From 9a3ffbaab2425a771f6b2e4c89f7eba9e1deb84a Mon Sep 17 00:00:00 2001 From: Jiffin Tony Thottan Date: Tue, 19 May 2020 18:18:01 +0530 Subject: [PATCH] obc: Do not delete user for retain policy if it is owner When obc is deleted, the attached ceph user will be also removed This will cause obc creation failure for the same bucket since user was missing. With this patch the user will be retained revoking his permissions Also removed 'GetBucketPolicy' permission from Allowed action. The same set of permission is used for denying the owner/old user of OBC. So that in the next obc request for the bucket, owner can set polciy for the new user Closes: https://github.com/rook/rook/issues/5510 Signed-off-by: Jiffin Tony Thottan --- .../ceph/object/bucket/provisioner.go | 22 +++++++++++++++++++ .../ceph/object/bucket/s3-handlers.go | 1 - 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/pkg/operator/ceph/object/bucket/provisioner.go b/pkg/operator/ceph/object/bucket/provisioner.go index e8e9c0eb8..db85a7dcb 100644 --- a/pkg/operator/ceph/object/bucket/provisioner.go +++ b/pkg/operator/ceph/object/bucket/provisioner.go @@ -254,6 +254,28 @@ func (p Provisioner) Revoke(ob *bktv1alpha1.ObjectBucket) error { } } + if bucket.Owner == p.cephUserName { + statement := NewPolicyStatement(). + WithSID(p.cephUserName). + ForPrincipals(p.cephUserName). + ForResources(p.bucketName). + ForSubResources(p.bucketName). + Denies(). + Actions(AllowedActions...) + if policy == nil { + policy = NewBucketPolicy(*statement) + } else { + policy = policy.ModifyBucketPolicy(*statement) + } + out, err := s3svc.PutBucketPolicy(p.bucketName, *policy) + logger.Infof("PutBucketPolicy output: %v", out) + if err != nil { + return errors.Wrap(err, "failed to update policy") + } else { + return nil + } + } + // drop policy if present if policy != nil { policy = policy.DropPolicyStatements(p.cephUserName) diff --git a/pkg/operator/ceph/object/bucket/s3-handlers.go b/pkg/operator/ceph/object/bucket/s3-handlers.go index 86c581040..caf8514ea 100644 --- a/pkg/operator/ceph/object/bucket/s3-handlers.go +++ b/pkg/operator/ceph/object/bucket/s3-handlers.go @@ -184,7 +184,6 @@ var AllowedActions = []action{ GetBucketLocation, GetBucketLogging, GetBucketNotification, - GetBucketPolicy, GetBucketTagging, GetBucketVersioning, GetBucketWebsite,