unkinben
4b0430f0df
The BucketAccess model only offered three coarse levels (read-only/read-write/ full) applied to the whole bucket. Real grants often need to be scoped to a key prefix, limited to a source network or TLS, restricted to specific actions, or expressed as an arbitrary S3 statement. RGW (Reef 18.2+/Squid) honours the S3 bucket-policy features to do all of this; expose them on BucketAccess while keeping the level as the ergonomic default. - add BucketAccess spec fields: paths (key-prefix scoping), actions (action override), conditions (sourceIPs + secureTransportOnly), rawStatements (arbitrary S3 statements with the principal injected) - extend ceph.Grant + BuildBucketPolicy to render prefixed object resources, custom-action statements, S3 condition blocks, and raw statements, keeping output deterministic (sorted, stable sids) - translate the new spec fields into grants in the Bucket controller and fingerprint grants so distinct fine-grained BucketAccess objects no longer collapse on UID+level alone - regenerate deepcopy + CRDs; add config/samples/04-access-fine-grained.yaml - cover paths, action override, conditions, raw statements and determinism in policy_test.go; document the fields in the README Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
79 lines
2.1 KiB
YAML
79 lines
2.1 KiB
YAML
# Fine-grained grants. Each of these refines the coarse read-only/read-write/full
|
|
# levels with prefix scoping, action overrides, conditions, or raw statements.
|
|
|
|
# 1. Prefix-scoped read-write: this workload may read/write objects only under
|
|
# the "uploads/" and "tmp/" key prefixes (bucket-level ListBucket still spans
|
|
# the whole bucket).
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: BucketAccess
|
|
metadata:
|
|
name: app-data-uploader
|
|
namespace: default
|
|
spec:
|
|
bucketRef: app-data
|
|
level: read-write
|
|
secretName: app-data-uploader-rgw
|
|
paths:
|
|
- uploads/
|
|
- tmp/
|
|
---
|
|
# 2. Read-only from inside the cluster only: restrict the grant to a source CIDR
|
|
# and require TLS.
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: BucketAccess
|
|
metadata:
|
|
name: app-data-internal-ro
|
|
namespace: default
|
|
spec:
|
|
bucketRef: app-data
|
|
level: read-only
|
|
secretName: app-data-internal-ro-rgw
|
|
conditions:
|
|
sourceIPs:
|
|
- 10.0.0.0/8
|
|
secureTransportOnly: true
|
|
---
|
|
# 3. Explicit action set: grant exactly these actions instead of a level's
|
|
# canned set (level is still required but its actions are ignored).
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: BucketAccess
|
|
metadata:
|
|
name: app-data-getput
|
|
namespace: default
|
|
spec:
|
|
bucketRef: app-data
|
|
level: read-only
|
|
secretName: app-data-getput-rgw
|
|
actions:
|
|
- s3:GetObject
|
|
- s3:PutObject
|
|
---
|
|
# 4. Raw statements escape hatch: full control over the policy statement. Level,
|
|
# actions, paths and conditions are ignored; the operator only injects the
|
|
# Principal (this grant's user). Resources without an "arn:" prefix are
|
|
# treated as bucket-relative key prefixes.
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: BucketAccess
|
|
metadata:
|
|
name: app-data-raw
|
|
namespace: default
|
|
spec:
|
|
bucketRef: app-data
|
|
level: read-only
|
|
secretName: app-data-raw-rgw
|
|
rawStatements:
|
|
- effect: Allow
|
|
actions:
|
|
- s3:GetObject
|
|
resources:
|
|
- public/
|
|
- effect: Deny
|
|
actions:
|
|
- s3:DeleteObject
|
|
resources:
|
|
- locked/
|
|
conditions:
|
|
Bool:
|
|
aws:SecureTransport:
|
|
- "false"
|