Skip to content

SILO Console 2.7.1: Service-Account Policy Inheritance and Strict Validation

Console 2.7.1 preserves service-account policy inheritance on metadata edits, blocks empty inline-policy variants, surfaces save errors inside the edit modal, and adopts Go 1.27.4, silo-pkg 3.16.1, and mcli 20261112.

SILO Console 2.7.1 is released, following 2.7.0. Tag: v2.7.1; source: 3825ebc44451. This is a standalone Console release; published SILO Server 20261109 continues to embed Console 2.7.0 until the next Server release is published.

GitHub release · Compatibility notes · SN-2026-025 chronicle · Downloads

Service-account policy inheritance (SN-2026-025)

  • Separate inherited vs. inline policy tracking (1be8a74bf): Console previously populated the service-account editor with the parent user’s effective policy and resubmitted that document during metadata or status saves (silo-console#89). Editing an inherited key’s name, description, expiry, or enabled state froze the parent policy into a static inline policy and failed whenever the parent policy exceeded the 4 KiB inline session-policy limit (blocking even emergency disable actions). Console 2.7.1 tracks inheritance explicitly and omits policy on metadata-only saves when neither the toggle nor the inline document changed.
  • Explicit reset to inheritance: turning off Restrict beyond user policy sends an explicit empty policy ({}) so a repaired SILO Server (post-20261109 candidate) removes the stored inline restriction and restores parent inheritance.
  • Empty inline-policy guard & modal error feedback (a1a84cab4, 1fdb279fd, 3825ebc44): while Restrict beyond user policy remains enabled, creating or replacing a policy rejects an empty editor, {}, {"Statement":[]}, {"Statement":null}, and backend-accepted case-insensitive, Unicode-folded, or duplicate-key empty variants. Unchanged historical empty inline policies can still save metadata-only edits without altering permissions. Save errors render directly inside the edit modal instead of failing behind the dialog.

Strict policy JSON validation and dependencies

  • Backend policy validation (3825ebc44): Console API endpoints enforce strict JSON policy decoding aligned with silo-pkg v3.16.1, rejecting unknown fields, trailing JSON tokens, non-object payloads, empty Principal: {} / unsupported NotPrincipal blocks, and empty named policies.
  • Toolchain and pinned stack: built with Go 1.27.4, github.com/pgsty/silo-pkg/v3 v3.16.1, and pgsty/mc RELEASE.2026-11-12T00-00-00Z (mcli 20261112, v0.0.0-20261111180825-a37a9f054fba), verified against the Go proxy, checksum database, and immutable GitHub release metadata.

Upgrade note: standalone Console v2.7.1 protects metadata-only edits immediately; explicit reset-to-inheritance (policy: "{}") requires the matching post-20261109 SILO Server update. Stop older console usage-worker processes before starting 2.7.1 workers when upgrading from pre-2.7.0 deployments.

Verification and delivery

  • Required matrix · Required vulnerability checks · Tag release and artifact verification · Latest image promotion
  • Image: docker.io/pgsty/silo-console:v2.7.1 and docker.io/pgsty/silo-console:latest (linux/amd64, linux/arm64), manifest digest sha256:2afef06f8505eadb24d657acd0f68c78bce8b148b1d9b74981454560fa3b055f.
  • GitHub Release ships 44 verified assets (six platform executables and archives, nine Linux RPM/DEB/APK packages, source archive, SPDX SBOMs, legal notices, and a Cosign-signed SHA-256 manifest with GitHub provenance).