Relayer 2.9.0 build a9c61e8
- s3gateway: `s3:*` no longer authorizes non-s3 actions — closes a namespace-crossing privilege escalation exposed by the IAM self-service reversal
- mt-reshape E-A2: the tenant byte quota lives on the cost-center, not on `s3_tenants`
- The S3 Gateway’s multi-tenant conformance gaps close, and the published compatibility number becomes reproducible instead of hollow
- Every storage snapshot tick now lays down the box’s aggregate row byte-identically PLUS one row per tenant — the source data finally tells the per-tenant truth
- s3gateway: `TestReconcile_HealShapePin` rewritten for the heal split
- A claimed Relayer now has exactly one durable identity — adopted from Conductor at boot, journaled forever, and checkable on demand
- s3gateway: box-identity heal engine — a claimed box’s existing data comes back under its real identity in one reboot
- s3gateway: tenants get their own `_tenN` namespace — a tenant can never collide with a billing sub-account or be created before the box knows who it is
- s3gateway: the flip-boot heal is now actually wired — the E-A1+E-B1 heal path fires on real boxes instead of lying dormant
- The security scan that runs before every code push was never actually scanning anything, and separately raised false alarms
- File-sharing user accounts stored a second, readable copy of each password on Relayers that have no file sharing installed
- A release-gate check counted 27 storage-administration commands without checking any of them
- Every Grafana link in the sidebar returned “Unauthorized” on a Relayer that had been upgraded in place
- Two release-gate tests went red on code changes that were correct
- The tenant Access keys page could not list or create keys at all
- The release gate’s emergency-reissue check could not run at all, and its key-lifecycle check never ran either
- The release gate could not exercise a single state-changing tenant route against a live box
- A tenant’s own access history now names the three account-level refusals in words a customer can act on
- The new operator audit read no longer widens a filter that was sent but left empty, and its ordering is now total
- Four more places where the release gate could have graded the box on something that never happened
- Management routes that used to answer any caller with no credential now answer only callers inside the box
- A re-runnable release gate that proves tenant isolation before the surface is enabled for a real customer
- Operators can now read the tenant-provisioning audit trail over the API
- Operators can now mint a tenant administrator, reissue an activation code, see the lock roster, and unlock a locked administrator, all from the UI
- A page reload no longer drops a signed-in tenant administrator back to the operator-picker view
- The tenant step-up throttle now actually enforces its source-IP dimension instead of only recording it
- Creating a bucket for a tenant now routes through the owner-authenticated management endpoint, so it lands in the tenant’s own storage instead of the operator’s root
- The operator’s tenant-scoped bucket listing is now sourced from the authoritative bucket record, so empty and just-created buckets appear
- Tenant administrators can now sign in to their own storage console
- Tenant administrators can now manage their own S3 access keys — create, rotate, revoke — with no operator ticket
- Tenant administrators can now see their own usage, read their own access history with a reason on every denial, and copy ready-made connection details — without filing a support ticket
- D7 gate inputs — served topology
- The “Recent denials” panel and the audit log’s Denied view now include authentication failures, not just policy denials
- Leaving the provider dashboard with an unsaved selection expression now warns before discarding it
- Setting a tenant’s rate limit from the operator UI now works
- Internal test maintenance for the provider dashboard — no product changes
- Files carried over from an older single-tenant Relayer now download, not just show in the list
- A freshly logged-in Relayer’s dashboard now shows all your providers instead of an empty “No VPD configured” panel
- The tenant-scoped directory now has a real behavioral test proving a tenant sees only its own users
- The API now stops handing back box-wide data through the routes the UI never put a tenant picker in front of
- The cost center you pick when claiming a Relayer is now the cost center the box actually adopts and keeps — end to end
- A Relayer now locks in its billing identity before storage starts, closing a rare startup timing gap
- Strengthened the automated tests that verify each tenant sees only its own data
- Container boot no longer logs a scary credential error on every start
- Box identity is now a synchronous env read, not a boot-time network call
- Creating a user inside a specific tenant is now a one-click action on that tenant’s own row — no raw API calls
- A suspended tenant now reads as *suspended*, not as a broken login
- A mid-task browser reload no longer costs the operator their place
- Changing this Relayer’s cost center is now a deliberate, guarded act instead of a bare dropdown
- The standalone Relayer image now builds and runs the cost-tracking process, so byte-quota enforcement is wired end to end
- Operators can now browse a tenant’s buckets down to the individual file from the Tenant Management screen
- The IAM mint no longer trusts a client-supplied `cost_center`
- mt-reshape E-B1: tenant-scoped list reads validate the `cost_center` against the box’s owned roster and fail closed
- mt-reshape E-A2: the tenant byte quota is now set on the cost-center route, not the tenant route
- mt-reshape E-A1: creating an IAM user or service account no longer asks for a cost center
- Tenants are now presented as tenants everywhere — never as internal billing codes
- mt-reshape E-B1: a tenant-scoped session now sees a limited relayer-ui view of only its own buckets, objects, usage, users, and settings
- Config plumbing for the storage gateway’s boot-time identity adoption
- New `S3GW_MAINTENANCE_DB_CFG_PATH` allowlist entry
- A Relayer box with a configuration file missing its storage-credential block no longer crash-loops on boot
- Closed a gap in the CelEditor/WebGL noise filter that let some of the same errors back into Sentry even on releases that already contained the filter
Relayer 2.7.0 build 281f7e5
- monitoring: WORM-defeat alerts missed their ≤60s detection SLA on the default Alertmanager route
- s3gateway: valid credentials were rejected with `InvalidAccessKeyId` under high request concurrency
- s3gateway: runtime Sentry kill-switch — silence error reporting without a rebuild
- monitoring: alert delivery spine — firing rules now reach the operator instead of evaluating into a void
- monitoring: Watchdog dead-man’s-switch — the operator is told when the monitoring stack itself dies
- monitoring: alert thresholds are `.env`-tunable — threshold changes are a config edit + recreate, never a source change or rebuild
- docs: observability & alerting operator runbook
- s3gateway: audit-pipeline health metrics registered unconditionally + NDJSON write-health counters
- s3gateway: WORM-defeat attempt detection — counters + ≤60s trip-wire alert
- monitoring: application logs now reach Loki — the operator can search every service’s logs, not just audit
- hostio + s3gateway: cache-hit-rate and per-bucket activity are now instrumented — the two series the AI-engineer overview screen needs
- s3gateway: IAM-user and service-account credentials minted before multi-tenant enforcement lost all storage access after an upgrade — permanently
- The embedded database now restarts itself if it ever goes down, instead of leaving storage stuck until someone reboots the box
- On a claimed Relayer, a signed-in account that is not the owner is now refused on every management surface — not just the handful of routes that remembered to check
- Signing in with an account that doesn’t own the Relayer now shows a clear “belongs to another account” notice instead of a fake session error — and a Cost Center change can no longer silently strand the box
- A claimed box’s billing identity can no longer be reassigned from outside via the `COSTCENTER` environment variable
- The Audit Log page shows transactions again
- On a newly onboarded Relayer, operators can create tenants and IAM access keys again
- Retired the “MinIO” name from the storage service — an existing box upgrades silently, same credential, no gateway downtime
- The owner now decides who may take their Relayer over
- A non-owner can now take over a claimed Relayer safely, and the prior owner is always protected by a snapshot taken before anything moves
- A non-owner account now hits a full-screen gate instead of a banner it could click past
- “All Providers” can now be applied to Relayer
- Removed legacy dashboard pages that were reachable only by typing their URL — the few readouts only they provided moved to the NOC dashboard first
- The Encryption guide now lives on the public docs site at xns.tech/docs/encryption/ — the hidden in-app knowledge base is retired
- Internal test-suite cleanup — no product changes
- The NOC dashboard’s disk table now reports available space for every storage folder, including those on the shared volume
- Removed the retired previous-generation File Manager and other unused screens
- Removed unused interface files left over from earlier product generations
- `mc/tenant-usage` fails closed on a cross-tenant row
- The tenant dashboard is now reachable, and its quota/usage/profile numbers are real
- One screen answers “is storage slowing my pipeline, and which bucket.”
- A locked object’s retention mode is now visible without an API call
- Operators can pick which tenant the dashboard scopes to
- Grafana anonymous-Admin removed; auth-proxy is the only identity path
- The pre-login cache-dump no longer leaks live credentials
- `/alertmanager` gated reverse proxy
- Native Log Search over audit + application logs
- Grafana dashboards + Explore are in-product nav links, one login via auth-proxy
- `/alertmanager` auth gate enabled — session cookie now covers it
- The IAM policy “View JSON” modal now loads
- Saving a Cost Center change now takes effect immediately — and can no longer save an ID the box failed to authenticate
- Creating an IAM user or service account failed on a seeded box when the Cost Center was left blank / “Inherit account default.”
Relayer 2.6.5 build 3e0f9ad
Relayer 2.1.0 build ce6f987
- Now shipping on the public release channel, multi-arch (Intel/AMD + ARM64)
- Full S3 API — flexible checksums, browser form uploads (SigV4 POST), accurate list pagination, bulk-delete batching, and real S3 error semantics (proper 404 / 400 responses)
- New: redirect audit logs to an external Loki with one env var (
S3GW_AUDIT_LOKI_PUSH_URL), no rebuild — alongside the existing signed-webhook SIEM export - Steady under load — a connection governor tames read storms, graceful load-shed returns 503 SlowDown + Retry-After, and deleted objects stay deleted across restarts
- Operable — structured logging and Sentry error reporting across every service
Relayer 2.0.0 build 611a255
- Added Terms of Service and Privacy Policy links to the app footer
- Added a session identity badge — shows the signed-in user with a live connection-status indicator
- Packaged as a multi-arch bundle (Intel/AMD + ARM64): Relayer with Prometheus + Grafana monitoring
