feat(bucket): add access policy

Author: acamilleri

Dockerfile

@@ -15,6 +15,7 @@ RUN go mod download
 COPY cmd/main.go cmd/main.go
 COPY api/ api/
 COPY internal/ internal/
+COPY pkg/ pkg/
 
 
 # Build

README.md

@@ -199,7 +199,37 @@ spec:
   quota:
     default: 10000000    
     # override: 20000000
-  
+
+  # AccessPolicy to set on the bucket
+  # Default to Private.
+  # The type can be "Public", "Private" or "Custom"
+  # Public, anyone can access in rw without authentication.
+  # Private, only authenticated users with policies can access.
+  # Custom, define a policy to apply.
+  # In the example below, everybody can read, but only authenticated users with policy can write.
+  accessPolicy:
+    type: Custom
+    policyContent: |-
+      {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "AWS": [
+                "*"
+              ]
+            },
+            "Action": [
+              "s3:GetObject"
+            ],
+            "Resource": [
+              "arn:aws:s3:::dummy-bucket/*"
+            ]
+          }
+        ]
+      }
+
   # Optionnal, let empty if you have configured the default s3 else use an existing s3Instance
   s3InstanceRef: "s3-default-instance"
 

api/v1alpha1/bucket_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+	s3model "github.com/InseeFrLab/s3-operator/pkg/s3/model"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -47,6 +48,10 @@ type BucketSpec struct {
 	// Quota to apply to the bucket
 	// +kubebuilder:validation:Required
 	Quota Quota `json:"quota"`
+
+	// AccessPolicy to apply to the bucket
+	// +kubebuilder:validation:Optional
+	AccessPolicy *AccessPolicy `json:"accessPolicy,omitempty"`
 }
 
 // BucketStatus defines the observed state of Bucket
@@ -87,6 +92,18 @@ type Quota struct {
 	Override int64 `json:"override,omitempty"`
 }
 
+type AccessPolicy struct {
+	// type of the AccessPolicy
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Default=Private
+	// +kubebuilder:validation:Enum=Private;Public;Custom
+	Type s3model.BucketAccessPolicyType `json:"type"`
+
+	// Content of the policy (IAM JSON format) for Custom AccessPolicy
+	// +kubebuilder:validation:Optional
+	PolicyContent string `json:"policyContent,omitempty"`
+}
+
 func init() {
 	SchemeBuilder.Register(&Bucket{}, &BucketList{})
 }

api/v1alpha1/zz_generated.deepcopy.go

@@ -33,7 +33,7 @@ import (
 	s3InstanceControllers "github.com/InseeFrLab/s3-operator/internal/controller/s3instance"
 	userControllers "github.com/InseeFrLab/s3-operator/internal/controller/user"
 	"github.com/InseeFrLab/s3-operator/internal/helpers"
-	s3factory "github.com/InseeFrLab/s3-operator/internal/s3/factory/impl"
+	s3factory "github.com/InseeFrLab/s3-operator/pkg/s3/factory/impl"
 
 	"go.uber.org/zap/zapcore"
 	"k8s.io/apimachinery/pkg/runtime"

cmd/main.go

@@ -39,6 +39,23 @@ spec:
           spec:
             description: BucketSpec defines the desired state of Bucket
             properties:
+              accessPolicy:
+                description: AccessPolicy to apply to the bucket
+                properties:
+                  policyContent:
+                    description: Content of the policy (IAM JSON format) for Custom
+                      AccessPolicy
+                    type: string
+                  type:
+                    description: type of the AccessPolicy
+                    enum:
+                    - Private
+                    - Public
+                    - Custom
+                    type: string
+                required:
+                - type
+                type: object
               name:
                 description: Name of the bucket
                 type: string

config/crd/bases/s3.onyxia.sh_buckets.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.0
+version: 0.8.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.12.0"
+appVersion: "v0.13.0"