Add basic support of policy engine #257

New Issue

Closed

opened 2023-11-01 13:14:35 +00:00 by alexvanin · 1 comment

alexvanin commented

2023-11-01 13:14:35 +00:00

Owner

In v0.29.0 S3 gateway should support FrostFS policies by using policy-engine component. In basic version, engine should read local cache of policies and control access to the S3 API operations. To do that, every request produces request context, which is used in the engine.

sequenceDiagram
    participant User
    participant Middleware
    participant Policy Engine
    participant Handler

    User ->> Middleware: Request
    Middleware ->> Middleware: Build request context
    Middleware ->> Policy Engine: Is Allowed
    alt 
    Policy Engine ->> Middleware: Yes
    Middleware ->> Handler: Request
    Handler ->> User: Response
    else 
    Policy Engine ->> Middleware: No
    Middleware ->> User: Not allowed response
    end

In v0.29.0 S3 gateway should support FrostFS policies by using [policy-engine](https://git.frostfs.info/TrueCloudLab/policy-engine) component. In basic version, engine should read local cache of policies and control access to the S3 API operations. To do that, every request produces request context, which is used in the engine. ```mermaid sequenceDiagram participant User participant Middleware participant Policy Engine participant Handler User ->> Middleware: Request Middleware ->> Middleware: Build request context Middleware ->> Policy Engine: Is Allowed alt Policy Engine ->> Middleware: Yes Middleware ->> Handler: Request Handler ->> User: Response else Policy Engine ->> Middleware: No Middleware ->> User: Not allowed response end ```

alexvanin added this to the v0.29.0 milestone 2023-11-01 13:14:35 +00:00

dkirillov was assigned by alexvanin

2023-11-01 13:14:35 +00:00

alexvanin referenced this issue

2023-11-01 13:16:51 +00:00

Define Control API for internal cache of policy engine rules #258

alexvanin referenced this issue

2023-11-02 08:35:17 +00:00

Rework `put-bucket-policy` with FrostFS Policy Engine #261

dkirillov commented

2023-11-07 12:29:25 +00:00

Collaborator

Probably this task is blocked by TrueCloudLab/policy-engine#7 and TrueCloudLab/policy-engine#8 because engine and request interfaces are changing

Probably this task is blocked by https://git.frostfs.info/TrueCloudLab/policy-engine/issues/7 and https://git.frostfs.info/TrueCloudLab/policy-engine/issues/8 because engine and request interfaces are changing

dkirillov referenced a pull request that will close this issue

2023-11-30 08:33:56 +00:00

feature/257-add_policy_checking #272

~~dkirillov referenced this issue 2023-12-06 13:47:52 +00:00~~

[#259] Support contract based policies #276

alexvanin closed this issue

2023-12-06 14:56:29 +00:00

alexvanin referenced this issue from a commit

2023-12-06 14:56:30 +00:00

[#257] Add policy checker

alexvanin referenced this issue from a commit

2023-12-06 14:56:30 +00:00