Add example of APE rules to cli commands help #1575

New issue

Open

opened 2024-12-20 10:07:01 +00:00 by dkirillov · 4 comments

dkirillov commented

2024-12-20 10:07:01 +00:00

Member

It would be very nice to see syntax for --rules flag in help for

frostfs-adm morph ape add-rule-chain
frostfs-cli ape-manager add

Currently there is only comment in code

 // ParseAPERule parses access-policy-engine statement from the following form:
 // <status>[:status_detail] <action>... [<condition>...] <resource>...
 //
 // Examples:
 // deny  Object.Put *
 // deny:QuotaLimitReached Object.Put *
 // allow Object.Put *
 // allow Object.Get ResourceCondition:Department=HR RequestCondition:Actor=ownerA *
 // allow Object.Get any ResourceCondition:Department=HR RequestCondition:Actor=ownerA *
 // allow Object.Get all ResourceCondition:Department=HR RequestCondition:Actor=ownerA *
 // allow Object.* *
 // allow Container.* *
 //
 //nolint:godot
 func ParseAPERule(r *apechain.Rule, rule string) error {

Describe the solution you'd like

Add examples to help

Describe alternatives you've considered

Additional context

## Is your feature request related to a problem? Please describe. It would be very nice to see syntax for `--rules` flag in help for * `frostfs-adm morph ape add-rule-chain` * `frostfs-cli ape-manager add` Currently there is only comment in code https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/148d68933bb1f3fda17db2c7f4fe073336554f67/pkg/util/ape/parser.go#L62-L76 ## Describe the solution you'd like Add examples to help ## Describe alternatives you've considered No ## Additional context No

dkirillov added the

triage

label 2024-12-20 10:07:01 +00:00

a-savchuk commented

2024-12-23 07:49:11 +00:00

Member

The help message for the --rule flag in the CLI was recently made more descriptive (#1519). This change is only for the CLI, not for frostfs-adm. The need of having it in frostfs-adm should be considered. Does the existing help message lack anything you might need?

The help message for the `--rule` flag in the CLI was recently made more descriptive (https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/1519). This change is only for the CLI, not for `frostfs-adm`. The need of having it in `frostfs-adm` should be considered. **Does the existing help message lack anything you might need?**

dkirillov commented

2024-12-23 11:46:13 +00:00

Author

Member

I'd like to see all possible actions in help instead of etc

Actions:
  Object operations:
    - Object.Put, Object.Get, etc.
    - Object.*     (all object operations)
 Container operations:
   - Container.Put, Container.Get, etc.
   - Container.*  (all container operations)

For example: Can I use Container.List (or action for ListContainer has different name in cli?) in container operations or this is possible only for namespace?

Can I provide rule with StringLike condition?
Probably we support only = and != for the sake of simplicity. But we should mention this and advise to use json format for complex rules.
But probably we could support wildcard in condition with =/!= and consider it as *Like condition
Finally I'd like to see a couple of exact examples of rules e.g.

      --rule stringArray      Defines an Access Policy Engine (APE) rule in the format:
                                  <status>[:status_detail] <action>... <condition>... <resource>...
                              
                               * Allow any container operation in namespae:
                                   allow Container.* *
                               * Make your container public-read:
                                   allow ...
                               * Make your container public-read-write:
                                   allow ... 
                               * Make your container public-read for specific public key:
                                   allow ...
                              
                              Status:
                                 // ...

* I'd like to see all possible actions in help instead of `etc` ``` Actions: Object operations: - Object.Put, Object.Get, etc. - Object.* (all object operations) Container operations: - Container.Put, Container.Get, etc. - Container.* (all container operations) ``` For example: Can I use `Container.List` (or action for [ListContainer](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/a3bc3099bd5bfefd702b44070d58982e477a56e9/schema/native/consts.go#L16) has different name in cli?) in container operations or this is possible only for namespace? * Can I provide rule with `StringLike` [condition](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/a3bc3099bd5bfefd702b44070d58982e477a56e9/pkg/chain/chain.go#L124)? Probably we support only `=` and `!=` for the sake of simplicity. But we should mention this and advise to use json format for complex rules. But probably we could support wildcard in condition with `=`/`!=` and consider it as `*Like` condition * Finally I'd like to see a couple of exact examples of rules e.g. ``` --rule stringArray Defines an Access Policy Engine (APE) rule in the format: <status>[:status_detail] <action>... <condition>... <resource>... * Allow any container operation in namespae: allow Container.* * * Make your container public-read: allow ... * Make your container public-read-write: allow ... * Make your container public-read for specific public key: allow ... Status: // ... ```

👍 1

fyrchik commented

2024-12-23 12:15:36 +00:00

Owner

I'd like to see all possible actions in help instead of etc

I think we should link to a spec then. This help is useful, but not need to be exhaustive. For us Container.List is just a string (correct me if I am wrong), and the "real" list of methods depends on the API version.

>I'd like to see all possible actions in help instead of etc I think we should link to a spec then. This help is useful, but not need to be exhaustive. For us `Container.List` is just a string (correct me if I am wrong), and the "real" list of methods depends on the API version.

dkirillov commented

2024-12-23 12:55:04 +00:00

Author

Member

I think we should link to a spec then

What spec do you mean? If you mean api-go or policy-engine it seems I will see PutObject or similar const there. But cli accept this in different format.
Probably we should fix frostfs-cli then so it accepts exactly string from spec (PutObect, ListContainers etc.) rather than Object.Put

> I think we should link to a spec then What spec do you mean? If you mean `api-go` or `policy-engine` it seems I will see `PutObject` or similar const there. But cli accept this in different format. Probably we should fix `frostfs-cli` then so it accepts exactly string from spec (`PutObect`, `ListContainers` etc.) rather than `Object.Put`