TrueCloudLab/frostfs-s3-gw
17
3
Fork 19
Code Issues 28 Pull requests 7 Projects Releases 17 Packages Activity Actions

[#357] Add check of request and resource tags #357

Merged
alexvanin merged 1 commit from mbiryukova/frostfs-s3-gw:feature/tags_to_policy_check into master 2024-04-17 07:07:00 +00:00
Conversation 0 Commits 1 Files changed 24 +506 -155
mbiryukova commented 2024-04-10 07:47:42 +00:00
Member
Copy link

Signed-off-by: Marina Biryukova m.biryukova@yadro.com

Signed-off-by: Marina Biryukova <m.biryukova@yadro.com>
mbiryukova self-assigned this 2024-04-10 07:47:42 +00:00
mbiryukova force-pushed feature/tags_to_policy_check from 84e123a0fb to 1c84cf5ae2 2024-04-10 07:48:14 +00:00 Compare
mbiryukova changed title from [#xxx] Add check of request and resource tags to [#357] Add check of request and resource tags 2024-04-10 07:48:41 +00:00
mbiryukova requested review from storage-services-committers 2024-04-10 08:01:19 +00:00
mbiryukova requested review from storage-services-developers 2024-04-10 08:01:19 +00:00
mbiryukova force-pushed feature/tags_to_policy_check from 1c84cf5ae2 to 0fe50f000d 2024-04-10 08:31:41 +00:00 Compare
mbiryukova force-pushed feature/tags_to_policy_check from 0fe50f000d to 780c329cab 2024-04-10 09:27:35 +00:00 Compare
mbiryukova force-pushed feature/tags_to_policy_check from 780c329cab to 0c47fd4228 2024-04-10 13:25:28 +00:00 Compare
dkirillov reviewed 2024-04-11 06:57:14 +00:00
dkirillov left a comment
Member
Copy link

Looks good

Looks good
api/middleware/policy.go Outdated
@ -30,0 +40,4 @@
CompleteMultipartUploadOperation,
UploadPartOperation,
UploadPartCopyOperation,
ListPartsOperation,
dkirillov commented 2024-04-11 06:39:42 +00:00
Member
Copy link

Can aws restrict uploadPart/listingParts by resource attribute (that was added during create multipart upload)?

Can aws restrict uploadPart/listingParts by resource attribute (that was added during create multipart upload)?
mbiryukova commented 2024-04-11 10:43:08 +00:00
Author
Member
Copy link

It seems not

It seems not
👍 1
dkirillov marked this conversation as resolved
api/middleware/policy.go Outdated
@ -39,0 +59,4 @@
}
type ResourceTagging interface {
GetBucketInfo(ctx context.Context, name string) (*data.BucketInfo, error)
dkirillov commented 2024-04-11 06:43:50 +00:00
Member
Copy link

This duplicates PolicyConfig.BucketResolver.

This duplicates `PolicyConfig.BucketResolver`.
dkirillov marked this conversation as resolved
api/middleware/policy.go Outdated
@ -54,6 +84,7 @@ func PolicyCheck(cfg PolicyConfig) Func {
ctx := r.Context()
if err := policyCheck(r, cfg); err != nil {
reqLogOrDefault(ctx, cfg.Log).Error(logs.PolicyValidationFailed, zap.Error(err))
err = frostfsErrors.UnwrapErr(err)
dkirillov commented 2024-04-11 06:38:42 +00:00
Member
Copy link

Why do we need this?

Why do we need this?
mbiryukova commented 2024-04-11 08:41:00 +00:00
Author
Member
Copy link

Without this we will return InternalError if requesting tags of non-existent bucket or object, instead of NoSuchBucket or NoSuchKey

Without this we will return `InternalError` if requesting tags of non-existent bucket or object, instead of `NoSuchBucket` or `NoSuchKey`
dkirillov commented 2024-04-11 09:13:59 +00:00
Member
Copy link

Can we add test for such case then? For now If I remove this line tests still pass

Can we add test for such case then? For now If I remove this line tests still pass
dkirillov marked this conversation as resolved
api/middleware/policy.go Outdated
@ -68,3 +99,3 @@
func policyCheck(r *http.Request, cfg PolicyConfig) error {
reqType, bktName, objName := getBucketObject(r, cfg.Domains)
req, err := getPolicyRequest(r, cfg.FrostfsID, reqType, bktName, objName, cfg.Log)
req, err := getPolicyRequest(r, cfg.FrostfsID, cfg.Decoder, cfg.Tagging, reqType, bktName, objName, cfg.Log)
dkirillov commented 2024-04-11 06:45:22 +00:00
Member
Copy link

It seems we can pass whole cfg param

It seems we can pass whole `cfg` param
dkirillov marked this conversation as resolved
mbiryukova force-pushed feature/tags_to_policy_check from 0c47fd4228 to 3b76446d72 2024-04-11 11:06:29 +00:00 Compare
dkirillov approved these changes 2024-04-12 06:29:34 +00:00
ironbee approved these changes 2024-04-16 14:07:16 +00:00
alexvanin approved these changes 2024-04-17 07:06:53 +00:00
alexvanin merged commit 3ff027587c into master 2024-04-17 07:07:00 +00:00
alexvanin deleted branch feature/tags_to_policy_check 2024-04-17 07:07:01 +00:00
alexvanin added this to the v0.30.0 milestone 2024-05-27 11:14:12 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
dkirillov
ironbee
alexvanin
Labels
Clear labels   
P0

Highest

  
P1

High

  
P2

Medium

  
P3

Low

  
good first issue

Good for newcomers

  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
P0
P1
P2
P3
good first issue
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
v0.30.0
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
mbiryukova
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-s3-gw#357
No description provided.
Delete branch "mbiryukova/frostfs-s3-gw:feature/tags_to_policy_check"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?