Add fine-grained bucket access: paths, actions, conditions, raw #4

2026-07-24T22:49:44+10:00

unkinben commented

2026-07-24 22:49:44 +10:00

Why

BucketAccess only offered three coarse levels (read-only / read-write / full) applied to the whole bucket. Real grants often need to be scoped to a key prefix, limited to a source network or TLS, restricted to specific S3 actions, or expressed as an arbitrary statement. RGW (Reef 18.2+ / Squid) honours the S3 bucket-policy features to do all of this, so this exposes them on BucketAccess while keeping level as the ergonomic default.

Builds on #3 (the go-ceph/radosgw rebuild, now merged).

Changes

add BucketAccess spec fields:
- paths — scope object access to key prefixes (<bucket>/<prefix>*)
- actions — grant exactly these S3 actions instead of the level's set
- conditions — sourceIPs (aws:SourceIp allowlist) + secureTransportOnly (aws:SecureTransport)
- rawStatements — arbitrary S3 statements (effect/actions/resources/conditions) with the Principal injected
extend ceph.Grant + BuildBucketPolicy to render prefixed object resources, custom-action statements, condition blocks and raw statements, all deterministic (sorted, stable sids)
translate the new spec fields into grants in the Bucket controller and fingerprint grants so distinct fine-grained BucketAccess objects no longer collapse on UID+level alone
regenerate deepcopy + CRDs; add config/samples/04-access-fine-grained.yaml
cover paths / action override / conditions / raw / determinism in policy_test.go; document the fields in the README

Notes

When rawStatements is set, level/actions/paths/conditions are ignored for that grant; raw resources without an arn: prefix are treated as bucket-relative key prefixes.
RGW's condition-key support is a subset of AWS — validate exotic conditions against the cluster.

Verification

gofmt, go vet, go build ./..., go test -race ./... pass; CGO_ENABLED=0 binary builds; CRDs regenerated with controller-gen v0.17.3.

https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

## Why `BucketAccess` only offered three coarse levels (`read-only` / `read-write` / `full`) applied to the **whole bucket**. Real grants often need to be scoped to a key prefix, limited to a source network or TLS, restricted to specific S3 actions, or expressed as an arbitrary statement. RGW (Reef 18.2+ / Squid) honours the S3 bucket-policy features to do all of this, so this exposes them on `BucketAccess` while keeping `level` as the ergonomic default. Builds on #3 (the go-ceph/radosgw rebuild, now merged). ## Changes - add `BucketAccess` spec fields: - `paths` — scope object access to key prefixes (`<bucket>/<prefix>*`) - `actions` — grant exactly these S3 actions instead of the level's set - `conditions` — `sourceIPs` (`aws:SourceIp` allowlist) + `secureTransportOnly` (`aws:SecureTransport`) - `rawStatements` — arbitrary S3 statements (`effect`/`actions`/`resources`/`conditions`) with the Principal injected - extend `ceph.Grant` + `BuildBucketPolicy` to render prefixed object resources, custom-action statements, condition blocks and raw statements, all deterministic (sorted, stable sids) - translate the new spec fields into grants in the Bucket controller and **fingerprint** grants so distinct fine-grained `BucketAccess` objects no longer collapse on `UID+level` alone - regenerate deepcopy + CRDs; add `config/samples/04-access-fine-grained.yaml` - cover paths / action override / conditions / raw / determinism in `policy_test.go`; document the fields in the README ## Notes - When `rawStatements` is set, `level`/`actions`/`paths`/`conditions` are ignored for that grant; raw `resources` without an `arn:` prefix are treated as bucket-relative key prefixes. - RGW's condition-key support is a subset of AWS — validate exotic conditions against the cluster. ## Verification `gofmt`, `go vet`, `go build ./...`, `go test -race ./...` pass; `CGO_ENABLED=0` binary builds; CRDs regenerated with controller-gen v0.17.3. https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

unkinben added 1 commit 2026-07-24 22:49:44 +10:00

Add fine-grained bucket access: paths, actions, conditions, raw

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

4b0430f0df

The BucketAccess model only offered three coarse levels (read-only/read-write/
full) applied to the whole bucket. Real grants often need to be scoped to a key
prefix, limited to a source network or TLS, restricted to specific actions, or
expressed as an arbitrary S3 statement. RGW (Reef 18.2+/Squid) honours the S3
bucket-policy features to do all of this; expose them on BucketAccess while
keeping the level as the ergonomic default.

- add BucketAccess spec fields: paths (key-prefix scoping), actions (action
  override), conditions (sourceIPs + secureTransportOnly), rawStatements
  (arbitrary S3 statements with the principal injected)
- extend ceph.Grant + BuildBucketPolicy to render prefixed object resources,
  custom-action statements, S3 condition blocks, and raw statements, keeping
  output deterministic (sorted, stable sids)
- translate the new spec fields into grants in the Bucket controller and
  fingerprint grants so distinct fine-grained BucketAccess objects no longer
  collapse on UID+level alone
- regenerate deepcopy + CRDs; add config/samples/04-access-fine-grained.yaml
- cover paths, action override, conditions, raw statements and determinism in
  policy_test.go; document the fields in the README

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

benvin merged commit 619aa6751d into main

2026-07-24 23:02:52 +10:00

benvin deleted branch benvin/bucketaccess-fine-grained-policy

2026-07-24 23:02:52 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/cephrgw-operator#4