feat(bucket): add access policy

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
 FROM golang:1.23 as builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -15,6 +15,7 @@
 COPY cmd/main.go cmd/main.go
 COPY api/ api/
 COPY internal/ internal/
+COPY pkg/ pkg/
 
 
 # Build

README.md

@@ -199,7 +199,37 @@ spec:
   quota:
     default: 10000000    
     # override: 20000000
-
+
+  # AccessPolicy to set on the bucket
+  # Default to Private.
+  # The type can be "Public", "Private" or "Custom"
+  # Public, anyone can access in rw without authentication.
+  # Private, only authenticated users with policies can access.
+  # Custom, define a policy to apply.
+  # In the example below, everybody can read, but only authenticated users with policy can write.
+  accessPolicy:
+    type: Custom
+    policyContent: |-
+      {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "AWS": [
+                "*"
+              ]
+            },
+            "Action": [
+              "s3:GetObject"
+            ],
+            "Resource": [
+              "arn:aws:s3:::dummy-bucket/*"
+            ]
+          }
+        ]
+      }
+
   # Optionnal, let empty if you have configured the default s3 else use an existing s3Instance
   s3InstanceRef: "s3-default-instance"
 

api/v1alpha1/bucket_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+	s3model "github.com/InseeFrLab/s3-operator/pkg/s3/model"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -47,6 +48,10 @@ type BucketSpec struct {
 	// Quota to apply to the bucket
 	// +kubebuilder:validation:Required
 	Quota Quota `json:"quota"`
+
+	// AccessPolicy to apply to the bucket
+	// +kubebuilder:validation:Optional
+	AccessPolicy *AccessPolicy `json:"accessPolicy,omitempty"`
 }
 
 // BucketStatus defines the observed state of Bucket
@@ -87,6 +92,18 @@ type Quota struct {
 	Override int64 `json:"override,omitempty"`
 }
 
+type AccessPolicy struct {
+	// type of the AccessPolicy
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Default=Private
+	// +kubebuilder:validation:Enum=Private;Public;Custom
+	Type s3model.BucketAccessPolicyType `json:"type"`
+
+	// Content of the policy (IAM JSON format) for Custom AccessPolicy
+	// +kubebuilder:validation:Optional
+	PolicyContent string `json:"policyContent,omitempty"`
+}
+
 func init() {
 	SchemeBuilder.Register(&Bucket{}, &BucketList{})
 }

cmd/main.go

@@ -33,7 +33,7 @@ import (
 	s3InstanceControllers "github.com/InseeFrLab/s3-operator/internal/controller/s3instance"
 	userControllers "github.com/InseeFrLab/s3-operator/internal/controller/user"
 	"github.com/InseeFrLab/s3-operator/internal/helpers"
-	s3factory "github.com/InseeFrLab/s3-operator/internal/s3/factory/impl"
+	s3factory "github.com/InseeFrLab/s3-operator/pkg/s3/factory/impl"
 
 	"go.uber.org/zap/zapcore"
 	"k8s.io/apimachinery/pkg/runtime"

config/crd/bases/s3.onyxia.sh_buckets.yaml

@@ -39,6 +39,23 @@ spec:
           spec:
             description: BucketSpec defines the desired state of Bucket
             properties:
+              accessPolicy:
+                description: AccessPolicy to apply to the bucket
+                properties:
+                  policyContent:
+                    description: Content of the policy (IAM JSON format) for Custom
+                      AccessPolicy
+                    type: string
+                  type:
+                    description: type of the AccessPolicy
+                    enum:
+                    - Private
+                    - Public
+                    - Custom
+                    type: string
+                required:
+                - type
+                type: object
               name:
                 description: Name of the bucket
                 type: string

deploy/charts/s3-operator/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.0
+version: 0.8.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.12.0"
+appVersion: "v0.13.0"

deploy/charts/s3-operator/templates/crds/buckets.yaml

@@ -6,7 +6,7 @@ metadata:
     {{- if .Values.crds.keep }}
     helm.sh/resource-policy: keep
     {{- end }}
-    controller-gen.kubebuilder.io/version: v0.11.1
+    controller-gen.kubebuilder.io/version: v0.17.1
   labels:
   {{- include "s3-operator.labels" . | nindent 4 }}
   name: buckets.s3.onyxia.sh
@@ -25,20 +25,42 @@ spec:
         description: Bucket is the Schema for the buckets API
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
           spec:
             description: BucketSpec defines the desired state of Bucket
             properties:
+              accessPolicy:
+                description: AccessPolicy to apply to the bucket
+                properties:
+                  policyContent:
+                    description: Content of the policy (IAM JSON format) for Custom
+                      AccessPolicy
+                    type: string
+                  type:
+                    description: type of the AccessPolicy
+                    enum:
+                      - Private
+                      - Public
+                      - Custom
+                    type: string
+                required:
+                  - type
+                type: object
               name:
                 description: Name of the bucket
                 type: string
@@ -80,45 +102,39 @@ spec:
             description: BucketStatus defines the observed state of Bucket
             properties:
               conditions:
-                description: 'Status management using Conditions. See also : https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties'
+                description: |-
+                  Status management using Conditions.
+                  See also : https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
                 items:
-                  description: "Condition contains details for one aspect of the current
-                    state of this API Resource. --- This struct is intended for direct
-                    use as an array at the field path .status.conditions.  For example,
-                    \n type FooStatus struct{ // Represents the observations of a
-                    foo's current state. // Known .status.conditions.type are: \"Available\",
-                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
-                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
-                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
-                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition
-                        transitioned from one status to another. This should be when
-                        the underlying condition changed.  If that is not known, then
-                        using the time when the API field changed is acceptable.
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating
-                        details about the transition. This may be an empty string.
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation
-                        that the condition was set based upon. For instance, if .metadata.generation
-                        is currently 12, but the .status.conditions[x].observedGeneration
-                        is 9, the condition is out of date with respect to the current
-                        state of the instance.
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating
-                        the reason for the condition's last transition. Producers
-                        of specific condition types may define expected values and
-                        meanings for this field, and whether the values are considered
-                        a guaranteed API. The value should be a CamelCase string.
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
                         This field may not be empty.
                       maxLength: 1024
                       minLength: 1
@@ -133,10 +149,6 @@ spec:
                       type: string
                     type:
                       description: type of condition in CamelCase or in foo.example.com/CamelCase.
-                        --- Many .condition.type values are consistent across resources
-                        like Available, but because arbitrary conditions can be useful
-                        (see .node.status.conditions), the ability to deconflict is
-                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string