Support credentials update with GSet scheme #135

New Issue

Closed

opened 2023-06-09 14:43:36 +00:00 by alexvanin · 1 comment

alexvanin commented

2023-06-09 14:43:36 +00:00

Owner

Accessbox is an object that contains bearer tokens signed for specific gateway keys. Address of accessbox object (cid/oid) is used as access key id for S3 credentials. There is a case when storage network is expanded with new S3 gateways. New S3 gateways can't use existing accessboxes because they don't contain suitable bearer tokens. The only way to handle this case is to issue new tokens.

Describe the solution you'd like

Use 2PSet object versioning scheme for accessbox objects.

S3 Gateway:

Searches for the latest version of the object with Filename of access key id in the accessbox container.
If no objects found, use access key id as direct address for accessbox.

S3 Authmate:

Support issuing secrets with 2PSet headers based on existing accessbox

Describe alternatives you've considered

Tree service looks like a suitable place for accessbox versions, but there are some concerns on tree service data restore after the loss. So tree service isn't preferable option here.

Additional context

It takes about 5-6 seconds to find latest version of the accessbox out of 1000 versions with 2PSet. Seems okay for now.

## Is your feature request related to a problem? Please describe. Accessbox is an object that contains bearer tokens signed for specific gateway keys. Address of accessbox object (cid/oid) is used as access key id for S3 credentials. There is a case when storage network is expanded with new S3 gateways. New S3 gateways can't use existing accessboxes because they don't contain suitable bearer tokens. The only way to handle this case is to issue new tokens. ## Describe the solution you'd like Use 2PSet object versioning scheme for accessbox objects. S3 Gateway: 1. Searches for the latest version of the object with `Filename` of access key id in the accessbox container. 2. If no objects found, use access key id as direct address for accessbox. S3 Authmate: 1. Support issuing secrets with 2PSet headers based on existing accessbox ## Describe alternatives you've considered Tree service looks like a suitable place for accessbox versions, but there are some concerns on tree service data restore after the loss. So tree service isn't preferable option here. ## Additional context It takes about 5-6 seconds to find latest version of the accessbox out of 1000 versions with 2PSet. Seems okay for now.