feat: reconcile bucket versioning and object lock

CHANGELOG.md

@@ -29,6 +29,7 @@ All notable changes to RustFS Operator are documented in this file. The format i
 - Tenant `spec.hostUsers` and OpenShift `hostUsers: false` defaults for `restricted-v3`.
 - Tenant bucket canned anonymous access and ConfigMap-sourced bucket policies.
 - Declarative Tenant bucket lifecycle rules with drift-aware ownership and explicit removal.
+- Declarative Tenant bucket versioning and Object Lock default retention with drift-aware ownership.
 - Helm chart `cosiDriver.enabled` to deploy the RustFS COSI (`rustfs.objectstorage.k8s.io`)
   driver alongside the upstream provisioner sidecar, with dedicated ServiceAccount/RBAC.
 - Seven built-in RustFS Grafana dashboards, published by default as sidecar-discoverable

console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx

@@ -34,6 +34,7 @@ import type {
   EncryptionInfoResponse,
   UpdateEncryptionRequest,
   UpdateSecurityContextRequest,
+  ProvisioningBucketStatus,
   ProvisioningItemStatus,
 } from "@/types/api"
 import { ApiError } from "@/lib/api-client"
@@ -107,11 +108,12 @@ function provisioningGroups(tenant: TenantDetailsResponse) {
   ].filter((group) => group.items.length > 0)
 }
 
-function provisioningItemDetails(item: ProvisioningItemStatus): string {
+function provisioningItemDetails(item: ProvisioningItemStatus | ProvisioningBucketStatus): string {
   const details: string[] = []
   if (item.policies && item.policies.length > 0) details.push(`policies=${item.policies.join(",")}`)
   if (item.region) details.push(`region=${item.region}`)
   if (item.objectLock != null) details.push(`objectLock=${item.objectLock ? "true" : "false"}`)
+  if ("versioning" in item && item.versioning) details.push(`versioning=${item.versioning}`)
   if (item.lastAppliedGeneration != null) details.push(`generation=${item.lastAppliedGeneration}`)
   return details.length > 0 ? details.join(" ") : "-"
 }

console-web/types/api.ts

@@ -126,12 +126,20 @@ export interface ProvisioningBucket {
   name: string
   region?: string
   objectLock?: boolean
+  versioning?: boolean
+  objectLockConfiguration?: BucketObjectLockConfiguration
   anonymous?: "Private" | "Download" | "Upload" | "Public"
   policy?: PolicyDocumentSource
   lifecycle?: BucketLifecycleSpec
   deletionPolicy?: ProvisioningDeletionPolicy
 }
 
+export interface BucketObjectLockConfiguration {
+  state?: "Present" | "Absent"
+  mode?: "Governance" | "Compliance"
+  days?: number
+}
+
 export interface BucketLifecycleSpec {
   state: "Present" | "Absent"
   rules?: BucketLifecycleRule[]
@@ -171,6 +179,9 @@ export interface ProvisioningItemStatus {
 export interface ProvisioningBucketStatus extends ProvisioningItemStatus {
   lifecycleDesiredHash?: string | null
   lifecycleLastAppliedHash?: string | null
+  versioning?: "Unversioned" | "Enabled" | "Suspended" | null
+  objectLockConfigurationDesiredHash?: string | null
+  objectLockConfigurationLastAppliedHash?: string | null
 }
 
 export interface ProvisioningStatus {

crates/rustfs-admin/src/lib.rs

@@ -35,6 +35,8 @@ mod s3_ops;
 pub use s3_ops::{
     BucketLifecycleAbortIncompleteMultipartUpload, BucketLifecycleConfiguration,
     BucketLifecycleExpiration, BucketLifecycleRule, BucketLifecycleRuleStatus,
+    BucketObjectLockConfiguration, BucketObjectLockDefaultRetention, BucketObjectLockRetentionMode,
+    BucketObjectLockRetentionPeriod, BucketVersioningState, BucketVersioningUpdate,
     canonicalize_bucket_lifecycle_xml,
 };
 /// sts_ops: temporary credential flows.
@@ -232,6 +234,8 @@ pub enum RustfsClientError {
         status: StatusCode,
         detail: Option<String>,
     },
+    InvalidBucketVersioningResponse,
+    InvalidObjectLockConfigurationResponse,
     InvalidLifecycleConfigurationResponse,
     ParseResponseFailed,
     SigningFailed,
@@ -277,6 +281,12 @@ impl std::fmt::Display for RustfsClientError {
             Self::InvalidLifecycleConfigurationResponse => {
                 write!(f, "invalid bucket lifecycle configuration response")
             }
+            Self::InvalidBucketVersioningResponse => {
+                write!(f, "invalid bucket versioning response")
+            }
+            Self::InvalidObjectLockConfigurationResponse => {
+                write!(f, "invalid bucket Object Lock configuration response")
+            }
             Self::ParseResponseFailed => write!(f, "failed to parse AssumeRole response"),
             Self::SigningFailed => write!(f, "failed to compute request signature"),
         }
@@ -321,6 +331,8 @@ impl RustfsClientError {
             | Self::InvalidTenantTlsCa
             | Self::TlsClientBuildFailed
             | Self::RequestBuildFailed
+            | Self::InvalidBucketVersioningResponse
+            | Self::InvalidObjectLockConfigurationResponse
             | Self::InvalidLifecycleConfigurationResponse
             | Self::SigningFailed => false,
         }