auth and config

Two packages that together define how MinIO is configured at runtime.

internal/auth

A handful of files (internal/auth/auth.go, internal/auth/credentials.go) that own the access-key / secret-key types and the validators every other package uses.

Symbol	What it does
auth.Credentials	The (AccessKey, SecretKey, SessionToken, Expiration) value MinIO passes around.
auth.GenerateCredentials	Random root or service-account credentials.
auth.CheckAccessKey...	Length and charset rules borrowed from AWS.

The package is imported by cmd/iam.go, cmd/auth-handler.go, the STS handlers, and anything that mints or compares creds. It depends only on crypto/rand and regexp.

internal/config

The configuration registry. Every subsystem registers a KVS (key-value store) entry with helper text and validation, then cmd/config-current.go merges them into the persistent on-cluster config.

internal/config/
├── config.go                # Top-level KVS / SubsysInfo definitions
├── help.go                  # HelpKVS schema
├── errors.go, errors-utils.go
├── certs.go, certsinfo.go   # TLS cert validation helpers
├── crypto.go                # Config-file encryption (when MINIO_CONFIG_ENV_FILE is encrypted)
├── legacy.go                # Older config formats
├── server.go                # Server-wide config bag
├── api/, batch/, browser/, callhome/, compress/, dns/, drive/, etcd/, heal/,
│   identity/, ilm/, lambda/, notify/, policy/, scanner/, storageclass/, subnet/
└── ...

Subsystems

The config.SubSystems slice in internal/config/config.go enumerates every configurable area. Each subsystem provides:

• A default KVS (the keys it knows about and their defaults).
• A HelpKVS documenting them (used by mc admin config get --help).
• A LookupConfig function that parses the merged KVS into a typed Config struct.
• Optional environment-variable prefixes (MINIO_<AREA>_<KEY>).

Persistence

The merged config is serialised to .minio.sys/config/config.json (encrypted with the cluster KMS if available) by cmd/config-current.go. It's then propagated to peers via the peer REST.

Environment variables

github.com/minio/pkg/v3/env is the lookup helper. A typical config block accepts both an env var (like MINIO_API_REQUESTS_MAX) and a KVS key. The env var wins.

Help and runtime defaults

internal/config/help.go defines the HelpKVS and HelpKV types. Every subsystem registers its help with RegisterHelpSubSys so mc admin config can render guidance for every key.

Integration points

• cmd/server-main.go calls config.LookupConfig for each subsystem during boot.
• cmd/admin-handlers-config-kv.go exposes mc admin config get/set HTTP endpoints.
• cmd/site-replication.go syncs config across sites.

Entry points for modification

• Add a new config knob. Create a new directory under internal/config/<area>/, define DefaultKVS, Help, Config, and LookupConfig. Register the subsystem in internal/config/config.go. Document the env vars in Configuration.
• Add a new credential format. Touch internal/auth/, mind backwards compatibility — existing accesses must still parse.