docs: clarify S3-compatible endpoint configuration for backups - #469
Conversation
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
There was a problem hiding this comment.
Pull request overview
This PR updates the backups configuration documentation to more explicitly explain how to use the backup-s3 module with non-AWS, S3-compatible object stores by clarifying BACKUP_S3_ENDPOINT usage and related environment variables.
Changes:
- Expanded the S3 section intro to explicitly mention Amazon S3 plus several S3-compatible providers.
- Added an “S3-compatible endpoints” subsection with guidance and a copy/paste environment example.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge. |
|
I agree with the CLA |
2607793 to
cecf15c
Compare
…e guidance The page said the backup module tries IAM first and falls back to access keys. resolveCredentials does the opposite: an auth proxy wins, then static env keys, and IAM is reached only when no keys are set. Stale keys therefore shadow an attached instance role silently, which is the failure users hit. Also: - keep MinIO as the only named S3-compatible store; drop the "any store" claim, since core requires multipart upload, ListObjectsV2 and Content-MD5 and exposes no addressing-style or CA setting - document the legacy AWS_ACCESS_KEY / AWS_SECRET_KEY aliases - note that a scheme in BACKUP_S3_ENDPOINT stops Weaviate from starting - note that only the literal "false" disables BACKUP_S3_USE_SSL - link BACKUP_SKIP_ACCESS_CHECK from the S3 table - nest Option 1 and Option 2 under S3 authentication - drop ENABLE_MODULES from the example; it contradicted the one above it - tag the environment block as bash
|
Hi @goanpeca! Thanks a lot for the contribution 😄 |
Summary
The
backup-s3module already works with Amazon S3 and any S3-compatible object store (it builds its client fromBACKUP_S3_ENDPOINT), but the backups page does not spell out how to point it at a non-AWS endpoint or how its AWS-named credentials apply to compatible backends. This adds that guidance. Docs only, no code or behavior changes.What changed
One file,
docs/deploy/configuration/backups.md:BACKUP_S3_ENDPOINTaccepts a host with an optional port, must not include anhttp://orhttps://scheme, and usesBACKUP_S3_USE_SSLfor TLS.AWS_REGIONguidance.Notes
Examples use a placeholder endpoint and no provider is singled out.