Skip to content

Egress S3 (MinIO / S3-compatible)

Responsibility

Object-store capability provider for S3-compatible backends (in-cluster MinIO first). Workflows call it via service_call — no native orchestrator storage steps.

Capabilities:

  • egress.s3.put — put object (bucket, key, body or body_base64, content_type)
  • egress.s3.get — get object
  • egress.s3.list — list objects (prefix, limit)
  • egress.s3.delete — delete object
  • s3.connection — connection type s3 (endpoint, access/secret key, region, secure, default_bucket)

Admin routes (dashboard proxy, X-S3-Admin-Token):

  • GET /admin/buckets, POST /admin/buckets
  • GET /admin/objects, GET|PUT|DELETE /admin/object

Architecture

Capability provider (see Deploy integration contract):

  • Registers with capability-registry at startup
  • Default endpoint: http://orchestrator-minio:9000
  • Bootstraps bucket object-demo when default credentials are set
  • Distinct from the platform storage service (filesystem KV / runtime docs under /app/data)

Connection Model

name: minio_demo
type: s3
endpoint: http://orchestrator-minio:9000
region: us-east-1
secure: false
default_bucket: object-demo

Reference: flows/connections/minio_demo.yaml.

In-cluster demo connections omit access_key / secret_key. The egress-s3 pod fills defaults from meshflows-orchestrator-minio, or MinIO image defaults (minioadmin / minioadmin) when that K8s secret is absent.

For external S3 (or explicit credentials), add:

access_key: $secret:minio-access-key
secret_key: $secret:minio-secret-key

and create those runtime secrets (Dashboard → Secrets), or rely on storage startup seed / deploy sync from meshflows-orchestrator-minio after that secret exists.

Example Workflow

  • Workflow: flows/workflows/storage_minio_demo.yaml
  • HTTP trigger: POST /v1/api/integration/storage-minio-demo
  • DSAV archive: flows/workflows/dsav_message_archive.yaml + AMQP trigger flows/triggers/dsav-message-archive-amqp.yaml — stores each DSAV message at Domain/Service/Action/Version/YYYY/MM/DD/<request_id>.json on MinIO (requires SES for the javascript key-builder step).

Deploy

  • Image: meshflows/egress-s3
  • Deployment: egress-s3
  • Service path: engine/services/s3/
  • Secret: meshflows-orchestrator-minio (access_key / secret_key)

Health

  • GET /healthz
  • GET /readyz
  • GET /internal/capabilities
  • Cluster health maps s3.service → deployment egress-s3