TrueCloudLab
/
policy-engine
generated from TrueCloudLab/basic
18
0
Fork 8
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

[#17] iam: Add converter to native policy #17

Merged
fyrchik merged 1 commits from dkirillov/policy-engine:feature/support-iam_to_native_converter into master 2023-11-21 09:05:27 +00:00
Conversation 3 Commits 1 Files Changed 9
dkirillov commented 2023-11-10 14:57:29 +00:00
Collaborator

Signed-off-by: Denis Kirillov d.kirillov@yadro.com

Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>
dkirillov self-assigned this 2023-11-10 14:57:29 +00:00
dkirillov changed title from WIP: [#XX] iam: Add converter to native policy to WIP: [#17] iam: Add converter to native policy 2023-11-10 15:03:29 +00:00
dstepanov-yadro commented 2023-11-14 07:13:24 +00:00
Collaborator

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ?
dkirillov commented 2023-11-14 07:19:50 +00:00
Poster
Collaborator

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Not really, here we want to have converter from IAM (not EACL) policy to native policy

> Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ? Not really, here we want to have converter from IAM (not EACL) policy to native policy
dstepanov-yadro commented 2023-11-14 07:22:32 +00:00
Collaborator

Is this PR duplicate of TrueCloudLab/frostfs-node#800 ?

Not really, here we want to have converter from IAM (not EACL) policy to native policy

Hm, but looks like this will be frostfs-storage - specific, so i think it is better to do in frostfs-node repository.

> > Is this PR duplicate of https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800 ? > > Not really, here we want to have converter from IAM (not EACL) policy to native policy Hm, but looks like this will be `frostfs-storage` - specific, so i think it is better to do in `frostfs-node` repository.
dkirillov force-pushed feature/support-iam_to_native_converter from dfba3eb75b to 3191bab0fc 2023-11-14 12:10:54 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from 3191bab0fc to cec3744f9f 2023-11-14 12:20:51 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from cec3744f9f to e2e53d8f1e 2023-11-14 12:27:22 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from e2e53d8f1e to 6f140f0df8 2023-11-15 12:07:16 +00:00 Compare
dkirillov force-pushed feature/support-iam_to_native_converter from 6f140f0df8 to 9226dc32b9 2023-11-15 12:35:25 +00:00 Compare
dkirillov reviewed 2023-11-15 12:44:19 +00:00
iam/converter_native.go Outdated
@ -0,0 +78,4 @@
},
Condition: append(ruleConditions, conditions...),
}
engineChain.Rules = append(engineChain.Rules, r)
dkirillov commented 2023-11-15 12:44:19 +00:00
Poster
Collaborator

Note: we have to form several rules because of currently conditions can be combined only in one level OR/AND but in iam we have more complex scheme.
Also we need separate conditions for user in different rules to achieve OR behavior. The same for resources.

Explanation:
Consider applying initial policy for resources:

  • bucket1/object1
  • bucket2/*

In case of buket1/object1 resource we form native resource native:object//<bucket1-cid>/* and additional condition: FilePath must equal object1. So if we place both native resources (native:object//<bucket1-cid>/* and native:object//<bucket2-cid>/*) into one rule we will match only requests that operates on object with FilePath: object1 even for bucket2 but we want to apply rule to any object in bucket2

cc @fyrchik

Note: we have to form several rules because of currently conditions can be combined only in one level OR/AND but in iam we have more [complex scheme](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-logic-multiple-context-keys-or-values.html). Also we need separate conditions for user in different rules to achieve OR behavior. The same for resources. Explanation: Consider applying initial policy for resources: * `bucket1/object1` * `bucket2/*` In case of `buket1/object1` resource we form native resource `native:object//<bucket1-cid>/*` and additional condition: `FilePath` must equal `object1`. So if we place both native resources (`native:object//<bucket1-cid>/*` and `native:object//<bucket2-cid>/*`) into one rule we will match only requests that operates on object with `FilePath: object1` even for `bucket2` but we want to apply rule to any object in `bucket2` cc @fyrchik
dkirillov changed title from WIP: [#17] iam: Add converter to native policy to [#17] iam: Add converter to native policy 2023-11-15 12:44:31 +00:00
dkirillov requested review from storage-core-committers 2023-11-15 12:44:40 +00:00
dkirillov requested review from storage-core-developers 2023-11-15 12:44:41 +00:00
dkirillov requested review from storage-services-committers 2023-11-15 12:44:41 +00:00
dkirillov requested review from storage-services-developers 2023-11-15 12:44:41 +00:00
alexvanin approved these changes 2023-11-15 13:43:20 +00:00
iam/policy.go Outdated
@ -223,2 +223,4 @@
func (p Policy) validate() error {
if len(p.Statement) == 0 {
return errors.New("'Statement' missing")
alexvanin commented 2023-11-15 13:40:13 +00:00
Owner

typo: 'Statement' is missing

typo: 'Statement' *is* missing
👀 1
dkirillov force-pushed feature/support-iam_to_native_converter from 9226dc32b9 to 3d8b63ac2a 2023-11-15 13:51:14 +00:00 Compare
dstepanov-yadro reviewed 2023-11-15 15:48:56 +00:00
iam/converter_native.go Outdated
@ -0,0 +30,4 @@
supportedS3ActionListBucket = "ListBucket"
)
//nolint:funlen
dstepanov-yadro commented 2023-11-15 15:48:56 +00:00
Collaborator

:-(

:-(
dkirillov commented 2023-11-16 06:26:18 +00:00
Poster
Collaborator

Whoops. It's not necessary anymore

Whoops. It's not necessary anymore
dstepanov-yadro approved these changes 2023-11-15 15:50:00 +00:00
dkirillov force-pushed feature/support-iam_to_native_converter from 3d8b63ac2a to c9d4d15db6 2023-11-16 06:36:53 +00:00 Compare
fyrchik reviewed 2023-11-21 08:15:28 +00:00
go.mod Outdated
@ -4,2 +4,3 @@
require github.com/stretchr/testify v1.8.1
require (
git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231114081800-3787477133f3
fyrchik commented 2023-11-21 08:15:28 +00:00
Owner

sdk-go could depend on this repo, not the other way around.

`sdk-go` could depend on this repo, not the other way around.
alexvanin commented 2023-11-21 08:22:49 +00:00
Owner

Should we avoid neo-go dependency as well? I think it is possible by making interfaces more abstract and return strings, instead of keys and container ids.

Should we avoid neo-go dependency as well? I think it is possible by making interfaces more abstract and return strings, instead of keys and container ids.
fyrchik commented 2023-11-21 08:24:04 +00:00
Owner

I would avoid if possible, though neo-go couldn't introduce circles, SDK easily can.

I would avoid if possible, though neo-go couldn't introduce circles, SDK easily can.
dkirillov commented 2023-11-21 08:26:39 +00:00
Poster
Collaborator

Ok, I'll fix this

Ok, I'll fix this
fyrchik approved these changes 2023-11-21 08:16:28 +00:00
dkirillov force-pushed feature/support-iam_to_native_converter from c9d4d15db6 to 5fa9d91903 2023-11-21 08:45:58 +00:00 Compare
fyrchik merged commit 5fa9d91903 into master 2023-11-21 09:05:27 +00:00
dkirillov deleted branch feature/support-iam_to_native_converter 2023-11-21 09:06:58 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
alexvanin
dstepanov-yadro
fyrchik
TrueCloudLab/storage-core-developers
TrueCloudLab/storage-services-developers
Labels
Clear labels
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff   
blocked

The issue or PR is blocked by something   
bug

Something is not working   
config

Configuration format update or breaking change   
discussion

Talking about something in order to reach a decision or to exchange ideas   
documentation

Documentation related   
duplicate

This issue or pull request already exists   
enhancement

New feature   
go

Language features adoption   
help wanted

Extra attention is needed   
internal
   
invalid

Something is wrong   
kludge

This is a kludge and we know it   
observability

Related to metrics, tracing and logs   
perfomance

Perfomance related   
question

More information is needed   
refactoring

Refactoring   
wontfix

This won't be fixed
No Label
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
dkirillov
4 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/policy-engine#17
There is no content yet.
Delete Branch "dkirillov/policy-engine:feature/support-iam_to_native_converter"

Deleting a branch is permanent. Although the deleted branch may exist for a short time before cleaning up, in most cases it CANNOT be undone. Continue?