TrueCloudLab/policy-engine
20
0
Fork 11
generated from TrueCloudLab/basic
Code Issues 5 Pull requests 1 Projects Releases Packages Wiki Activity Actions

[#17] iam: Add converter to native policy #17

Merged
fyrchik merged 1 commit from dkirillov/policy-engine:feature/support-iam_to_native_converter into master 2023-11-21 09:05:27 +00:00
Conversation 3 Commits 1 Files changed 9 +1648 -346
dkirillov commented 2023-11-10 14:57:29 +00:00
Member
Copy link

Signed-off-by: Denis Kirillov d.kirillov@yadro.com

Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>
dkirillov self-assigned this 2023-11-10 14:57:29 +00:00
dkirillov changed title from WIP: [#XX] iam: Add converter to native policy to WIP: [#17] iam: Add converter to native policy 2023-11-10 15:03:29 +00:00
dstepanov-yadro commented 2023-11-14 07:13:24 +00:00
Member
Copy link

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ?
dkirillov commented 2023-11-14 07:19:50 +00:00
Author
Member
Copy link

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Not really, here we want to have converter from IAM (not EACL) policy to native policy

> Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ? Not really, here we want to have converter from IAM (not EACL) policy to native policy
dstepanov-yadro commented 2023-11-14 07:22:32 +00:00
Member
Copy link

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Not really, here we want to have converter from IAM (not EACL) policy to native policy

Hm, but looks like this will be frostfs-storage - specific, so i think it is better to do in frostfs-node repository.

> > Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ? > > Not really, here we want to have converter from IAM (not EACL) policy to native policy Hm, but looks like this will be `frostfs-storage` - specific, so i think it is better to do in `frostfs-node` repository.
dkirillov force-pushed feature/support-iam_to_native_converter from dfba3eb75b to 3191bab0fc 2023-11-14 12:10:54 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from 3191bab0fc to cec3744f9f 2023-11-14 12:20:51 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from cec3744f9f to e2e53d8f1e 2023-11-14 12:27:22 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from e2e53d8f1e to 6f140f0df8 2023-11-15 12:07:16 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from 6f140f0df8 to 9226dc32b9 2023-11-15 12:35:25 +00:00 Compare
dkirillov reviewed 2023-11-15 12:44:19 +00:00
iam/converter_native.go Outdated
@ -0,0 +78,4 @@
},
Condition: append(ruleConditions, conditions...),
}
engineChain.Rules = append(engineChain.Rules, r)
dkirillov commented 2023-11-15 12:44:19 +00:00
Author
Member
Copy link

Note: we have to form several rules because of currently conditions can be combined only in one level OR/AND but in iam we have more complex scheme.
Also we need separate conditions for user in different rules to achieve OR behavior. The same for resources.

Explanation:
Consider applying initial policy for resources:

  • bucket1/object1
  • bucket2/*

In case of buket1/object1 resource we form native resource native:object//<bucket1-cid>/* and additional condition: FilePath must equal object1. So if we place both native resources (native:object//<bucket1-cid>/* and native:object//<bucket2-cid>/*) into one rule we will match only requests that operates on object with FilePath: object1 even for bucket2 but we want to apply rule to any object in bucket2

cc @fyrchik

Note: we have to form several rules because of currently conditions can be combined only in one level OR/AND but in iam we have more [complex scheme](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-logic-multiple-context-keys-or-values.html). Also we need separate conditions for user in different rules to achieve OR behavior. The same for resources. Explanation: Consider applying initial policy for resources: * `bucket1/object1` * `bucket2/*` In case of `buket1/object1` resource we form native resource `native:object//<bucket1-cid>/*` and additional condition: `FilePath` must equal `object1`. So if we place both native resources (`native:object//<bucket1-cid>/*` and `native:object//<bucket2-cid>/*`) into one rule we will match only requests that operates on object with `FilePath: object1` even for `bucket2` but we want to apply rule to any object in `bucket2` cc @fyrchik
dkirillov changed title from WIP: [#17] iam: Add converter to native policy to [#17] iam: Add converter to native policy 2023-11-15 12:44:31 +00:00
dkirillov requested review from storage-core-committers 2023-11-15 12:44:40 +00:00
dkirillov requested review from storage-core-developers 2023-11-15 12:44:41 +00:00
dkirillov requested review from storage-services-committers 2023-11-15 12:44:41 +00:00
dkirillov requested review from storage-services-developers 2023-11-15 12:44:41 +00:00
alexvanin approved these changes 2023-11-15 13:43:20 +00:00
iam/policy.go Outdated
@ -223,2 +223,4 @@
func (p Policy) validate() error {
if len(p.Statement) == 0 {
return errors.New("'Statement' missing")
alexvanin commented 2023-11-15 13:40:13 +00:00
Owner
Copy link

typo: 'Statement' is missing

typo: 'Statement' *is* missing
👀 1
dkirillov force-pushed feature/support-iam_to_native_converter from 9226dc32b9 to 3d8b63ac2a 2023-11-15 13:51:14 +00:00 Compare
dstepanov-yadro reviewed 2023-11-15 15:48:56 +00:00
iam/converter_native.go Outdated
@ -0,0 +30,4 @@
supportedS3ActionListBucket = "ListBucket"
)
//nolint:funlen
dstepanov-yadro commented 2023-11-15 15:48:56 +00:00
Member
Copy link

:-(

:-(
dkirillov commented 2023-11-16 06:26:18 +00:00
Author
Member
Copy link

Whoops. It's not necessary anymore

Whoops. It's not necessary anymore
dstepanov-yadro approved these changes 2023-11-15 15:50:00 +00:00
dkirillov force-pushed feature/support-iam_to_native_converter from 3d8b63ac2a to c9d4d15db6 2023-11-16 06:36:53 +00:00 Compare
fyrchik reviewed 2023-11-21 08:15:28 +00:00
go.mod Outdated
@ -4,2 +4,3 @@
require github.com/stretchr/testify v1.8.1
require (
git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231114081800-3787477133f3
fyrchik commented 2023-11-21 08:15:28 +00:00
Owner
Copy link

sdk-go could depend on this repo, not the other way around.

`sdk-go` could depend on this repo, not the other way around.
alexvanin commented 2023-11-21 08:22:49 +00:00
Owner
Copy link

Should we avoid neo-go dependency as well? I think it is possible by making interfaces more abstract and return strings, instead of keys and container ids.

Should we avoid neo-go dependency as well? I think it is possible by making interfaces more abstract and return strings, instead of keys and container ids.
fyrchik commented 2023-11-21 08:24:04 +00:00
Owner
Copy link

I would avoid if possible, though neo-go couldn't introduce circles, SDK easily can.

I would avoid if possible, though neo-go couldn't introduce circles, SDK easily can.
dkirillov commented 2023-11-21 08:26:39 +00:00
Author
Member
Copy link

Ok, I'll fix this

Ok, I'll fix this
fyrchik approved these changes 2023-11-21 08:16:28 +00:00
dkirillov force-pushed feature/support-iam_to_native_converter from c9d4d15db6 to 5fa9d91903 2023-11-21 08:45:58 +00:00 Compare
fyrchik merged commit 5fa9d91903 into master 2023-11-21 09:05:27 +00:00
dkirillov deleted branch feature/support-iam_to_native_converter 2023-11-21 09:06:58 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
alexvanin
dstepanov-yadro
fyrchik
TrueCloudLab/storage-core-developers
TrueCloudLab/storage-services-developers
Labels
Clear labels
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
dkirillov
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/policy-engine#17
No description provided.
Delete branch "dkirillov/policy-engine:feature/support-iam_to_native_converter"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?