The BucketAccess model only offered three coarse levels (read-only/read-write/
full) applied to the whole bucket. Real grants often need to be scoped to a key
prefix, limited to a source network or TLS, restricted to specific actions, or
expressed as an arbitrary S3 statement. RGW (Reef 18.2+/Squid) honours the S3
bucket-policy features to do all of this; expose them on BucketAccess while
keeping the level as the ergonomic default.
- add BucketAccess spec fields: paths (key-prefix scoping), actions (action
override), conditions (sourceIPs + secureTransportOnly), rawStatements
(arbitrary S3 statements with the principal injected)
- extend ceph.Grant + BuildBucketPolicy to render prefixed object resources,
custom-action statements, S3 condition blocks, and raw statements, keeping
output deterministic (sorted, stable sids)
- translate the new spec fields into grants in the Bucket controller and
fingerprint grants so distinct fine-grained BucketAccess objects no longer
collapse on UID+level alone
- regenerate deepcopy + CRDs; add config/samples/04-access-fine-grained.yaml
- cover paths, action override, conditions, raw statements and determinism in
policy_test.go; document the fields in the README
Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
unkinben
4b0430f0df