TrueCloudLab/frostfs-node
21
1
Fork 27
Code Issues 108 Pull requests 3 Projects Releases 1 Activity Actions

[#390] frostfs-cli: Pass bearer token to Tree srv #427

Merged
realloc merged 1 commit from aarifullin/frostfs-node:feature/390-bearer_tree_srv into master 2023-06-07 13:04:21 +00:00
Conversation 1 Commits 1 Files changed 5 +11 -4
aarifullin commented 2023-06-05 16:03:30 +00:00
Member
Copy link
  • Add --bearer flag for "tree" subcommand

Signed-off-by: Airat Arifullin a.arifullin@yadro.com

This PR is only first step to solve the issue. The bearer token can be generated with s3-authmate (but this is "custom" way of mine):

s3-authmate obtain-secret --wallet <wallet-path> --peer s03.frostfs.devenv:8080 --gate-wallet <gate-path> --access-key-id <AWS_ACCESS_ID> | jq .bearer

This allows to get valid JSON bearer token that can be passed to cli with --bearer token, but I haven't checked if it's really fine (it generates only "OTHERS" roles for now)
Anyway, the rpc response is

rpc call: rpc error: code = Unknown desc = access to operation GET is denied by extended ACL check: not found allowing rules for the request

This is because container's role processing differs from object's (here is no SYSTEM role). We need to discuss this

* Add --bearer flag for "tree" subcommand Signed-off-by: Airat Arifullin a.arifullin@yadro.com ----- This PR is only first step to solve the [issue](https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/390). The bearer token can be generated with s3-authmate (but this is "custom" way of mine): ``` s3-authmate obtain-secret --wallet <wallet-path> --peer s03.frostfs.devenv:8080 --gate-wallet <gate-path> --access-key-id <AWS_ACCESS_ID> | jq .bearer ``` This allows to get valid JSON bearer token that can be passed to cli with `--bearer` token, but I haven't checked if it's really fine (it generates only "OTHERS" roles for now) Anyway, the rpc response is ``` rpc call: rpc error: code = Unknown desc = access to operation GET is denied by extended ACL check: not found allowing rules for the request ``` This is because container's role processing differs from object's (here is no `SYSTEM` role). We need to discuss this
aarifullin added the
enhancement
frostfs-cli
 labels 2023-06-05 16:03:47 +00:00
aarifullin force-pushed feature/390-bearer_tree_srv from 0bb092c7f8 to 9c4a2bffe0 2023-06-05 16:04:33 +00:00 Compare
aarifullin requested review from alexvanin 2023-06-05 16:05:25 +00:00
aarifullin requested review from storage-core-developers 2023-06-05 16:05:30 +00:00
aarifullin requested review from storage-core-committers 2023-06-05 16:05:34 +00:00
acid-ant approved these changes 2023-06-07 07:07:36 +00:00
dstepanov-yadro approved these changes 2023-06-07 07:09:33 +00:00
alexvanin reviewed 2023-06-07 07:58:14 +00:00
cmd/frostfs-cli/modules/tree/root.go Outdated
@ -45,0 +54,4 @@
func getBearerToken(cmd *cobra.Command) []byte {
if bearerPath, _ := cmd.Flags().GetString(bearerFlagKey); bearerPath != "" {
var bt bearer.Token
err := common.ReadBinaryOrJSON(cmd, &bt, bearerPath)
alexvanin commented 2023-06-07 07:58:14 +00:00
Owner
Copy link

Is there a reason to not use common.ReadBearerToken?

Is there a reason to not use `common.ReadBearerToken`?
aarifullin commented 2023-06-07 08:09:41 +00:00
Author
Member
Copy link

Hm. You're right. Probably I've ignored ReadBearerToken for debug reason :) I fixed it

Hm. You're right. Probably I've ignored `ReadBearerToken` for debug reason :) I fixed it
aarifullin force-pushed feature/390-bearer_tree_srv from 9c4a2bffe0 to 189a367ef2 2023-06-07 08:08:46 +00:00 Compare
alexvanin approved these changes 2023-06-07 08:40:13 +00:00
alexvanin left a comment
Owner
Copy link

This is because container's role processing differs from object's (here is no SYSTEM role). We need to discuss this

Actually, it works if you use S3 Gateway wallet to access the tree.

# create new credentials
frostfs-s3-authmate issue-secret --wallet frostfs-dev-env/wallets/wallet.json --peer s01.frostfs.devenv:8080 --gate-public-key 0313b1ac3a8076e155a7e797b24f0b650cccad5941ea59d7cfd51a024a8b2a06bf
Enter password for ../frostfs-dev-env/wallets/wallet.json >
{
  "access_key_id": "BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg0D7opEDcVAwdyK4KZbEamqpMQ2fWpUfaGapNHpNhgiQGS",
  "secret_access_key": "3ebb7b0c2ec9fc0c64b0791effc9a3b2335b913b3681ba9c2da350b08bf66e36",
  "owner_private_key": "22c0234c2c10b4ab24bbd2aa5a0d8ecf66339eb067c56f9ec5d97426dd3d7f23",
  "wallet_public_key": "031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a",
  "container_id": "BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg"
}

# create some object in S3
aws configure
aws s3api --endpoint-url http://s3.frostfs.devenv:8080 create-bucket --bucket "hello-world"
aws s3api --endpoint-url http://s3.frostfs.devenv:8080 put-object --bucket "hello-world" --key Makefile --body ./Makefile

# get container id of the bucket
$ curl --head http://s3.frostfs.devenv:8080/hello-world | grep X-Container-Id
X-Container-Id: 8ZbPdBDsfefqHPUsNoKXzvhWKDm9DNWY4PANVikhmGof

# get bearer token with custom authmate
frostfs-s3-authmate obtain-secret --wallet frostfs-dev-env/wallets/wallet.json --peer s01.frostfs.devenv:8080 --gate-wallet frostfs-dev-env/services/s3_gate/wallet.json --access-key-id BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg0D7opEDcVAwdyK4KZbEamqpMQ2fWpUfaGapNHpNhgiQGS | jq .bearer > btoken.json
Enter password for ../frostfs-dev-env/wallets/wallet.json >
Enter password for ./services/s3_gate/wallet.json >

# use bearer with s3 gateway wallet to access the tree
frostfs-cli tree get-by-path -w frostfs-dev-env/services/s3_gate/wallet.json --bearer btoken.json --cid 8ZbPdBDsfefqHPUsNoKXzvhWKDm9DNWY4PANVikhmGof --latest --path 'Makefile' -r s01.frostfs.devenv:8080 --tid version
Enter password >
4800413715384042197:
        Parent ID:  0
        Timestamp:  3
        Meta pairs:
                FileName: Makefile
                Size: 5273
                ETag: 407bb90c909f12a9ddebdab7a84052e0ed6049a9cacfa5bdb266e86c2eda740b
                IsUnversioned: true
                OID: 7PuYwuJqDU9jGrA6HXfG2M6jbxJRxRAHphoG4EMdfV2Z
> This is because container's role processing differs from object's (here is no SYSTEM role). We need to discuss this Actually, it works if you use S3 Gateway wallet to access the tree. ``` # create new credentials frostfs-s3-authmate issue-secret --wallet frostfs-dev-env/wallets/wallet.json --peer s01.frostfs.devenv:8080 --gate-public-key 0313b1ac3a8076e155a7e797b24f0b650cccad5941ea59d7cfd51a024a8b2a06bf Enter password for ../frostfs-dev-env/wallets/wallet.json > { "access_key_id": "BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg0D7opEDcVAwdyK4KZbEamqpMQ2fWpUfaGapNHpNhgiQGS", "secret_access_key": "3ebb7b0c2ec9fc0c64b0791effc9a3b2335b913b3681ba9c2da350b08bf66e36", "owner_private_key": "22c0234c2c10b4ab24bbd2aa5a0d8ecf66339eb067c56f9ec5d97426dd3d7f23", "wallet_public_key": "031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a", "container_id": "BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg" } # create some object in S3 aws configure aws s3api --endpoint-url http://s3.frostfs.devenv:8080 create-bucket --bucket "hello-world" aws s3api --endpoint-url http://s3.frostfs.devenv:8080 put-object --bucket "hello-world" --key Makefile --body ./Makefile # get container id of the bucket $ curl --head http://s3.frostfs.devenv:8080/hello-world | grep X-Container-Id X-Container-Id: 8ZbPdBDsfefqHPUsNoKXzvhWKDm9DNWY4PANVikhmGof # get bearer token with custom authmate frostfs-s3-authmate obtain-secret --wallet frostfs-dev-env/wallets/wallet.json --peer s01.frostfs.devenv:8080 --gate-wallet frostfs-dev-env/services/s3_gate/wallet.json --access-key-id BeVd4t9Ue7qV8EGyaNJ6qBibbchLwiWSYiX5oqSnLJHg0D7opEDcVAwdyK4KZbEamqpMQ2fWpUfaGapNHpNhgiQGS | jq .bearer > btoken.json Enter password for ../frostfs-dev-env/wallets/wallet.json > Enter password for ./services/s3_gate/wallet.json > # use bearer with s3 gateway wallet to access the tree frostfs-cli tree get-by-path -w frostfs-dev-env/services/s3_gate/wallet.json --bearer btoken.json --cid 8ZbPdBDsfefqHPUsNoKXzvhWKDm9DNWY4PANVikhmGof --latest --path 'Makefile' -r s01.frostfs.devenv:8080 --tid version Enter password > 4800413715384042197: Parent ID: 0 Timestamp: 3 Meta pairs: FileName: Makefile Size: 5273 ETag: 407bb90c909f12a9ddebdab7a84052e0ed6049a9cacfa5bdb266e86c2eda740b IsUnversioned: true OID: 7PuYwuJqDU9jGrA6HXfG2M6jbxJRxRAHphoG4EMdfV2Z ```
👍 1
aarifullin requested review from dstepanov-yadro 2023-06-07 09:12:12 +00:00
aarifullin requested review from acid-ant 2023-06-07 09:12:14 +00:00
aarifullin commented 2023-06-07 09:14:28 +00:00
Author
Member
Copy link

@alexvanin . Thanks!
Actually, I used the same way but it seems I've had incorrect local state

@alexvanin . Thanks! Actually, I used the same way but it seems I've had incorrect local state
acid-ant approved these changes 2023-06-07 09:36:33 +00:00
dstepanov-yadro approved these changes 2023-06-07 10:31:56 +00:00
realloc merged commit 189a367ef2 into master 2023-06-07 13:04:21 +00:00
realloc deleted branch feature/390-bearer_tree_srv 2023-06-07 13:04:22 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
alexvanin
acid-ant
dstepanov-yadro
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
badger

Badger DB related issues

  
frostfs-adm

   
frostfs-cli

   
frostfs-ir

   
frostfs-lens

   
frostfs-node

   
good first issue

Good for newcomers

  
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#427
No description provided.
Delete branch "aarifullin/frostfs-node:feature/390-bearer_tree_srv"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?