artifact-store/workplans/ARTIFACT-STORE-WP-0007-minio-maxio-sts-vending.md

id, type, title, repo, domain, status, owner, topic_slug, planning_priority, planning_order, created, updated, state_hub_workstream_id

id	type	title	repo	domain	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
ARTIFACT-STORE-WP-0007	workplan	MinIO Compatibility, MaxIO Fork Assessment, And STS Credential Vending	artifact-store	infotech	active	codex	stack	high	7	2026-05-17	2026-06-27	2f34bb96-7206-4cb5-acdf-43880b57a9ec

ARTIFACT-STORE-WP-0007: MinIO Compatibility, MaxIO Fork Assessment, And STS Credential Vending

Purpose

Create a dedicated workstream for the work that should not keep artifact-store's S3 backend and guide-board pilot workstreams open: MinIO-compatible test infrastructure, the "MaxIO" fork/community opportunity, and whether NetKingdom already supports the Security Token Service credential-vending pattern for object storage.

Context

As of 2026-05-17, upstream minio/minio is archived/read-only on GitHub and the README says the repository is no longer maintained. The same README says Community Edition is now source-only, while the source remains AGPLv3. The latest GitHub release visible there is RELEASE.2025-10-15T17-29-55Z.

Relevant source references:

• https://github.com/minio/minio
• https://min.io/docs/minio/linux/developers/security-token-service.html
• https://min.io/docs/minio/linux/developers/security-token-service/AssumeRoleWithWebIdentity.html
• https://github.com/OpenMaxIO/openmaxio-object-browser

Initial local scan of /home/worsch/net-kingdom found credential bootstrap, Vault/KeePassXC, OIDC, Keycloak/Authelia, and static S3/MinIO backup references, but no explicit STS credential-vending implementation or MinIO AssumeRoleWithWebIdentity path yet.

Constraints

• Do not put MinIO fork or community governance assumptions into the artifact-store S3 adapter.
• Treat AGPLv3, trademark/brand, release provenance, and security patch obligations as first-class risks before any "MaxIO" fork decision.
• STS credential vending should issue short-lived credentials from workload/user identity; long-lived root access keys should not become the default integration pattern.
• NetKingdom owns identity/security architecture; artifact-store owns whether its S3 backend can consume vendored temporary credentials.

D7.1 - MinIO / Fork Landscape Assessment

id: ARTIFACT-STORE-WP-0007-T001
status: done
priority: high
state_hub_task_id: "11d84b56-be7a-4013-8e21-36b7b656b69b"

Acceptance:

• Record a dated assessment of upstream MinIO status, latest usable source tag, AGPL obligations, removed/enterprise-shifted features, and available community forks.
• Compare at least: upstream source build, OpenMaxIO UI pieces, Pigsty MinIO fork, Garage, RustFS, SeaweedFS, and Ceph RGW.
• Decide whether "MaxIO" should be a direct fork, a packaging/build distribution, a compatibility profile, or not pursued.

Progress 2026-06-27:

• Added docs/minio-compatibility-landscape-2026-06-27.md, recording the dated source/fork/object-store assessment and deciding that artifact-store should pursue a compatibility profile rather than a direct MaxIO server fork.
• Verified current source references for upstream MinIO archive/tag posture, MinIO AIStor STS/OIDC shape, OpenMaxIO UI scope, Garage, RustFS, SeaweedFS, and Ceph RGW.
• D7.1 is done; follow-up implementation remains in D7.2-D7.5.

D7.2 - MinIO Compatibility Harness

id: ARTIFACT-STORE-WP-0007-T002
status: done
priority: high
state_hub_task_id: "c826f3ac-2ed7-4150-aa7c-e778ae71a72b"

Acceptance:

• Restore or define the dependency/bootstrap path for MinIO-compatible integration tests (uv/Python deps, Docker/testcontainers or a deterministic compose fixture).
• Run artifact-store S3 backend tests against the selected MinIO or fork target.
• Document manual smoke commands and expected health/verify outputs.

Progress 2026-06-27:

• Added skipped-by-default live MinIO tests in tests/integration/test_storage_s3_minio.py. The harness runs only when an operator supplies ARTIFACTSTORE_MINIO_ENDPOINT_URL, bucket, access key, and secret key through the local environment.
• Added make test-minio and documented the manual MinIO smoke in docs/OPERATOR.md, including required permissions and the non-secret application-level ARTIFACTSTORE_S3_*_REF mapping.
• Remaining D7.2 gate: run the harness against an approved MinIO-compatible endpoint and capture the health/round-trip/multipart result.

Completed 2026-07-02:

• Added the deterministic local fixture scripts/minio_local_smoke.sh and make test-minio-local: it starts a throwaway minio/minio:latest container bound to 127.0.0.1:19000 with one-run generated credentials, waits for /minio/health/live (HTTP 200), creates the smoke bucket via mc, runs make test-minio, and tears the container down on exit.
• Live run passed against MinIO server (image digest sha256:14cea493...): test_live_minio_round_trip_with_range and test_live_minio_multipart_upload — 2 passed. Health, round-trip with range reads, and multipart upload are all verified against a real MinIO endpoint; no credentials persisted anywhere.
• This closes D7.2's bootstrap-path, live-run, and documentation acceptance. Runs against a production/approved shared endpoint remain possible with the same make test-minio env contract whenever an operator supplies one.

D7.3 - STS Credential Vending Assessment For NetKingdom

id: ARTIFACT-STORE-WP-0007-T003
status: todo
priority: high
state_hub_task_id: "d3d5c4c1-d3b2-4163-b99d-1b08f90566d1"

Acceptance:

• Inventory NetKingdom's current object-storage credential path, including backup jobs and any S3/MinIO secrets.
• Determine whether Keycloak/Authelia/local-identity can act as the OIDC identity provider for MinIO-compatible AssumeRoleWithWebIdentity.
• Produce a target architecture for credential vending: issuer, token audience, role/policy mapping, expiration, revocation, audit, and break-glass behavior.

D7.4 - Artifact-Store Temporary Credential Support

id: ARTIFACT-STORE-WP-0007-T004
status: todo
priority: medium
state_hub_task_id: "9b80057a-d86e-4f14-9d14-928ee29f970d"

Acceptance:

• Decide whether artifact-store's S3 backend needs dynamic credential refresh for STS-vended credentials or whether refresh belongs in a sidecar/secret controller.
• If needed, design the minimal configuration shape for short-lived credentials without storing them in request bodies or event payloads.
• Verify that artifactstore storage verify --backend s3 can run with temporary credentials.

D7.5 - Follow-Up Workstream Routing

id: ARTIFACT-STORE-WP-0007-T005
status: todo
priority: medium
state_hub_task_id: "614f7918-6fef-4460-b3fc-f9ff3c156422"

Acceptance:

• Create or link NetKingdom follow-up work for STS credential vending if the implementation belongs outside artifact-store.
• Create or link producer-side guide-board/open-cmis-tck work for the missing reports/cmis-summary.md fragment.
• Close this workstream with a decision: adopt existing fork, build MaxIO, use another S3-compatible store, or defer.

Success criteria

• Artifact-store no longer treats MinIO as an incidental CI detail; it has a clear compatibility and governance strategy.
• NetKingdom has a concrete answer on STS credential vending for object storage.
• Any MaxIO fork work starts only after legal, security, governance, and community-support duties are explicit.