Make targets for issuing credentials #86
No reviewers
alexvanin
Labels
No labels
P0
P1
P2
P3
good first issue
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
No milestone
No project
No assignees
9 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: TrueCloudLab/frostfs-dev-env#86
Loading…
Reference in a new issue
No description provided.
Delete branch "nzinkevich/frostfs-dev-env:make_creds"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Close #84
Signed-off-by: Nikita Zinkevich n.zinkevich@yadro.com
@ -60,6 +60,7 @@ get: $(foreach SVC, $(GET_SVCS), get.$(SVC)).PHONY: upup: up/basic@$(foreach SVC, $(START_SVCS), $(shell docker-compose -f services/$(SVC)/docker-compose.yml up -d))./vendor/frostfs-adm morph proxy-add-account --config frostfs-adm.yml --account NYpbUf3vVDfaL1UyiUxwEfR6dtrZSBztis || die "Couldn't set s3-gw wallet as proxy wallet"What wallet is this hardcoded account from? A quick grep through my copy of the repo did not come up with any results
Fixed. It's a contract wallet address
@ -0,0 +2,4 @@# Generate S3 credentialss3cred:@docker exec -it s3_gate /usr/bin/issue-creds.sh s3This recipe asks for
/user_wallet.jsonpassword on my machine, ands3is not accepted as valid. Maybe we can avoid interactive prompt here?Fixed, now if wallet has non-empty password, you can pass it via
passwordparameter. Now it also has optional paramscontract_passwordandgate_public_keyif contract wallet is not default. Example given in README.md@ -0,0 +6,4 @@# Generate S3 credentials based on imported walletss3cred-custom:@docker exec -it s3_gate /usr/bin/issue-creds.sh s3 $(wallet)Did you test this? I'm not sure that
$(wallet)is visible from inside thes3_gatecontainer.Added
walletsdirectory for storing custom wallets@ -0,0 +1 @@{"version":"1.0","accounts":[{"address":"NQjbiXuAoZHCifBJ9H1TQ7SPQA3EzdA1Mr","key":"6PYVwvn4kpcHD2VedzwcKcFgGYooeiBrWaJdXg1WEag3fzNWMwPKnKDKV4","label":"nikita","contract":{"script":"DCEDzN6yW9sasGL4sGpyAq9I47Ly2b2JjRz0WSqLoW1sIU9BVuezJw==","parameters":[{"name":"parameter0","type":"Signature"}],"deployed":false},"lock":false,"isDefault":false}],"scrypt":{"n":16384,"r":8,"p":8},"extra":{"Tokens":null}}We like you very much, but this is not really appropriate for a public repo :)
xk6-frostfsalso uses a separate wallet. What about adding it as well?fc39619f6bto1d97f4bd88Do you mean user wallet? If so, you can place wallet in
service/s3_gate/walletsdirectory and callmake s3cred wallet=wallet.jsonto issue creds[#84] Port targets for issuing credentialsto [#84] Port Make targets for issuing credentials[#84] Port Make targets for issuing credentialsto [#84] Make targets for issuing credentials@ -60,6 +60,7 @@ get: $(foreach SVC, $(GET_SVCS), get.$(SVC)).PHONY: upup: up/basic@$(foreach SVC, $(START_SVCS), $(shell docker-compose -f services/$(SVC)/docker-compose.yml up -d))./vendor/frostfs-adm morph proxy-add-account --config frostfs-adm.yml --account NUUb82KR2JrVByHs2YSKgtK29gKnF5q6Vt || die "Couldn't set s3-gw wallet as proxy wallet"Could we, please, calculate
--accountvalue using:?
@ -0,0 +8,4 @@--contract-wallet /wallet.json 1> /dev/null && touch $WALLET_CACHE/$USERNAME}issueAWS() {issueCreds
@ -0,0 +9,4 @@s3cred:@docker exec -e AUTHMATE_WALLET_PASSPHRASE=$(password) -e AUTHMATE_WALLET_CONTRACT_PASSPHRASE=$(contract_password) s3_gate /usr/bin/issue-creds.sh s3 $(wallet) $(gate_public_key)# Generate S3 credentialsIncorrect comment
@ -13,10 +13,13 @@ services:ipv4_address: ${IPV4_PREFIX}.82volumes:- ./wallet.json:/wallet.json- ./user_wallet.json:/user_wallet.jsonLet's use
frostfs-dev-env/wallets/wallet.jsonwallet by default@ -0,0 +13,4 @@--wallet $WALLET_PATH \--peer s01.frostfs.devenv:8080 \--gate-public-key $S3_GATE_PUBLIC_KEY \--container-placement-policy "REP 1"Probably we should use different policy.
REP 3for example@ -0,0 +10,4 @@@docker exec -e AUTHMATE_WALLET_PASSPHRASE=$(password) -e AUTHMATE_WALLET_CONTRACT_PASSPHRASE=$(contract_password) s3_gate /usr/bin/issue-creds.sh s3 $(wallet) $(gate_public_key)# Generate S3 credentialscred:Should we rename this target? To be more clear that this command just register user and don't create any credentials
@ -0,0 +1 @@{"version":"1.0","accounts":[{"address":"NQ7XnUVh5Uf5Vi9WxFRWHoShP8jHcHx6cd","key":"6PYT8dNaPWmhuiF6LovPyxbg7b3yrBic4gyk57JC7Fed5kkdX7bPn7Y6Pe","label":"custom","contract":{"script":"DCECyvyY2A+nacS1BGtLY63A9RzHTi4P1urM4LjLVrkroLNBVuezJw==","parameters":[{"name":"parameter0","type":"Signature"}],"deployed":false},"lock":false,"isDefault":false}],"scrypt":{"n":16384,"r":8,"p":8},"extra":{"Tokens":null}}Why do we need this new wallet?
@ -0,0 +7,4 @@# Generate S3 credentialss3cred:@docker exec -e AUTHMATE_WALLET_PASSPHRASE=$(password) -e AUTHMATE_WALLET_CONTRACT_PASSPHRASE=$(contract_password) s3_gate /usr/bin/issue-creds.sh s3 $(wallet) $(gate_public_key)This will not work if password contains whitespace
1d97f4bd88to1918f2aa02New commits pushed, approval review dismissed automatically according to repository settings
LGTM
@ -0,0 +1,14 @@.PHONY: s3cred registerpassword?=""Empty strings in Makefile are just empty. This should be
password?=Quotes work for now, but that's more of an accident:
AUTHMATE_WALLET_PASSPHRASE="$(password)"AUTHMATE_WALLET_PASSPHRASE=""""A few
accidentsedits later it might cost someone a long debug session.1918f2aa02to54af37899aNew commits pushed, approval review dismissed automatically according to repository settings
@ -0,0 +13,4 @@--wallet $WALLET_PATH \--peer s01.frostfs.devenv:8080 \--gate-public-key $S3_GATE_PUBLIC_KEY \--container-placement-policy "REP 3"What's happen if my container has other policy?
This policy is used to create container to store 'accessbox' object with tokens for s3-gateway to use for authorization. So any valid policy can be used here.
For example, I often use
REP 4policy when I test some split-brain issues in dev-env. This way all nodes contain accessbox and authorization does not affect the case I want to check.@ -13,10 +13,13 @@ services:ipv4_address: ${IPV4_PREFIX}.82volumes:- ./wallet.json:/wallet.jsonThere are 3 different wallet volumes with the same name.
Do we need them all?
From the name alone, it is not obvious what are the use-cases for each.
Now these volumes have corresponding comments. One is a service wallet, another one is for user operation, and for more there are separate dir of custom wallets to use.
[#84] Make targets for issuing credentialsto Make targets for issuing credentials54af37899ato20e6f09106New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
20e6f09106to636be7352eMerging it, because all required approved were collected before last force change for #86 (comment)