Sealos S3

Identity and Discovery

• Owner: sealos-s3 (/sealos-s3 and bucket, object, policy, credentials, presign, or quota requests).
• Class: cloud-local-mutation through sealos-cli s3, with an optional redacted deployment handoff.
• Canaries: S3-PRIVATE-REUSE, S3-CONFIRM-PUBLIC, and S3-REDACT-OBJECT.

Scope and Boundaries

Accept a project path and object-storage intent. Analyze first, list existing buckets, create or reuse private storage, initialize credentials only when needed, and wire the smallest existing env-key set. Preserve local MinIO/Compose fallback; public policy, rotation, deletion, and destructive object changes remain gated.

Risk and Confirmation

Keep buckets private by default. Ask before public policy, credential rotation for an active app, bucket/object deletion, or replacing storage configuration. Never print secret keys, full credential blocks, kubeconfig, auth files, or copied env values; parse JSON output rather than scraping secrets from tables.

Lifecycle Workflow

For each request, resolve the project, analyze storage need, confirm CLI/auth/region/workspace, list before create/reuse, wait for credential readiness, wire existing keys, prove an authenticated upload/read or presign path, clean temporary objects, and report policy state. Emit request-scoped success, stopped, or error; the existing private-first workflow remains the domain extension below. Workspace ambiguity, missing credential readiness, or a tracked env target stops the request before mutation.