TrueCloudLab/frostfs-node
21
1
Fork 27
Code Issues 107 Pull requests 5 Projects Releases 2 Activity Actions

cli: Add support for container in local rules #921

Merged
fyrchik merged 3 commits from acid-ant/frostfs-node:feature/876-cli-policy into master 2024-09-04 19:51:05 +00:00
Conversation 0 Commits 3 Files changed 7 +467 -120
acid-ant commented 2024-01-22 10:44:12 +00:00
Member
Copy link

Closes #876, #846

Blocked by TrueCloudLab/policy-engine#44

Extend existing implementation to support for namespaces in rule for object and container.
Print chain in human-readable format.

Signed-off-by: Anton Nikiforov an.nikiforov@yadro.com

Closes #876, #846 Blocked by https://git.frostfs.info/TrueCloudLab/policy-engine/pulls/44 Extend existing implementation to support for namespaces in rule for `object` and `container`. Print `chain` in human-readable format. Signed-off-by: Anton Nikiforov <an.nikiforov@yadro.com>
acid-ant requested review from storage-core-committers 2024-01-22 10:44:25 +00:00
acid-ant requested review from storage-core-developers 2024-01-22 10:44:25 +00:00
acid-ant requested review from dkirillov 2024-01-22 10:44:39 +00:00
acid-ant force-pushed feature/876-cli-policy from 4af0866a65 to 016ddd148b 2024-01-23 07:21:57 +00:00 Compare
acid-ant force-pushed feature/876-cli-policy from 016ddd148b to bb64aaa38d 2024-01-23 07:26:20 +00:00 Compare
dstepanov-yadro reviewed 2024-01-23 07:32:03 +00:00
cmd/frostfs-cli/modules/control/add_rule.go Outdated
@ -31,0 +27,4 @@
--rule "deny Object.Get EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr/*"
--rule "deny:QuotaLimitReached Object.Put Object.Resource:Department=HR *"
More details can be found here https://git.frostfs.info/TrueCloudLab/frostfs-node/src/branch/master/cmd/frostfs-cli/docs/policy.md
dstepanov-yadro commented 2024-01-23 07:32:02 +00:00
Member
Copy link

I think it is better to drop link from example: in case of docs autogenerating, it will be strange to have external link

I think it is better to drop link from example: in case of docs autogenerating, it will be strange to have external link
acid-ant commented 2024-01-23 07:35:21 +00:00
Author
Member
Copy link

Agree, removed.

Agree, removed.
dstepanov-yadro marked this conversation as resolved
acid-ant force-pushed feature/876-cli-policy from bb64aaa38d to bd7a7bb5e0 2024-01-23 07:32:08 +00:00 Compare
acid-ant force-pushed feature/876-cli-policy from bd7a7bb5e0 to ec1395fbec 2024-01-23 07:35:13 +00:00 Compare
dstepanov-yadro reviewed 2024-01-23 07:39:18 +00:00
cmd/frostfs-cli/modules/util/ape.go Outdated
@ -105,0 +111,4 @@
if err != nil {
condition, errCond := parseCondition(lexeme)
if errCond != nil {
err = fmt.Errorf("%w:%w", err, errCond)
dstepanov-yadro commented 2024-01-23 07:39:18 +00:00
Member
Copy link

Looks like err can be not nil but not returned. Is it ok?

Looks like `err` can be not nil but not returned. Is it ok?
acid-ant commented 2024-01-23 08:23:55 +00:00
Author
Member
Copy link

In the rule, it is possible to mix actions and conditions, but resources should be always at the end of the rule. The same is for status - rule should always start with it. So when lexeme neither action, neither condition - it is resource. If it is not a resource - error will contain all parsing errors.

In the `rule`, it is possible to mix `actions` and `conditions`, but `resources` should be always at the end of the `rule`. The same is for `status` - `rule` should always start with it. So when `lexeme` neither `action`, neither `condition` - it is `resource`. If it is not a `resource` - error will contain all parsing errors.
dstepanov-yadro approved these changes 2024-01-23 07:45:00 +00:00
dstepanov-yadro approved these changes 2024-01-23 07:45:56 +00:00
acid-ant force-pushed feature/876-cli-policy from ec1395fbec to f01c7fc902 2024-01-25 08:30:28 +00:00 Compare
aarifullin reviewed 2024-01-25 15:47:07 +00:00
cmd/frostfs-cli/modules/util/ape.go Outdated
@ -105,0 +115,4 @@
lexemes = lexemes[i+1:]
break
}
if condition.Object == apechain.ObjectResource || condition.Object == apechain.ObjectRequest {
aarifullin commented 2024-01-25 15:47:07 +00:00
Member
Copy link

Just :)

actionType  = condition.Object == apechain.ObjectResource || condition.Object == apechain.ObjectRequest
Just :) ```go actionType = condition.Object == apechain.ObjectResource || condition.Object == apechain.ObjectRequest ```
acid-ant commented 2024-01-25 17:27:16 +00:00
Author
Member
Copy link

OMG! Shame on me! Fixed.

OMG! Shame on me! Fixed.
aarifullin approved these changes 2024-01-25 16:02:10 +00:00
acid-ant force-pushed feature/876-cli-policy from f01c7fc902 to 8f65c503de 2024-01-25 17:26:05 +00:00 Compare
acid-ant force-pushed feature/876-cli-policy from 8f65c503de to 417f8fc2c2 2024-01-25 17:26:25 +00:00 Compare
fyrchik approved these changes 2024-01-26 06:54:01 +00:00
cmd/frostfs-cli/docs/policy.md
@ -0,0 +36,4 @@
## Add rule
Local rule can be added with the command `frostfs-cli control add-rule`:
```shell
@:~$ frostfs-cli control add-rule --endpoint s04.frostfs.devenv:8081 -c cnt_create_cfg.yml \
fyrchik commented 2024-01-26 06:50:56 +00:00
Owner
Copy link

What is the meaning of @:~$, is it some macro?

What is the meaning of `@:~$`, is it some macro?
aarifullin commented 2024-01-26 07:15:39 +00:00
Member
Copy link

Means cosole input like user@USER-123:~$

Means cosole input like `user@USER-123:~$`
fyrchik marked this conversation as resolved
aarifullin approved these changes 2024-01-26 07:13:28 +00:00
fyrchik merged commit 417f8fc2c2 into master 2024-01-26 07:56:58 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
dkirillov
dstepanov-yadro
fyrchik
aarifullin
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
badger

Badger DB related issues

  
frostfs-adm

   
frostfs-cli

   
frostfs-ir

   
frostfs-lens

   
frostfs-node

   
good first issue

Good for newcomers

  
triage
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
badger
frostfs-adm
frostfs-cli
frostfs-ir
frostfs-lens
frostfs-node
good first issue
triage
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-node#921
No description provided.
Delete branch "acid-ant/frostfs-node:feature/876-cli-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?