Introduce "internal" cloudserver and allow bypass policies on that port #5807
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is used to handle internal traffic (esp. from backbeat) with specific handling of policies where needed. Issue: CLDSRV-650
Hello francoisferrand,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Currently, bucket policies affect also internal processes (backbeat...), which can allow end users to "break" some features (replication, lifecycle...). The topic was discussed in [1], and the short term solution is to use some sort of "internal" cloudserver, which would not evaluate bucket policies. This is addressed by this commit, which adds the ability to create an "internal" endpoint on a separate port, where bucket policies are ignored. [1] https://scality.atlassian.net/wiki/spaces/OS/pages/2895347722/Authorizing+Internal+Services+S3+Operations Issue: CLDSRV-650
francoisferrand
force-pushed
the
improvement/CLDSRV-650
branch
from
2796a6c to
dfe7321
Compare
Codecov ReportAttention: Patch coverage is
✅ All tests successful. No failed tests found.
Additional details and impacted files
... and 1 file with indirect coverage changes @@ Coverage Diff @@
## development/9.0 #5807 +/- ##
===================================================
+ Coverage 75.62% 75.76% +0.13%
===================================================
Files 188 188
Lines 11949 11963 +14
===================================================
+ Hits 9037 9064 +27
+ Misses 2912 2899 -13
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Kerkesni
approved these changes
May 26, 2025
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
|
/approve |
Build failedThe build for commit did not succeed in branch w/9.1/improvement/CLDSRV-650 The following options are set: approve |
|
I have successfully merged the changeset of this pull request
The following branches have NOT changed:
Please check the status of the associated issue CLDSRV-650. Goodbye francoisferrand. The following options are set: approve |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In order to ensure backbeat (and internal processes in general) are not affected by user's bucket policies, allow starting cloudserver with a separate "internal" port, through which bucket policies are currently bypassed.
More details here: https://scality.atlassian.net/wiki/spaces/OS/pages/2895347722/Authorizing+Internal+Services+S3+Operations
Issue: CLDSRV-650