Introduce "internal" cloudserver and allow bypass policies on that port#5807
Introduce "internal" cloudserver and allow bypass policies on that port#5807bert-e merged 3 commits intodevelopment/9.0from
Conversation
This is used to handle internal traffic (esp. from backbeat) with specific handling of policies where needed. Issue: CLDSRV-650
Hello francoisferrand,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Currently, bucket policies affect also internal processes (backbeat...), which can allow end users to "break" some features (replication, lifecycle...). The topic was discussed in [1], and the short term solution is to use some sort of "internal" cloudserver, which would not evaluate bucket policies. This is addressed by this commit, which adds the ability to create an "internal" endpoint on a separate port, where bucket policies are ignored. [1] https://scality.atlassian.net/wiki/spaces/OS/pages/2895347722/Authorizing+Internal+Services+S3+Operations Issue: CLDSRV-650
2796a6c to
dfe7321
Compare
Codecov ReportAttention: Patch coverage is
✅ All tests successful. No failed tests found.
Additional details and impacted files
... and 1 file with indirect coverage changes @@ Coverage Diff @@
## development/9.0 #5807 +/- ##
===================================================
+ Coverage 75.62% 75.76% +0.13%
===================================================
Files 188 188
Lines 11949 11963 +14
===================================================
+ Hits 9037 9064 +27
+ Misses 2912 2899 -13
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
|
/approve |
Build failedThe build for commit did not succeed in branch w/9.1/improvement/CLDSRV-650 The following options are set: approve |
|
I have successfully merged the changeset of this pull request
The following branches have NOT changed:
Please check the status of the associated issue CLDSRV-650. Goodbye francoisferrand. The following options are set: approve |
In order to ensure backbeat (and internal processes in general) are not affected by user's bucket policies, allow starting cloudserver with a separate "internal" port, through which bucket policies are currently bypassed.
More details here: https://scality.atlassian.net/wiki/spaces/OS/pages/2895347722/Authorizing+Internal+Services+S3+Operations
Issue: CLDSRV-650