Support new FrostFS ID contract #260

New issue

Closed

opened 2023-11-01 14:21:56 +00:00 by alexvanin · 1 comment

alexvanin commented

2023-11-01 14:21:56 +00:00

Owner

After TrueCloudLab/frostfs-contract#48 support new FrostFS ID contract in the S3 Gateway. Add new configuration flag (enabled by default), to check if access box key is registered in FrostFS ID contract. Use checks for bucket-related operations and ignore it for object-related operations, because:

objects are belong to user-owned bucket,
objects are controlled by ACL and policies,
objects can be accessed anonymously in S3.

Update authmate with optional flag to register private key in FrostFS ID contract.

~~Fetch namespace from FrostFS ID subject.~~

Edit 1: This approach restricts inter-namespace communication. Such communication is valid, so fetch namespace from the HTTP header which can be set by proxy server for specific namespace. Configure HTTP header key in config file.

Use namespace during bucket resolving:

default root namespace should be converted in .container NNS zone as before,
all non-default namespaces converted to NNS zone directly.

After https://git.frostfs.info/TrueCloudLab/frostfs-contract/issues/48 support new FrostFS ID contract in the S3 Gateway. Add new configuration flag (enabled by default), to check if access box key is registered in FrostFS ID contract. Use checks for bucket-related operations and ignore it for object-related operations, because: 1) objects are belong to user-owned bucket, 2) objects are controlled by ACL and policies, 3) objects can be accessed anonymously in S3. Update authmate with optional flag to register private key in FrostFS ID contract. ~~Fetch namespace from FrostFS ID subject.~~ Edit 1: This approach restricts inter-namespace communication. Such communication is valid, so fetch namespace from the HTTP header which can be set by proxy server for specific namespace. Configure HTTP header key in config file. Use namespace during bucket resolving: 1) default `root` namespace should be converted in `.container` NNS zone as before, 2) all non-default namespaces converted to NNS zone directly.