Skip to content

Commit 1cd93b5

Browse files
JackLemaitreJackLemaitre
authored
Merge pull request #43 from InseeFrLab/add-hability-to-create-user
Add hability to create user
2 parents 9ef45a3 + 1c752dd commit 1cd93b5

File tree

13 files changed

+1198
-26
lines changed

13 files changed

+1198
-26
lines changed

‎README.md‎

Lines changed: 77 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,16 @@ At its heart, the operator revolves around CRDs that match S3 resources :
2121
- `buckets.s3.onyxia.sh`
2222
- `policies.s3.onyxia.sh`
2323
- `paths.s3.onyxia.sh`
24+
- `users.s3.onyxia.sh`
2425

2526
The custom resources based on these CRDs are a somewhat simplified projection of the real S3 resources. From the operator's point of view :
2627

2728
- A `Bucket` CR matches a S3 bucket, and only has a name, a quota (actually two, [see Bucket example in *Usage* section below](#bucket)), and optionally, a set of paths
2829
- A `Policy` CR matches a "canned" policy (not a bucket policy, but a global one, that can be attached to a user), and has a name, and its actual content (IAM JSON)
2930
- A `Path` CR matches a set of paths inside of a policy. This is akin to the `paths` property of the `Bucket` CRD, except `Path` is not responsible for Bucket creation.
31+
- A `S3User` CR matches a user in the s3 server, and has a name, a set of policy and a set of group.
3032

31-
Each custom resource based on these CRDs on Kubernetes is to be matched with a resource on the S3 instance. If the CR and the corresponding S3 resource diverge, the operator will create or update the S3 resource to bring it back to .
33+
Each custom resource based on these CRDs on Kubernetes is to be matched with a resource on the S3 instance. If the CR and the corresponding S3 resource diverge, the operator will create or update the S3 resource to bring it back to.
3234

3335
Two important caveats :
3436

@@ -86,7 +88,56 @@ The parameters are summarized in the table below :
8688
| `bucket-deletion` | false | - | no | Trigger bucket deletion on the S3 backend upon CR deletion. Will fail if bucket is not empty. |
8789
| `policy-deletion` | false | - | no | Trigger policy deletion on the S3 backend upon CR deletion |
8890
| `path-deletion` | false | - | no | Trigger path deletion on the S3 backend upon CR deletion. Limited to deleting the `.keep` files used by the operator. |
91+
| `s3User-deletion` | false | - | no | Trigger S3User deletion on the S3 backend upon CR deletion. |
92+
| `override-existing-secret` | false | - | no | Update secret linked to s3User if already exist, else noop |
93+
94+
## Minimal rights needed to work
95+
96+
The Operator need at least this rights:
97+
98+
```json
99+
{
100+
"Version": "2012-10-17",
101+
"Statement": [
102+
{
103+
"Effect": "Allow",
104+
"Action": [
105+
"s3:CreateBucket",
106+
"s3:GetObject",
107+
"s3:ListAllMyBuckets",
108+
"s3:ListBucket",
109+
"s3:PutObject"
110+
],
111+
"Resource": [
112+
"arn:aws:s3:::*"
113+
]
114+
},
115+
{
116+
"Effect": "Allow",
117+
"Action": [
118+
"admin:CreatePolicy",
119+
"admin:GetBucketQuota",
120+
"admin:GetPolicy",
121+
"admin:ListPolicy",
122+
"admin:SetBucketQuota",
123+
"admin:CreateUser",
124+
"admin:ListUsers",
125+
"admin:DeleteUser",
126+
"admin:GetUser",
127+
"admin:AddUserToGroup",
128+
"admin:RemoveUserFromGroup",
129+
"admin:AttachUserOrGroupPolicy",
130+
"admin:ListUserPolicies"
131+
132+
],
133+
"Resource": [
134+
"arn:aws:s3:::*"
135+
]
136+
}
137+
]
138+
}
89139

140+
```
90141

91142
## Usage
92143

@@ -197,6 +248,29 @@ spec:
197248

198249
```
199250

251+
### S3User example
252+
253+
```yaml
254+
apiVersion: s3.onyxia.sh/v1alpha1
255+
kind: S3User
256+
metadata:
257+
labels:
258+
app.kubernetes.io/name: user
259+
app.kubernetes.io/instance: user-sample
260+
app.kubernetes.io/part-of: s3-operator
261+
app.kubernetes.io/managed-by: kustomize
262+
app.kubernetes.io/created-by: s3-operator
263+
name: user-sample
264+
spec:
265+
accessKey: user-sample
266+
policies:
267+
- policy-example1
268+
- policy-example2
269+
270+
```
271+
272+
Each S3user is linked to a kubernetes secret which have the same name that the S3User. The secret contains 2 keys: `accessKey` and `secretKey`.
273+
200274
## Operator SDK generated guidelines
201275

202276
<details>
@@ -276,3 +350,5 @@ make manifests
276350
More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)
277351

278352
</details>
353+
354+

‎api/v1alpha1/s3user_types.go‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/*
2+
Copyright 2023.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
)
22+
23+
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
24+
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
25+
26+
// S3UserSpec defines the desired state of S3User
27+
type S3UserSpec struct {
28+
29+
// Name of the S3User
30+
// +kubebuilder:validation:Required
31+
AccessKey string `json:"accessKey"`
32+
33+
// Policies associated to the S3User
34+
// +kubebuilder:validation:Optional
35+
Policies []string `json:"policies,omitempty"`
36+
}
37+
38+
// S3UserStatus defines the observed state of S3User
39+
type S3UserStatus struct {
40+
// Status management using Conditions.
41+
// See also : https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
42+
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
43+
}
44+
45+
//+kubebuilder:object:root=true
46+
//+kubebuilder:subresource:status
47+
48+
// S3User is the Schema for the S3Users API
49+
type S3User struct {
50+
metav1.TypeMeta `json:",inline"`
51+
metav1.ObjectMeta `json:"metadata,omitempty"`
52+
53+
Spec S3UserSpec `json:"spec,omitempty"`
54+
Status S3UserStatus `json:"status,omitempty"`
55+
}
56+
57+
//+kubebuilder:object:root=true
58+
59+
// S3UserList contains a list of S3User
60+
type S3UserList struct {
61+
metav1.TypeMeta `json:",inline"`
62+
metav1.ListMeta `json:"metadata,omitempty"`
63+
Items []S3User `json:"items"`
64+
}
65+
66+
func init() {
67+
SchemeBuilder.Register(&S3User{}, &S3UserList{})
68+
}

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 101 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)