Skip to content

Commit 830a807

Browse files
RedbackThomsonRedbackThomson
authored
Support Bucket policy (#36)
Adds support for creating, updating and delete bucket Policy. This field is simply a JSON string that applies IAM permissions to objects in the bucket. This is the first `Put*` field implemented so far that has a separate `Delete*` call, so the logic for `syncBucket` now checks accordingly.
1 parent 0334a98 commit 830a807

19 files changed

+750
-25
lines changed

‎apis/v1alpha1/ack-generate-metadata.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
ack_generate_info:
2-
build_date: "2021-08-12T22:22:41Z"
2+
build_date: "2021-08-12T23:12:20Z"
33
build_hash: 4d0db1b6f794e5221eb88b052b52a1a95017cf20
44
go_version: go1.15.6 linux/amd64
55
version: v0.9.2
6-
api_directory_checksum: a111b8798ffa13b2cf948befafae28feaef463ab
6+
api_directory_checksum: 0d04fca79a5350fa289a4aac8afd284351778233
77
api_version: v1alpha1
88
aws_sdk_go_version: v1.37.10
99
generator_config_info:
10-
file_checksum: 85625c1a8af87eb3bbda9c6764a356bd3751cb31
10+
file_checksum: b3cfb60b1b7154bc50d4c28096dfc75bf35a3767
1111
original_file_name: generator.yaml
1212
last_modification:
1313
reason: API generation
14-
timestamp: 2021-08-12 22:22:48.65031987 +0000 UTC
14+
timestamp: 2021-08-12 23:12:25.389076653 +0000 UTC

‎apis/v1alpha1/bucket.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha1/generator.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,10 @@ resources:
5858
from:
5959
operation: PutBucketOwnershipControls
6060
path: OwnershipControls
61-
# Policy:
62-
# from:
63-
# operation: PutBucketPolicy
64-
# path: Policy # Double check about ConfirmRemoveSelfBucketAccess
61+
Policy:
62+
from:
63+
operation: PutBucketPolicy
64+
path: Policy # Double check about ConfirmRemoveSelfBucketAccess
6565
# Replication:
6666
# from:
6767
# operation: PutBucketReplication

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/s3.services.k8s.aws_buckets.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,9 @@ spec:
194194
type: object
195195
type: array
196196
type: object
197+
policy:
198+
description: The bucket policy as a JSON document.
199+
type: string
197200
requestPayment:
198201
description: Container for Payer.
199202
properties:

‎generator.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,10 @@ resources:
5858
from:
5959
operation: PutBucketOwnershipControls
6060
path: OwnershipControls
61-
# Policy:
62-
# from:
63-
# operation: PutBucketPolicy
64-
# path: Policy # Double check about ConfirmRemoveSelfBucketAccess
61+
Policy:
62+
from:
63+
operation: PutBucketPolicy
64+
path: Policy # Double check about ConfirmRemoveSelfBucketAccess
6565
# Replication:
6666
# from:
6767
# operation: PutBucketReplication

‎helm/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v1
2-
name: ack-s3-controller
2+
name: s3-chart
33
description: A Helm chart for the ACK service controller for s3
44
version: v0.0.2
55
appVersion: v0.0.2
@@ -10,7 +10,7 @@ sources:
1010
maintainers:
1111
- name: ACK Admins
1212
url: https://github.com/orgs/aws-controllers-k8s/teams/ack-admin
13-
- name: S3 Admins
13+
- name: s3 Admins
1414
url: https://github.com/orgs/aws-controllers-k8s/teams/s3-maintainer
1515
keywords:
1616
- aws

‎helm/crds/s3.services.k8s.aws_buckets.yaml

Lines changed: 234 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.4.0
7+
controller-gen.kubebuilder.io/version: v0.6.1
88
creationTimestamp: null
99
name: buckets.s3.services.k8s.aws
1010
spec:
@@ -34,29 +34,258 @@ spec:
3434
metadata:
3535
type: object
3636
spec:
37-
description: BucketSpec defines the desired state of Bucket
37+
description: "BucketSpec defines the desired state of Bucket. \n In terms
38+
of implementation, a Bucket is a resource. An Amazon S3 bucket name
39+
is globally unique, and the namespace is shared by all AWS accounts."
3840
properties:
41+
accelerate:
42+
description: Container for setting the transfer acceleration state.
43+
properties:
44+
status:
45+
type: string
46+
type: object
3947
acl:
48+
description: The canned ACL to apply to the bucket.
4049
type: string
50+
cors:
51+
description: Describes the cross-origin access configuration for objects
52+
in an Amazon S3 bucket. For more information, see Enabling Cross-Origin
53+
Resource Sharing (https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html)
54+
in the Amazon Simple Storage Service Developer Guide.
55+
properties:
56+
corsRules:
57+
items:
58+
description: Specifies a cross-origin access rule for an Amazon
59+
S3 bucket.
60+
properties:
61+
allowedHeaders:
62+
items:
63+
type: string
64+
type: array
65+
allowedMethods:
66+
items:
67+
type: string
68+
type: array
69+
allowedOrigins:
70+
items:
71+
type: string
72+
type: array
73+
exposeHeaders:
74+
items:
75+
type: string
76+
type: array
77+
maxAgeSeconds:
78+
format: int64
79+
type: integer
80+
type: object
81+
type: array
82+
type: object
4183
createBucketConfiguration:
84+
description: The configuration information for the bucket.
4285
properties:
4386
locationConstraint:
4487
type: string
4588
type: object
89+
encryption:
90+
description: Specifies the default server-side-encryption configuration.
91+
properties:
92+
rules:
93+
items:
94+
description: Specifies the default server-side encryption configuration.
95+
properties:
96+
applyServerSideEncryptionByDefault:
97+
description: Describes the default server-side encryption
98+
to apply to new objects in the bucket. If a PUT Object
99+
request doesn't specify any server-side encryption, this
100+
default encryption will be applied. For more information,
101+
see PUT Bucket encryption (https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTencryption.html)
102+
in the Amazon Simple Storage Service API Reference.
103+
properties:
104+
kmsMasterKeyID:
105+
type: string
106+
sseAlgorithm:
107+
type: string
108+
type: object
109+
bucketKeyEnabled:
110+
type: boolean
111+
type: object
112+
type: array
113+
type: object
46114
grantFullControl:
115+
description: Allows grantee the read, write, read ACP, and write ACP
116+
permissions on the bucket.
47117
type: string
48118
grantRead:
119+
description: Allows grantee to list the objects in the bucket.
49120
type: string
50121
grantReadACP:
122+
description: Allows grantee to read the bucket ACL.
51123
type: string
52124
grantWrite:
125+
description: Allows grantee to create, overwrite, and delete any object
126+
in the bucket.
53127
type: string
54128
grantWriteACP:
129+
description: Allows grantee to write the ACL for the applicable bucket.
55130
type: string
131+
logging:
132+
description: Container for logging status information.
133+
properties:
134+
loggingEnabled:
135+
description: Describes where logs are stored and the prefix that
136+
Amazon S3 assigns to all log object keys for a bucket. For more
137+
information, see PUT Bucket logging (https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTlogging.html)
138+
in the Amazon Simple Storage Service API Reference.
139+
properties:
140+
targetBucket:
141+
type: string
142+
targetGrants:
143+
items:
144+
description: Container for granting information.
145+
properties:
146+
grantee:
147+
description: Container for the person being granted
148+
permissions.
149+
properties:
150+
displayName:
151+
type: string
152+
emailAddress:
153+
type: string
154+
id:
155+
type: string
156+
type_:
157+
type: string
158+
uRI:
159+
type: string
160+
type: object
161+
permission:
162+
type: string
163+
type: object
164+
type: array
165+
targetPrefix:
166+
type: string
167+
type: object
168+
type: object
56169
name:
170+
description: The name of the bucket to create.
57171
type: string
58172
objectLockEnabledForBucket:
173+
description: Specifies whether you want S3 Object Lock to be enabled
174+
for the new bucket.
59175
type: boolean
176+
ownershipControls:
177+
description: The OwnershipControls (BucketOwnerPreferred or ObjectWriter)
178+
that you want to apply to this Amazon S3 bucket.
179+
properties:
180+
rules:
181+
items:
182+
description: The container element for an ownership control
183+
rule.
184+
properties:
185+
objectOwnership:
186+
description: "The container element for object ownership
187+
for a bucket's ownership controls. \n BucketOwnerPreferred
188+
- Objects uploaded to the bucket change ownership to the
189+
bucket owner if the objects are uploaded with the bucket-owner-full-control
190+
canned ACL. \n ObjectWriter - The uploading account will
191+
own the object if the object is uploaded with the bucket-owner-full-control
192+
canned ACL."
193+
type: string
194+
type: object
195+
type: array
196+
type: object
197+
policy:
198+
description: The bucket policy as a JSON document.
199+
type: string
200+
requestPayment:
201+
description: Container for Payer.
202+
properties:
203+
payer:
204+
type: string
205+
type: object
206+
tagging:
207+
description: Container for the TagSet and Tag elements.
208+
properties:
209+
tagSet:
210+
items:
211+
description: A container of a key value name pair.
212+
properties:
213+
key:
214+
type: string
215+
value:
216+
type: string
217+
type: object
218+
type: array
219+
type: object
220+
versioning:
221+
description: Container for setting the versioning state.
222+
properties:
223+
status:
224+
type: string
225+
type: object
226+
website:
227+
description: Container for the request.
228+
properties:
229+
errorDocument:
230+
description: The error information.
231+
properties:
232+
key:
233+
type: string
234+
type: object
235+
indexDocument:
236+
description: Container for the Suffix element.
237+
properties:
238+
suffix:
239+
type: string
240+
type: object
241+
redirectAllRequestsTo:
242+
description: Specifies the redirect behavior of all requests to
243+
a website endpoint of an Amazon S3 bucket.
244+
properties:
245+
hostName:
246+
type: string
247+
protocol:
248+
type: string
249+
type: object
250+
routingRules:
251+
items:
252+
description: Specifies the redirect behavior and when a redirect
253+
is applied. For more information about routing rules, see
254+
Configuring advanced conditional redirects (https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html#advanced-conditional-redirects)
255+
in the Amazon Simple Storage Service Developer Guide.
256+
properties:
257+
condition:
258+
description: A container for describing a condition that
259+
must be met for the specified redirect to apply. For example,
260+
1. If request is for pages in the /docs folder, redirect
261+
to the /documents folder. 2. If request results in HTTP
262+
error 4xx, redirect request to another host where you
263+
might process the error.
264+
properties:
265+
httpErrorCodeReturnedEquals:
266+
type: string
267+
keyPrefixEquals:
268+
type: string
269+
type: object
270+
redirect:
271+
description: Specifies how requests are redirected. In the
272+
event of an error, you can specify a different error code
273+
to return.
274+
properties:
275+
hostName:
276+
type: string
277+
httpRedirectCode:
278+
type: string
279+
protocol:
280+
type: string
281+
replaceKeyPrefixWith:
282+
type: string
283+
replaceKeyWith:
284+
type: string
285+
type: object
286+
type: object
287+
type: array
288+
type: object
60289
required:
61290
- name
62291
type: object
@@ -120,10 +349,10 @@ spec:
120349
type: object
121350
type: array
122351
location:
352+
description: Specifies the Region where the bucket will be created.
353+
If you are creating a bucket on the US East (N. Virginia) Region
354+
(us-east-1), you do not need to specify the location.
123355
type: string
124-
required:
125-
- ackResourceMetadata
126-
- conditions
127356
type: object
128357
type: object
129358
served: true

0 commit comments

Comments
 (0)