S3/MinIO

Decision of the TC on 2021-08-18:

• The S3 API is the protocol for external (non-Postgres) object storage in FOLIO and standard environment variables/configuration of an S3 server on a per module basis.

• The module implementation of object storage must conform to the FOLIO standards for tenant separation

  • The recommended standards will be referenced/pointed out by the tech leads.

    • e.g. how tenant separation should be handled, etc.

    • @Jakub Skoczen will raise the topic with the tech leads

• Should the min.io client library be the recommended client as object storage choice agnostic library, but modules could also choose the native S3 implementation?

  • Yes.

• Should teams be allowed to store binary data in Postgres?  In some cases (amount of data is small, etc.)?

  • Yes.  If external object storage (not Postgres) is required, it must be S3.

  • Regardless of which is used, tenant separation still must be done. (x3)

Request of the Security Group on 2021-08-20:

• Binary files must be stored with strict tenant and module separation.

• A FOLIO MinIO security guide for developers and sysops must be published and reviewed by the security team before more modules start using it.

  • e.g. Including guidance for how to do the tenant/module separation.

  • The tech leads group will discuss this as noted during the TC meeting (see TC 2021-08-18 Meeting notes).