obc: Do not delete user for retain policy if it is owner

When obc is deleted, the attached ceph user will be also removed
This will cause obc creation failure for the same bucket since user
was missing. With this patch the user will be retained revoking his permissions

Also removed 'GetBucketPolicy' permission from Allowed action. The same set of
permission is used for denying the owner/old user of OBC. So that in the next
obc request for the bucket, owner can set polciy for the new user

Closes: https://github.com/rook/rook/issues/5510
Signed-off-by: Jiffin Tony Thottan <thottanjiffin@gmail.com>

pkg/operator/ceph/object/bucket/provisioner.go

@@ -254,6 +254,28 @@ func (p Provisioner) Revoke(ob *bktv1alpha1.ObjectBucket) error {
 			}
 		}
 
+		if bucket.Owner == p.cephUserName {
+			statement := NewPolicyStatement().
+				WithSID(p.cephUserName).
+				ForPrincipals(p.cephUserName).
+				ForResources(p.bucketName).
+				ForSubResources(p.bucketName).
+				Denies().
+				Actions(AllowedActions...)
+			if policy == nil {
+				policy = NewBucketPolicy(*statement)
+			} else {
+				policy = policy.ModifyBucketPolicy(*statement)
+			}
+			out, err := s3svc.PutBucketPolicy(p.bucketName, *policy)
+			logger.Infof("PutBucketPolicy output: %v", out)
+			if err != nil {
+				return errors.Wrap(err, "failed to update policy")
+			} else {
+				return nil
+			}
+		}
+
 		// drop policy if present
 		if policy != nil {
 			policy = policy.DropPolicyStatements(p.cephUserName)

pkg/operator/ceph/object/bucket/s3-handlers.go

@@ -184,7 +184,6 @@ var AllowedActions = []action{
 	GetBucketLocation,
 	GetBucketLogging,
 	GetBucketNotification,
-	GetBucketPolicy,
 	GetBucketTagging,
 	GetBucketVersioning,
 	GetBucketWebsite,