testpassword123";
-    let policy_name = "test-deny-policy";
-
-    // Create cleanup function
-    let cleanup = || async {
-        cleanup_user_and_policy(env, test_user, policy_name).await;
-    };
-
-    // Create user
-    create_user(env, test_user, test_password).await?;
-
-    // Create policy with both allow and deny statements
-    let policy_document = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            // Allow general access
-            {
-                "Effect": "Allow",
-                "Action": ["s3:ListAllMyBuckets"],
-                "Resource": ["arn:aws:s3:::*"]
-            },
-            // Allow creating buckets matching username pattern
-            {
-                "Effect": "Allow",
-                "Action": ["s3:CreateBucket"],
-                "Resource": [format!("arn:aws:s3:::{}-*", "${aws:username}")]
-            },
-            // Deny creating buckets with "private" in the name
-            {
-                "Effect": "Deny",
-                "Action": ["s3:CreateBucket"],
-                "Resource": ["arn:aws:s3:::*private*"]
-            }
-        ]
-    });
-
-    create_and_attach_policy(env, policy_name, test_user, policy_document).await?;
-
-    // Create S3 client for test user
-    let test_client = env.create_s3_client(test_user, test_password);
-
-    // Add a small delay to allow policy to propagate
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Test 1: User should be able to create bucket matching username pattern
-    info!("Test 1: User creating bucket matching username pattern");
-    let bucket_name = format!("{test_user}-test-bucket");
-    let create_result = test_client.create_bucket().bucket(&bucket_name).send().await;
-    if let Err(e) = create_result {
-        cleanup().await;
-        return Err(format!("User should be able to create bucket matching username pattern: {e}").into());
-    }
-
-    // Test 2: User should NOT be able to create bucket with "private" in the name (deny rule)
-    info!("Test 2: User attempting to create bucket with 'private' in name (should be denied)");
-    let private_bucket_name = "private-test-bucket";
-    let create_private_result = test_client.create_bucket().bucket(private_bucket_name).send().await;
-    if create_private_result.is_ok() {
-        cleanup().await;
-        return Err("User should NOT be able to create bucket with 'private' in name due to deny rule".into());
-    }
-
-    // Cleanup
-    info!("Cleaning up test resources");
-    cleanup().await;
-
-    info!("AWS policy variables deny test completed successfully");
-    Ok(())
-}

crates/e2e_test/src/policy/test_env.rs

@@ -1,100 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Custom test environment for policy variables tests
-//!
-//! This module provides a custom test environment that doesn't automatically
-//! stop servers when destroyed, addressing the server stopping issue.
-
-use aws_sdk_s3::Client;
-use aws_sdk_s3::config::{Config, Credentials, Region};
-use std::net::TcpStream;
-use std::time::Duration;
-use tokio::time::sleep;
-use tracing::{info, warn};
-
-// Default credentials
-const DEFAULT_ACCESS_KEY: &str = "rustfsadmin";
-const DEFAULT_SECRET_KEY: &str = "rustfsadmin";
-
-/// Custom test environment that doesn't automatically stop servers
-pub struct PolicyTestEnvironment {
-    pub temp_dir: String,
-    pub address: String,
-    pub url: String,
-    pub access_key: String,
-    pub secret_key: String,
-}
-
-impl PolicyTestEnvironment {
-    /// Create a new test environment with specific address
-    /// This environment won't stop any server when dropped
-    pub async fn with_address(address: &str) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
-        let temp_dir = format!("/tmp/rustfs_policy_test_{}", uuid::Uuid::new_v4());
-        tokio::fs::create_dir_all(&temp_dir).await?;
-
-        let url = format!("http://{address}");
-
-        Ok(Self {
-            temp_dir,
-            address: address.to_string(),
-            url,
-            access_key: DEFAULT_ACCESS_KEY.to_string(),
-            secret_key: DEFAULT_SECRET_KEY.to_string(),
-        })
-    }
-
-    /// Create an AWS S3 client configured for this RustFS instance
-    pub fn create_s3_client(&self, access_key: &str, secret_key: &str) -> Client {
-        let credentials = Credentials::new(access_key, secret_key, None, None, "policy-test");
-        let config = Config::builder()
-            .credentials_provider(credentials)
-            .region(Region::new("us-east-1"))
-            .endpoint_url(&self.url)
-            .force_path_style(true)
-            .behavior_version_latest()
-            .build();
-        Client::from_conf(config)
-    }
-
-    /// Wait for RustFS server to be ready by checking TCP connectivity
-    pub async fn wait_for_server_ready(&self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        info!("Waiting for RustFS server to be ready on {}", self.address);
-
-        for i in 0..30 {
-            if TcpStream::connect(&self.address).is_ok() {
-                info!("✅ RustFS server is ready after {} attempts", i + 1);
-                return Ok(());
-            }
-
-            if i == 29 {
-                return Err("RustFS server failed to become ready within 30 seconds".into());
-            }
-
-            sleep(Duration::from_secs(1)).await;
-        }
-
-        Ok(())
-    }
-}
-
-// Implement Drop trait that doesn't stop servers
-impl Drop for PolicyTestEnvironment {
-    fn drop(&mut self) {
-        // Clean up temp directory only, don't stop any server
-        if let Err(e) = std::fs::remove_dir_all(&self.temp_dir) {
-            warn!("Failed to clean up temp directory {}: {}", self.temp_dir, e);
-        }
-    }
-}

crates/e2e_test/src/policy/test_runner.rs

@@ -1,247 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::common::init_logging;
-use crate::policy::test_env::PolicyTestEnvironment;
-use serial_test::serial;
-use std::time::Instant;
-use tokio::time::{Duration, sleep};
-use tracing::{error, info};
-
-/// Core test categories
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TestCategory {
-    SingleValue,
-    MultiValue,
-    Concatenation,
-    Nested,
-    DenyScenarios,
-}
-
-impl TestCategory {}
-
-/// Test case definition
-#[derive(Debug, Clone)]
-pub struct TestDefinition {
-    pub name: String,
-    #[allow(dead_code)]
-    pub category: TestCategory,
-    pub is_critical: bool,
-}
-
-impl TestDefinition {
-    pub fn new(name: impl Into<String>, category: TestCategory, is_critical: bool) -> Self {
-        Self {
-            name: name.into(),
-            category,
-            is_critical,
-        }
-    }
-}
-
-/// Test result
-#[derive(Debug, Clone)]
-pub struct TestResult {
-    pub test_name: String,
-    pub success: bool,
-    pub error_message: Option<String>,
-}
-
-impl TestResult {
-    pub fn success(test_name: String) -> Self {
-        Self {
-            test_name,
-            success: true,
-            error_message: None,
-        }
-    }
-
-    pub fn failure(test_name: String, error: String) -> Self {
-        Self {
-            test_name,
-            success: false,
-            error_message: Some(error),
-        }
-    }
-}
-
-/// Test suite configuration
-#[derive(Debug, Clone, Default)]
-pub struct TestSuiteConfig {
-    pub include_critical_only: bool,
-}
-
-/// Policy test suite
-pub struct PolicyTestSuite {
-    tests: Vec<TestDefinition>,
-    config: TestSuiteConfig,
-}
-
-impl PolicyTestSuite {
-    /// Create default test suite
-    pub fn new() -> Self {
-        let tests = vec![
-            TestDefinition::new("test_aws_policy_variables_single_value", TestCategory::SingleValue, true),
-            TestDefinition::new("test_aws_policy_variables_multi_value", TestCategory::MultiValue, true),
-            TestDefinition::new("test_aws_policy_variables_concatenation", TestCategory::Concatenation, true),
-            TestDefinition::new("test_aws_policy_variables_nested", TestCategory::Nested, true),
-            TestDefinition::new("test_aws_policy_variables_deny", TestCategory::DenyScenarios, true),
-            TestDefinition::new("test_aws_policy_variables_sts", TestCategory::SingleValue, true),
-        ];
-
-        Self {
-            tests,
-            config: TestSuiteConfig::default(),
-        }
-    }
-
-    /// Configure test suite
-    pub fn with_config(mut self, config: TestSuiteConfig) -> Self {
-        self.config = config;
-        self
-    }
-
-    /// Run test suite
-    pub async fn run_test_suite(&self) -> Vec<TestResult> {
-        init_logging();
-        info!("Starting Policy Variables test suite");
-
-        let start_time = Instant::now();
-        let mut results = Vec::new();
-
-        // Create test environment
-        let env = match PolicyTestEnvironment::with_address("127.0.0.1:9000").await {
-            Ok(env) => env,
-            Err(e) => {
-                error!("Failed to create test environment: {}", e);
-                return vec![TestResult::failure("env_creation".into(), e.to_string())];
-            }
-        };
-
-        // Wait for server to be ready
-        if env.wait_for_server_ready().await.is_err() {
-            error!("Server is not ready");
-            return vec![TestResult::failure("server_check".into(), "Server not ready".into())];
-        }
-
-        // Filter tests
-        let tests_to_run: Vec<&TestDefinition> = self
-            .tests
-            .iter()
-            .filter(|test| !self.config.include_critical_only || test.is_critical)
-            .collect();
-
-        info!("Scheduled {} tests", tests_to_run.len());
-
-        // Run tests
-        for (i, test_def) in tests_to_run.iter().enumerate() {
-            info!("Running test {}/{}: {}", i + 1, tests_to_run.len(), test_def.name);
-            let test_start = Instant::now();
-
-            let result = self.run_single_test(test_def, &env).await;
-            let test_duration = test_start.elapsed();
-
-            match result {
-                Ok(_) => {
-                    info!("Test passed: {} ({:.2}s)", test_def.name, test_duration.as_secs_f64());
-                    results.push(TestResult::success(test_def.name.clone()));
-                }
-                Err(e) => {
-                    error!("Test failed: {} ({:.2}s): {}", test_def.name, test_duration.as_secs_f64(), e);
-                    results.push(TestResult::failure(test_def.name.clone(), e.to_string()));
-                }
-            }
-
-            // Delay between tests to avoid resource conflicts
-            if i < tests_to_run.len() - 1 {
-                sleep(Duration::from_secs(2)).await;
-            }
-        }
-
-        // Print summary
-        self.print_summary(&results, start_time.elapsed());
-
-        results
-    }
-
-    /// Run a single test
-    async fn run_single_test(
-        &self,
-        test_def: &TestDefinition,
-        env: &PolicyTestEnvironment,
-    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        match test_def.name.as_str() {
-            "test_aws_policy_variables_single_value" => {
-                super::policy_variables_test::test_aws_policy_variables_single_value_impl_with_env(env).await
-            }
-            "test_aws_policy_variables_multi_value" => {
-                super::policy_variables_test::test_aws_policy_variables_multi_value_impl_with_env(env).await
-            }
-            "test_aws_policy_variables_concatenation" => {
-                super::policy_variables_test::test_aws_policy_variables_concatenation_impl_with_env(env).await
-            }
-            "test_aws_policy_variables_nested" => {
-                super::policy_variables_test::test_aws_policy_variables_nested_impl_with_env(env).await
-            }
-            "test_aws_policy_variables_deny" => {
-                super::policy_variables_test::test_aws_policy_variables_deny_impl_with_env(env).await
-            }
-            "test_aws_policy_variables_sts" => {
-                super::policy_variables_test::test_aws_policy_variables_sts_impl_with_env(env).await
-            }
-            _ => Err(format!("Test {} not implemented", test_def.name).into()),
-        }
-    }
-
-    /// Print test summary
-    fn print_summary(&self, results: &[TestResult], total_duration: Duration) {
-        info!("=== Test Suite Summary ===");
-        info!("Total duration: {:.2}s", total_duration.as_secs_f64());
-        info!("Total tests: {}", results.len());
-
-        let passed = results.iter().filter(|r| r.success).count();
-        let failed = results.len() - passed;
-        let success_rate = (passed as f64 / results.len() as f64) * 100.0;
-
-        info!("Passed: {} | Failed: {}", passed, failed);
-        info!("Success rate: {:.1}%", success_rate);
-
-        if failed > 0 {
-            error!("Failed tests:");
-            for result in results.iter().filter(|r| !r.success) {
-                error!("  - {}: {}", result.test_name, result.error_message.as_ref().unwrap());
-            }
-        }
-    }
-}
-
-/// Test suite
-#[tokio::test]
-#[serial]
-#[ignore = "Connects to existing rustfs server"]
-async fn test_policy_critical_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let config = TestSuiteConfig {
-        include_critical_only: true,
-    };
-    let suite = PolicyTestSuite::new().with_config(config);
-    let results = suite.run_test_suite().await;
-
-    let failed = results.iter().filter(|r| !r.success).count();
-    if failed > 0 {
-        return Err(format!("Critical tests failed: {failed} failures").into());
-    }
-
-    info!("All critical tests passed");
-    Ok(())
-}

crates/e2e_test/src/reliant/get_deleted_object_test.rs

@@ -1,283 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Test for GetObject on deleted objects
-//!
-//! This test reproduces the issue where getting a deleted object returns
-//! a networking error instead of NoSuchKey.
-
-#![cfg(test)]
-
-use aws_config::meta::region::RegionProviderChain;
-use aws_sdk_s3::Client;
-use aws_sdk_s3::config::{Credentials, Region};
-use aws_sdk_s3::error::SdkError;
-use bytes::Bytes;
-use serial_test::serial;
-use std::error::Error;
-use tracing::info;
-
-const ENDPOINT: &str = "http://localhost:9000";
-const ACCESS_KEY: &str = "rustfsadmin";
-const SECRET_KEY: &str = "rustfsadmin";
-const BUCKET: &str = "test-get-deleted-bucket";
-
-async fn create_aws_s3_client() -> Result<Client, Box<dyn Error>> {
-    let region_provider = RegionProviderChain::default_provider().or_else(Region::new("us-east-1"));
-    let shared_config = aws_config::defaults(aws_config::BehaviorVersion::latest())
-        .region(region_provider)
-        .credentials_provider(Credentials::new(ACCESS_KEY, SECRET_KEY, None, None, "static"))
-        .endpoint_url(ENDPOINT)
-        .load()
-        .await;
-
-    let client = Client::from_conf(
-        aws_sdk_s3::Config::from(&shared_config)
-            .to_builder()
-            .force_path_style(true)
-            .build(),
-    );
-    Ok(client)
-}
-
-/// Setup test bucket, creating it if it doesn't exist
-async fn setup_test_bucket(client: &Client) -> Result<(), Box<dyn Error>> {
-    match client.create_bucket().bucket(BUCKET).send().await {
-        Ok(_) => {}
-        Err(SdkError::ServiceError(e)) => {
-            let e = e.into_err();
-            let error_code = e.meta().code().unwrap_or("");
-            if !error_code.eq("BucketAlreadyExists") && !error_code.eq("BucketAlreadyOwnedByYou") {
-                return Err(e.into());
-            }
-        }
-        Err(e) => {
-            return Err(e.into());
-        }
-    }
-    Ok(())
-}
-
-#[tokio::test]
-#[serial]
-#[ignore = "requires running RustFS server at localhost:9000"]
-async fn test_get_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
-    // Initialize logging
-    let _ = tracing_subscriber::fmt()
-        .with_max_level(tracing::Level::INFO)
-        .with_test_writer()
-        .try_init();
-
-    info!("🧪 Starting test_get_deleted_object_returns_nosuchkey");
-
-    let client = create_aws_s3_client().await?;
-    setup_test_bucket(&client).await?;
-
-    // Upload a test object
-    let key = "test-file-to-delete.txt";
-    let content = b"This will be deleted soon!";
-
-    info!("Uploading object: {}", key);
-    client
-        .put_object()
-        .bucket(BUCKET)
-        .key(key)
-        .body(Bytes::from_static(content).into())
-        .send()
-        .await?;
-
-    // Verify object exists
-    info!("Verifying object exists");
-    let get_result = client.get_object().bucket(BUCKET).key(key).send().await;
-
-    assert!(get_result.is_ok(), "Object should exist after upload");
-
-    // Delete the object
-    info!("Deleting object: {}", key);
-    client.delete_object().bucket(BUCKET).key(key).send().await?;
-
-    // Try to get the deleted object - should return NoSuchKey error
-    info!("Attempting to get deleted object - expecting NoSuchKey error");
-    let get_result = client.get_object().bucket(BUCKET).key(key).send().await;
-
-    // Check that we get an error
-    assert!(get_result.is_err(), "Getting deleted object should return an error");
-
-    // Check that the error is NoSuchKey, not a networking error
-    let err = get_result.unwrap_err();
-
-    // Print the error for debugging
-    info!("Error received: {:?}", err);
-
-    // Check if it's a service error
-    match err {
-        SdkError::ServiceError(service_err) => {
-            let s3_err = service_err.into_err();
-            info!("Service error code: {:?}", s3_err.meta().code());
-
-            // The error should be NoSuchKey
-            assert!(s3_err.is_no_such_key(), "Error should be NoSuchKey, got: {s3_err:?}");
-
-            info!("✅ Test passed: GetObject on deleted object correctly returns NoSuchKey");
-        }
-        other_err => {
-            panic!("Expected ServiceError with NoSuchKey, but got: {other_err:?}");
-        }
-    }
-
-    // Cleanup
-    let _ = client.delete_object().bucket(BUCKET).key(key).send().await;
-
-    Ok(())
-}
-
-/// Test that HeadObject on a deleted object also returns NoSuchKey
-#[tokio::test]
-#[serial]
-#[ignore = "requires running RustFS server at localhost:9000"]
-async fn test_head_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
-    let _ = tracing_subscriber::fmt()
-        .with_max_level(tracing::Level::INFO)
-        .with_test_writer()
-        .try_init();
-
-    info!("🧪 Starting test_head_deleted_object_returns_nosuchkey");
-
-    let client = create_aws_s3_client().await?;
-    setup_test_bucket(&client).await?;
-
-    let key = "test-head-deleted.txt";
-    let content = b"Test content for HeadObject";
-
-    // Upload and verify
-    client
-        .put_object()
-        .bucket(BUCKET)
-        .key(key)
-        .body(Bytes::from_static(content).into())
-        .send()
-        .await?;
-
-    // Delete the object
-    client.delete_object().bucket(BUCKET).key(key).send().await?;
-
-    // Try to head the deleted object
-    let head_result = client.head_object().bucket(BUCKET).key(key).send().await;
-
-    assert!(head_result.is_err(), "HeadObject on deleted object should return an error");
-
-    match head_result.unwrap_err() {
-        SdkError::ServiceError(service_err) => {
-            let s3_err = service_err.into_err();
-            assert!(
-                s3_err.meta().code() == Some("NoSuchKey") || s3_err.meta().code() == Some("NotFound"),
-                "Error should be NoSuchKey or NotFound, got: {s3_err:?}"
-            );
-            info!("✅ HeadObject correctly returns NoSuchKey/NotFound");
-        }
-        other_err => {
-            panic!("Expected ServiceError but got: {other_err:?}");
-        }
-    }
-
-    Ok(())
-}
-
-/// Test GetObject with non-existent key (never existed)
-#[tokio::test]
-#[serial]
-#[ignore = "requires running RustFS server at localhost:9000"]
-async fn test_get_nonexistent_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
-    let _ = tracing_subscriber::fmt()
-        .with_max_level(tracing::Level::INFO)
-        .with_test_writer()
-        .try_init();
-
-    info!("🧪 Starting test_get_nonexistent_object_returns_nosuchkey");
-
-    let client = create_aws_s3_client().await?;
-    setup_test_bucket(&client).await?;
-
-    // Try to get an object that never existed
-    let key = "this-key-never-existed.txt";
-
-    let get_result = client.get_object().bucket(BUCKET).key(key).send().await;
-
-    assert!(get_result.is_err(), "Getting non-existent object should return an error");
-
-    match get_result.unwrap_err() {
-        SdkError::ServiceError(service_err) => {
-            let s3_err = service_err.into_err();
-            assert!(s3_err.is_no_such_key(), "Error should be NoSuchKey, got: {s3_err:?}");
-            info!("✅ GetObject correctly returns NoSuchKey for non-existent object");
-        }
-        other_err => {
-            panic!("Expected ServiceError with NoSuchKey, but got: {other_err:?}");
-        }
-    }
-
-    Ok(())
-}
-
-/// Test multiple consecutive GetObject calls on deleted object
-/// This ensures the fix is stable and doesn't have race conditions
-#[tokio::test]
-#[serial]
-#[ignore = "requires running RustFS server at localhost:9000"]
-async fn test_multiple_gets_deleted_object() -> Result<(), Box<dyn std::error::Error>> {
-    let _ = tracing_subscriber::fmt()
-        .with_max_level(tracing::Level::INFO)
-        .with_test_writer()
-        .try_init();
-
-    info!("🧪 Starting test_multiple_gets_deleted_object");
-
-    let client = create_aws_s3_client().await?;
-    setup_test_bucket(&client).await?;
-
-    let key = "test-multiple-gets.txt";
-    let content = b"Test content";
-
-    // Upload and delete
-    client
-        .put_object()
-        .bucket(BUCKET)
-        .key(key)
-        .body(Bytes::from_static(content).into())
-        .send()
-        .await?;
-
-    client.delete_object().bucket(BUCKET).key(key).send().await?;
-
-    // Try multiple consecutive GetObject calls
-    for i in 1..=5 {
-        info!("Attempt {} to get deleted object", i);
-        let get_result = client.get_object().bucket(BUCKET).key(key).send().await;
-
-        assert!(get_result.is_err(), "Attempt {i}: should return error");
-
-        match get_result.unwrap_err() {
-            SdkError::ServiceError(service_err) => {
-                let s3_err = service_err.into_err();
-                assert!(s3_err.is_no_such_key(), "Attempt {i}: Error should be NoSuchKey, got: {s3_err:?}");
-            }
-            other_err => {
-                panic!("Attempt {i}: Expected ServiceError but got: {other_err:?}");
-            }
-        }
-    }
-
-    info!("✅ All 5 attempts correctly returned NoSuchKey");
-    Ok(())
-}

crates/e2e_test/src/reliant/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 mod conditional_writes;
-mod get_deleted_object_test;
 mod lifecycle;
 mod lock;
 mod node_interact_test;