fix(security): align credential validation with runtime

Author: GatewayJ

deploy/rustfs-operator/crds/tenant-crd.yaml

@@ -174,7 +174,8 @@ spec:
               credsSecret:
                 description: |-
                   Optional reference to a Secret containing RustFS credentials.
-                  The Secret must contain 'accesskey' and 'secretkey' keys (both required, minimum 8 characters each).
+                  The Secret must contain 'accesskey' and 'secretkey' keys. Both values must be valid
+                  UTF-8 without NUL bytes and at least 8 UTF-8 bytes after trimming.
                   If not specified, credentials can be provided via environment variables in 'env'.
                   Priority: Secret credentials > Environment variables > RustFS built-in defaults.
                   For production use, always configure credentials via Secret or environment variables.

docs/operator-user-guide.md

@@ -455,7 +455,7 @@ spec:
 
 ### 7.3 Credentials
 
-For production, use `spec.credsSecret`. The Secret must be in the same namespace as the Tenant and contain UTF-8 `accesskey` and `secretkey` keys. Both values must be at least 8 characters.
+For production, use `spec.credsSecret`. The Secret must be in the same namespace as the Tenant and contain `accesskey` and `secretkey` keys. Both values must be valid UTF-8 without NUL bytes and at least 8 UTF-8 bytes after trimming.
 
 ```yaml
 apiVersion: v1
@@ -1154,7 +1154,8 @@ Common blocked reasons:
 | `InvalidPoolSpec` | Pool count, total volume count, pool name, and immutable fields. |
 | `CredentialSecretNotFound` | Secret exists in the Tenant namespace. |
 | `CredentialSecretMissingKey` | Secret contains `accesskey` and `secretkey`. |
-| `CredentialSecretTooShort` | Both credential values are at least 8 characters. |
+| `CredentialSecretInvalidEncoding` | Both credential values are valid UTF-8 without NUL bytes. |
+| `CredentialSecretTooShort` | Both credential values are at least 8 UTF-8 bytes after trimming. |
 | `KmsSecretNotFound` / `KmsSecretMissingKey` | KMS Secret exists and contains required keys, such as Vault `vault-token` or the Local KMS `masterKeySecretRef.key`. |
 | `CertManagerCrdMissing` / `CertManagerIssuerNotFound` | cert-manager is installed and the issuer exists. |
 | `InvalidWorkloadSecurityProfile` | Fix the seccomp or AppArmor profile type and its `localhostProfile` pairing. |

docs/operator-user-guide.zh-CN.md

@@ -431,7 +431,7 @@ spec:
 
 ### 7.3 凭据配置
 
-生产环境建议使用 `spec.credsSecret`。Secret 必须与 Tenant 在同一 namespace，并包含 UTF-8 编码的 `accesskey` 和 `secretkey` 两个 key，两个值长度都至少为 8 个字符。
+生产环境建议使用 `spec.credsSecret`。Secret 必须与 Tenant 在同一 namespace，并包含 `accesskey` 和 `secretkey` 两个 key；两个值都必须是不含 NUL 字节的有效 UTF-8，且 trim 后至少为 8 个 UTF-8 字节。
 
 ```yaml
 apiVersion: v1
@@ -1111,7 +1111,8 @@ kubectl logs -n rustfs-system \
 | `InvalidPoolSpec` | Pool 数量、总卷数、pool 名称和不可变字段。 |
 | `CredentialSecretNotFound` | Secret 是否存在于 Tenant namespace。 |
 | `CredentialSecretMissingKey` | Secret 是否包含 `accesskey` 和 `secretkey`。 |
-| `CredentialSecretTooShort` | 两个凭据值是否都至少 8 个字符。 |
+| `CredentialSecretInvalidEncoding` | 两个凭据值是否都是不含 NUL 字节的有效 UTF-8。 |
+| `CredentialSecretTooShort` | 两个凭据值 trim 后是否都至少为 8 个 UTF-8 字节。 |
 | `KmsSecretNotFound` / `KmsSecretMissingKey` | KMS Secret 是否存在，并包含必要 key，例如 Vault 的 `vault-token` 或 Local KMS 的 `masterKeySecretRef.key`。 |
 | `CertManagerCrdMissing` / `CertManagerIssuerNotFound` | cert-manager 是否安装，issuer 是否存在。 |
 | `InvalidWorkloadSecurityProfile` | 修正 seccomp 或 AppArmor profile 类型及其与 `localhostProfile` 的组合。 |

examples/secret-credentials-tenant.yaml

@@ -23,11 +23,11 @@ type: Opaque
 stringData:
   # RustFS admin access key (username)
   # ⚠️  IMPORTANT: Change these default values for production deployments!
-  # REQUIRED: Must be at least 8 characters long
+  # REQUIRED: Must be at least 8 UTF-8 bytes after trimming
   accesskey: "rustfsadmin123"
 
   # RustFS admin secret key (password)
-  # REQUIRED: Must be at least 8 characters long
+  # REQUIRED: Must be at least 8 UTF-8 bytes after trimming
   # Recommendation: Use at least 16 characters with mixed case, numbers, and symbols
   secretkey: "rustfsadmin123"
 
@@ -199,7 +199,8 @@ spec:
 # Note: The operator will retry every 60 seconds until keys are present
 
 # Issue: Credential validation error - keys too short
-# Solution: Ensure both accesskey and secretkey are at least 8 characters
+# Solution: Ensure both values are valid UTF-8 without NUL bytes and at least
+#           8 UTF-8 bytes after trimming
 #    kubectl get secret rustfs-credentials -o jsonpath='{.data.accesskey}' | base64 -d | wc -c
 #    kubectl get secret rustfs-credentials -o jsonpath='{.data.secretkey}' | base64 -d | wc -c
 # Note: The operator will retry every 60 seconds until credentials meet requirements
@@ -232,8 +233,8 @@ spec:
 # Credential validation errors (require user action):
 #   - Secret not found
 #   - Missing required keys (accesskey/secretkey)
-#   - Invalid UTF-8 encoding
-#   - Credentials too short (less than 8 characters)
+#   - Invalid UTF-8 encoding or NUL bytes
+#   - Credentials too short (less than 8 UTF-8 bytes after trimming)
 #   Retry interval: 60 seconds (reduces log/event spam while you fix the issue)
 #
 # Transient errors (may self-resolve):

examples/tenant-4nodes.yaml

@@ -68,7 +68,8 @@ spec:
       value: "true"
 
 ---
-# Credentials Secret for RustFS (keys must be at least 8 characters)
+# Credentials Secret for RustFS (values must be valid UTF-8 without NUL bytes
+# and at least 8 UTF-8 bytes after trimming)
 # Example: accesskey admin123, secretkey admin12345 (dev only)
 apiVersion: v1
 kind: Secret

src/context.rs

@@ -54,7 +54,7 @@ pub enum Error {
     CredentialSecretInvalidEncoding { secret_name: String, key: String },
 
     #[snafu(display(
-        "credential secret '{}' key '{}' must be at least 8 characters (got {} characters)",
+        "credential secret '{}' key '{}' must be at least 8 UTF-8 bytes after trimming (got {} bytes)",
         secret_name,
         key,
         length
@@ -298,7 +298,7 @@ fn validate_secret_utf8_non_blank(
 const RUSTFS_DEFAULT_CREDENTIAL_VALUE: &str = "rustfsadmin";
 
 const CREDENTIAL_SECRET_KEYS: [&str; 2] = ["accesskey", "secretkey"];
-const MIN_CREDENTIAL_LENGTH: usize = 8;
+const MIN_CREDENTIAL_LENGTH_BYTES: usize = 8;
 
 fn validate_credential_secret_data(secret: &Secret, secret_name: &str) -> Result<(), Error> {
     for key in CREDENTIAL_SECRET_KEYS {
@@ -315,8 +315,15 @@ fn validate_credential_secret_data(secret: &Secret, secret_name: &str) -> Result
                 secret_name: secret_name.to_string(),
                 key: key.to_string(),
             })?;
-        let length = value.len();
-        if length < MIN_CREDENTIAL_LENGTH {
+        if value.contains('\0') {
+            return Err(Error::CredentialSecretInvalidEncoding {
+                secret_name: secret_name.to_string(),
+                key: key.to_string(),
+            });
+        }
+
+        let length = value.trim().len();
+        if length < MIN_CREDENTIAL_LENGTH_BYTES {
             return CredentialSecretTooShortSnafu {
                 secret_name: secret_name.to_string(),
                 key: key.to_string(),
@@ -643,8 +650,8 @@ impl Context {
     /// # Validation Rules
     /// - Secret must exist in the same namespace as the Tenant
     /// - Secret must contain both `accesskey` and `secretkey` keys
-    /// - Both keys must be valid UTF-8 strings
-    /// - Both keys must be at least 8 characters long
+    /// - Both keys must be valid UTF-8 strings without NUL bytes
+    /// - Both keys must be at least 8 UTF-8 bytes after trimming
     ///
     /// # Returns
     /// - `Ok(())` if Secret is valid or not configured
@@ -890,8 +897,8 @@ mod credential_secret_validation_tests {
     fn credential_secret_accepts_valid_values() {
         let secret = Secret {
             data: Some(BTreeMap::from([
-                ("accesskey".to_string(), ByteString(b"access01".to_vec())),
-                ("secretkey".to_string(), ByteString(b"secret01".to_vec())),
+                ("accesskey".to_string(), ByteString(b" access01 ".to_vec())),
+                ("secretkey".to_string(), ByteString(b" secret01 ".to_vec())),
             ])),
             ..Default::default()
         };
@@ -944,11 +951,21 @@ mod credential_secret_validation_tests {
     }
 
     #[test]
-    fn credential_secret_values_must_be_valid_utf8() {
+    fn credential_secret_values_must_be_environment_safe_utf8() {
         let valid_value = ByteString(b"valid-key".to_vec());
         for (access_key, secret_key, invalid_key) in [
             (ByteString(vec![0xff]), valid_value.clone(), "accesskey"),
             (valid_value.clone(), ByteString(vec![0xff]), "secretkey"),
+            (
+                ByteString(b"valid\0key".to_vec()),
+                valid_value.clone(),
+                "accesskey",
+            ),
+            (
+                valid_value.clone(),
+                ByteString(b"valid\0key".to_vec()),
+                "secretkey",
+            ),
         ] {
             let secret = Secret {
                 data: Some(BTreeMap::from([
@@ -970,13 +987,32 @@ mod credential_secret_validation_tests {
     #[test]
     fn credential_secret_values_must_be_at_least_eight_bytes() {
         let valid_value = ByteString(b"valid-key".to_vec());
-        for (access_key, secret_key, invalid_key) in [
-            (ByteString(Vec::new()), valid_value.clone(), "accesskey"),
-            (valid_value.clone(), ByteString(Vec::new()), "secretkey"),
+        for (access_key, secret_key, invalid_key, expected_length) in [
+            (ByteString(Vec::new()), valid_value.clone(), "accesskey", 0),
+            (valid_value.clone(), ByteString(Vec::new()), "secretkey", 0),
             (
                 ByteString(b"short".to_vec()),
                 valid_value.clone(),
                 "accesskey",
+                5,
+            ),
+            (
+                ByteString(b"        ".to_vec()),
+                valid_value.clone(),
+                "accesskey",
+                0,
+            ),
+            (
+                ByteString(b" short ".to_vec()),
+                valid_value.clone(),
+                "accesskey",
+                5,
+            ),
+            (
+                valid_value.clone(),
+                ByteString(b" short ".to_vec()),
+                "secretkey",
+                5,
             ),
         ] {
             let secret = Secret {
@@ -993,11 +1029,29 @@ mod credential_secret_validation_tests {
                 Error::CredentialSecretTooShort {
                     secret_name,
                     key,
-                    ..
-                } if secret_name == "creds" && key == invalid_key
+                    length,
+                } if secret_name == "creds"
+                    && key == invalid_key
+                    && length == expected_length
             ));
         }
     }
+
+    #[test]
+    fn credential_secret_length_is_measured_in_trimmed_utf8_bytes() {
+        let secret = Secret {
+            data: Some(BTreeMap::from([
+                (
+                    "accesskey".to_string(),
+                    ByteString(" \u{1f510}\u{1f510} ".as_bytes().to_vec()),
+                ),
+                ("secretkey".to_string(), ByteString(b"secret01".to_vec())),
+            ])),
+            ..Default::default()
+        };
+
+        assert!(validate_credential_secret_data(&secret, "creds").is_ok());
+    }
 }
 
 #[cfg(test)]

src/status.rs

@@ -60,7 +60,7 @@ impl StatusError {
                 Reason::CredentialSecretInvalidEncoding,
                 ConditionType::CredentialsReady,
                 format!(
-                    "Credential Secret '{}' key '{}' must contain valid UTF-8",
+                    "Credential Secret '{}' key '{}' must contain valid UTF-8 without NUL bytes",
                     secret_name, key
                 ),
             ),
@@ -70,7 +70,7 @@ impl StatusError {
                 Reason::CredentialSecretTooShort,
                 ConditionType::CredentialsReady,
                 format!(
-                    "Credential Secret '{}' key '{}' must be at least 8 characters",
+                    "Credential Secret '{}' key '{}' must be at least 8 UTF-8 bytes after trimming",
                     secret_name, key
                 ),
             ),

src/types/v1alpha1/tenant.rs

@@ -181,7 +181,8 @@ pub struct TenantSpec {
     // // #[serde(default, skip_serializing_if = "Option::is_none")]
     // // pub side_cars: Option<SideCars>,
     /// Optional reference to a Secret containing RustFS credentials.
-    /// The Secret must contain 'accesskey' and 'secretkey' keys (both required, minimum 8 characters each).
+    /// The Secret must contain 'accesskey' and 'secretkey' keys. Both values must be valid
+    /// UTF-8 without NUL bytes and at least 8 UTF-8 bytes after trimming.
     /// If not specified, credentials can be provided via environment variables in 'env'.
     /// Priority: Secret credentials > Environment variables > RustFS built-in defaults.
     /// For production use, always configure credentials via Secret or environment variables.