diff --git a/Documentation/CRDs/Object-Storage/ceph-object-store-user-crd.md b/Documentation/CRDs/Object-Storage/ceph-object-store-user-crd.md index 3cb100f9f..039d2d948 100644 --- a/Documentation/CRDs/Object-Storage/ceph-object-store-user-crd.md +++ b/Documentation/CRDs/Object-Storage/ceph-object-store-user-crd.md @@ -48,3 +48,12 @@ spec: * `usage` * `metadata` * `zone` + * `roles` + * `info` + * `amz-cache` + * `bilog` + * `mdlog` + * `datalog` + * `user-policy` + * `odic-provider` + * `ratelimit` diff --git a/Documentation/CRDs/specification.md b/Documentation/CRDs/specification.md index f9d232b15..7bf51bfb2 100644 --- a/Documentation/CRDs/specification.md +++ b/Documentation/CRDs/specification.md @@ -8467,6 +8467,114 @@ string

Admin capabilities to read/write Ceph object store zones. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + +roles
+ +string + + + +(Optional) +

Admin capabilities to read/write roles for user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +info
+ +string + + + +(Optional) +

Admin capabilities to read/write information about the user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +amz-cache
+ +string + + + +(Optional) +

Add capabilities for user to send request to RGW Cache API header. Documented in https://docs.ceph.com/en/quincy/radosgw/rgw-cache/#cache-api

+ + + + +bilog
+ +string + + + +(Optional) +

Add capabilities for user to change bucket index logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +mdlog
+ +string + + + +(Optional) +

Add capabilities for user to change metadata logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +datalog
+ +string + + + +(Optional) +

Add capabilities for user to change data logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +user-policy
+ +string + + + +(Optional) +

Add capabilities for user to change user policies. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +oidc-provider
+ +string + + + +(Optional) +

Add capabilities for user to change oidc provider. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ + + + +ratelimit
+ +string + + + +(Optional) +

Add capabilities for user to set rate limiter for user and bucket. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities

+ +

ObjectUserQuotaSpec diff --git a/deploy/charts/rook-ceph/templates/resources.yaml b/deploy/charts/rook-ceph/templates/resources.yaml index 6c09a0ce1..9dd1f2812 100644 --- a/deploy/charts/rook-ceph/templates/resources.yaml +++ b/deploy/charts/rook-ceph/templates/resources.yaml @@ -10374,6 +10374,22 @@ spec: description: Additional admin-level capabilities for the Ceph object store user nullable: true properties: + amz-cache: + description: Add capabilities for user to send request to RGW Cache API header. Documented in https://docs.ceph.com/en/quincy/radosgw/rgw-cache/#cache-api + enum: + - '*' + - read + - write + - read, write + type: string + bilog: + description: Add capabilities for user to change bucket index logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string bucket: description: Admin capabilities to read/write Ceph object store buckets. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10382,6 +10398,30 @@ spec: - write - read, write type: string + datalog: + description: Add capabilities for user to change data logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + info: + description: Admin capabilities to read/write information about the user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + mdlog: + description: Add capabilities for user to change metadata logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string metadata: description: Admin capabilities to read/write Ceph object store metadata. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10390,6 +10430,30 @@ spec: - write - read, write type: string + oidc-provider: + description: Add capabilities for user to change oidc provider. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + ratelimit: + description: Add capabilities for user to set rate limiter for user and bucket. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + roles: + description: Admin capabilities to read/write roles for user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string usage: description: Admin capabilities to read/write Ceph object store usage. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10406,6 +10470,14 @@ spec: - write - read, write type: string + user-policy: + description: Add capabilities for user to change user policies. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string zone: description: Admin capabilities to read/write Ceph object store zones. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: diff --git a/deploy/examples/crds.yaml b/deploy/examples/crds.yaml index 0edae70fb..e39e5a12e 100644 --- a/deploy/examples/crds.yaml +++ b/deploy/examples/crds.yaml @@ -10365,6 +10365,22 @@ spec: description: Additional admin-level capabilities for the Ceph object store user nullable: true properties: + amz-cache: + description: Add capabilities for user to send request to RGW Cache API header. Documented in https://docs.ceph.com/en/quincy/radosgw/rgw-cache/#cache-api + enum: + - '*' + - read + - write + - read, write + type: string + bilog: + description: Add capabilities for user to change bucket index logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string bucket: description: Admin capabilities to read/write Ceph object store buckets. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10373,6 +10389,30 @@ spec: - write - read, write type: string + datalog: + description: Add capabilities for user to change data logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + info: + description: Admin capabilities to read/write information about the user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + mdlog: + description: Add capabilities for user to change metadata logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string metadata: description: Admin capabilities to read/write Ceph object store metadata. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10381,6 +10421,30 @@ spec: - write - read, write type: string + oidc-provider: + description: Add capabilities for user to change oidc provider. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + ratelimit: + description: Add capabilities for user to set rate limiter for user and bucket. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string + roles: + description: Admin capabilities to read/write roles for user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string usage: description: Admin capabilities to read/write Ceph object store usage. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: @@ -10397,6 +10461,14 @@ spec: - write - read, write type: string + user-policy: + description: Add capabilities for user to change user policies. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + enum: + - '*' + - read + - write + - read, write + type: string zone: description: Admin capabilities to read/write Ceph object store zones. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities enum: diff --git a/pkg/apis/ceph.rook.io/v1/types.go b/pkg/apis/ceph.rook.io/v1/types.go index cf2a5e95f..62c4ed3e8 100755 --- a/pkg/apis/ceph.rook.io/v1/types.go +++ b/pkg/apis/ceph.rook.io/v1/types.go @@ -1600,6 +1600,42 @@ type ObjectUserCapSpec struct { // +kubebuilder:validation:Enum={"*","read","write","read, write"} // Admin capabilities to read/write Ceph object store zones. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities Zone string `json:"zone,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Admin capabilities to read/write roles for user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + Roles string `json:"roles,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Admin capabilities to read/write information about the user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + Info string `json:"info,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to send request to RGW Cache API header. Documented in https://docs.ceph.com/en/quincy/radosgw/rgw-cache/#cache-api + AMZCache string `json:"amz-cache,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to change bucket index logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + BiLog string `json:"bilog,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to change metadata logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + MdLog string `json:"mdlog,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to change data logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + DataLog string `json:"datalog,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to change user policies. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + UserPolicy string `json:"user-policy,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to change oidc provider. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + OidcProvider string `json:"oidc-provider,omitempty"` + // +optional + // +kubebuilder:validation:Enum={"*","read","write","read, write"} + // Add capabilities for user to set rate limiter for user and bucket. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities + RateLimit string `json:"ratelimit,omitempty"` } // ObjectUserQuotaSpec can be used to set quotas for the object store user to limit their usage. See the [Ceph docs](https://docs.ceph.com/en/latest/radosgw/admin/?#quota-management) for more diff --git a/pkg/operator/ceph/object/user/controller.go b/pkg/operator/ceph/object/user/controller.go index 352162f4c..3319ea1ab 100644 --- a/pkg/operator/ceph/object/user/controller.go +++ b/pkg/operator/ceph/object/user/controller.go @@ -434,6 +434,33 @@ func generateUserConfig(user *cephv1.CephObjectStoreUser) admin.User { if user.Spec.Capabilities.Zone != "" { userConfig.UserCaps += fmt.Sprintf("zone=%s;", user.Spec.Capabilities.Zone) } + if user.Spec.Capabilities.Roles != "" { + userConfig.UserCaps += fmt.Sprintf("roles=%s;", user.Spec.Capabilities.Roles) + } + if user.Spec.Capabilities.AMZCache != "" { + userConfig.UserCaps += fmt.Sprintf("amz-cache=%s;", user.Spec.Capabilities.AMZCache) + } + if user.Spec.Capabilities.BiLog != "" { + userConfig.UserCaps += fmt.Sprintf("bilog=%s;", user.Spec.Capabilities.BiLog) + } + if user.Spec.Capabilities.Info != "" { + userConfig.UserCaps += fmt.Sprintf("info=%s;", user.Spec.Capabilities.Info) + } + if user.Spec.Capabilities.MdLog != "" { + userConfig.UserCaps += fmt.Sprintf("mdlog=%s;", user.Spec.Capabilities.MdLog) + } + if user.Spec.Capabilities.DataLog != "" { + userConfig.UserCaps += fmt.Sprintf("datalog=%s;", user.Spec.Capabilities.DataLog) + } + if user.Spec.Capabilities.UserPolicy != "" { + userConfig.UserCaps += fmt.Sprintf("user-policy=%s;", user.Spec.Capabilities.UserPolicy) + } + if user.Spec.Capabilities.OidcProvider != "" { + userConfig.UserCaps += fmt.Sprintf("oidc-provider=%s;", user.Spec.Capabilities.OidcProvider) + } + if user.Spec.Capabilities.RateLimit != "" { + userConfig.UserCaps += fmt.Sprintf("ratelimit=%s;", user.Spec.Capabilities.RateLimit) + } } return userConfig diff --git a/pkg/operator/ceph/object/user/controller_test.go b/pkg/operator/ceph/object/user/controller_test.go index c27df6bfb..0cfd4df6f 100644 --- a/pkg/operator/ceph/object/user/controller_test.go +++ b/pkg/operator/ceph/object/user/controller_test.go @@ -412,7 +412,7 @@ func TestCreateOrUpdateCephUser(t *testing.T) { StatusCode: 200, Body: io.NopCloser(bytes.NewReader([]byte(userCreateJSON))), }, nil - } else if req.URL.RawQuery == "caps=&format=json&uid=my-user&user-caps=users%3Dread%3Bbuckets%3Dread%3B" { + } else if req.URL.RawQuery == "caps=&format=json&uid=my-user&user-caps=users%3Dread%3Bbuckets%3Dwrite%3Broles%3D%2A%3Binfo%3Dread%2C%20write%3B" { return &http.Response{ StatusCode: 200, Body: io.NopCloser(bytes.NewReader([]byte(userCapsJSON))), @@ -461,7 +461,9 @@ func TestCreateOrUpdateCephUser(t *testing.T) { objectUser.Spec.Quotas = nil objectUser.Spec.Capabilities = &cephv1.ObjectUserCapSpec{ User: "read", - Bucket: "read", + Bucket: "write", + Roles: "*", + Info: "read, write", } userConfig = generateUserConfig(objectUser) r.userConfig = &userConfig @@ -510,7 +512,9 @@ func TestCreateOrUpdateCephUser(t *testing.T) { t.Run("setting both Quotas and Capabilities for the user", func(t *testing.T) { objectUser.Spec.Capabilities = &cephv1.ObjectUserCapSpec{ User: "read", - Bucket: "read", + Bucket: "write", + Roles: "*", + Info: "read, write", } objectUser.Spec.Quotas = &cephv1.ObjectUserQuotaSpec{MaxBuckets: &maxbucket, MaxObjects: &maxobject, MaxSize: &maxsize} userConfig = generateUserConfig(objectUser)