thebestvibedev/tromcho.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add image owner/owner_group/reader_group support (for antietcd VitastorAuthFilter)

Browse Source
This commit is contained in:
Vitaliy Filippov
2026-04-03 21:22:42 +03:00
parent 9101ec1754
commit 7be6fcd27e
11 changed files with 122 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cmd/cli.cpp
+12 -5
View File
@@ -49,6 +49,9 @@ static const char* help_text =
" --enc-key random Generate a new random AES-256-XTS encryption key for the new image.\n"
" --enc-key HEX Set a specified AES-256-XTS key (64 bytes in hex) for the new image.\n"
" --enc-key vault:ID Use an encryption key from an external Vault secret with specified ID.\n"
" --owner username Set owner (default is the current user from TLS certificate).\n"
" --owner_group name Set owner group name.\n"
" --reader_group rdr Set reader group name.\n"
"\n"
"vitastor-cli create --snapshot <snapshot> [OPTIONS] <image>\n"
"vitastor-cli snap-create [OPTIONS] <image>@<snapshot>\n"
@@ -63,10 +66,13 @@ static const char* help_text =
" Rename, resize image or change its readonly status. Images with children can't be made read-write.\n"
" If the new size is smaller than the old size, extra data will be purged.\n"
" You should resize file system in the image, if present, before shrinking it.\n"
" --deleted 1|0 Set/clear 'deleted image' flag (set automatically during unfinished deletes).\n"
" -f|--force Proceed with shrinking or setting readwrite flag even if the image has children.\n"
" --down-ok Proceed with shrinking even if some data will be left on unavailable OSDs.\n"
" --enc-key HEX Change image encryption key (allowed only with --force).\n"
" --deleted 1|0 Set/clear 'deleted image' flag (set automatically during unfinished deletes).\n"
" -f|--force Proceed with shrinking or setting readwrite flag even if the image has children.\n"
" --down-ok Proceed with shrinking even if some data will be left on unavailable OSDs.\n"
" --enc-key HEX Change image encryption key (allowed only with --force).\n"
" --owner username Change image owner.\n"
" --owner_group name Change image owner group name.\n"
" --reader_group rdr Change image reader group name.\n"
"\n"
"vitastor-cli dd [iimg=<image> | if=<file>] [oimg=<image> | of=<file>] [bs=1M]\n"
" [count=N] [seek/oseek=N] [skip/iseek=M] [iodepth=N] [status=progress]\n"
@@ -205,6 +211,7 @@ static const char* help_text =
" --used_for_app s3:<name> Mark pool as used for S3 location with name <name>\n"
" --pg_stripe_size <number> Increase object grouping stripe\n"
" --max_osd_combinations 10000 Maximum number of random combinations for LP solver input\n"
" --creator_group <group> User group allowed to create images in this pool.\n"
" --wait Wait for the new pool to come online\n"
" -f|--force Do not check that cluster has enough OSDs to create the pool\n"
" Examples:\n"
@@ -216,7 +223,7 @@ static const char* help_text =
" [-s|--pg_size <number>] [--pg_minsize <number>] [-n|--pg_count <count>]\n"
" [--failure_domain <level>] [--root_node <node>] [--osd_tags <tags>] [--used_for_app <type>:<name>]\n"
" [--max_osd_combinations <number>] [--primary_affinity_tags <tags>] [--scrub_interval <time>]\n"
" [--level_placement <rules>] [--raw_placement <rules>]\n"
" [--level_placement <rules>] [--raw_placement <rules>] [--creator_group <group>]\n"
" Non-modifiable parameters (changing them WILL lead to data loss):\n"
" [--block_size <size>] [--bitmap_granularity <size>]\n"
" [--immediate_commit <all|small|none>] [--pg_stripe_size <size>]\n"
src/cmd/cli_create.cpp
+18
View File
@@ -7,6 +7,7 @@
#include <ctype.h>
#include "cli.h"
#include "http_client.h"
#include "cluster_client.h"
#include "str_util.h"
@@ -35,6 +36,7 @@ struct image_creator_t
bool force_size = false;
std::string enc_key;
bool set_key = false;
std::string new_owner, new_owner_group, new_reader_group;
pool_id_t old_pool_id = 0;
inode_t new_parent_id = 0;
@@ -442,6 +444,19 @@ resume_3:
{
new_cfg.enc_key = cur_cfg.enc_key;
}
new_cfg.owner = http_context_get_ssl_cn(parent->cli->st_cli.get_http_ctx());
if (!new_owner.empty())
{
new_cfg.owner = new_owner;
}
if (!new_owner_group.empty())
{
new_cfg.owner_group = new_owner_group;
}
if (!new_reader_group.empty())
{
new_cfg.reader_group = new_reader_group;
}
json11::Json::array checks = json11::Json::array {
json11::Json::object {
{ "target", "VERSION" },
@@ -604,6 +619,9 @@ std::function<bool(cli_result_t &)> cli_tool_t::start_create(json11::Json cfg)
}
}
}
image_creator->new_owner = cfg["owner"].string_value();
image_creator->new_owner_group = cfg["owner_group"].string_value();
image_creator->new_reader_group = cfg["reader_group"].string_value();
image_creator->new_parent = cfg["parent"].string_value();
if (!cfg["size"].is_null())
{
src/cmd/cli_modify.cpp
+16
View File
@@ -19,6 +19,7 @@ struct image_changer_t
bool set_deleted = false, new_deleted = false;
bool set_key = false;
std::string enc_key;
json11::Json new_owner, new_owner_group, new_reader_group;
bool down_ok = false;
// interval between fsyncs
int fsync_interval = 128;
@@ -151,6 +152,18 @@ resume_1:
{
cfg.name = new_name;
}
if (new_owner.is_string())
{
cfg.owner = new_owner.string_value();
}
if (new_owner_group.is_string())
{
cfg.owner_group = new_owner_group.string_value();
}
if (new_reader_group.is_string())
{
cfg.reader_group = new_reader_group.string_value();
}
if (set_key)
{
if (!force)
@@ -278,6 +291,9 @@ std::function<bool(cli_result_t &)> cli_tool_t::start_modify(json11::Json cfg)
if (!changer->fsync_interval)
changer->fsync_interval = 128;
changer->down_ok = cfg["down_ok"].bool_value();
changer->new_owner = cfg["owner"];
changer->new_owner_group = cfg["owner_group"];
changer->new_reader_group = cfg["reader_group"];
// FIXME Check that the image doesn't have children when shrinking
return [changer](cli_result_t & result)
{
src/cmd/cli_pool_cfg.cpp
+1 -1
View File
@@ -91,7 +91,7 @@ std::string validate_pool_config(json11::Json::object & new_cfg, json11::Json ol
}
else if (key == "name" || key == "scheme" || key == "immediate_commit" ||
key == "failure_domain" || key == "root_node" || key == "scrub_interval" || key == "used_for_app" ||
key == "used_for_fs" || key == "raw_placement" || key == "local_reads")
key == "used_for_fs" || key == "raw_placement" || key == "local_reads" || key == "creator_group")
{
if (!value.is_string())
{
src/cmd/openapi.json
+9 -2
View File
@@ -108,7 +108,10 @@
{ "type": "string", "enum": [ "", "random" ] },
{ "type": "string", "pattern": "^[0-9a-fA-F]{128}$|^vault:" }
]
}
},
"owner": { "type": "string", "description": "Set image owner" },
"owner_group": { "type": "string", "description": "Set image owner group" },
"reader_group": { "type": "string", "description": "Set image reader group" }
}
} } } },
"responses": {
@@ -146,6 +149,9 @@
{ "type": "string", "pattern": "^[0-9a-fA-F]{128}$|^vault:" }
]
},
"owner": { "type": "string", "description": "Set image owner" },
"owner_group": { "type": "string", "description": "Set image owner group" },
"reader_group": { "type": "string", "description": "Set image reader group" },
"force": { "type": "boolean", "description": "Proceed with shrinking or setting readwrite flag even if the image has children" },
"down_ok": { "type": "boolean", "description": "Proceed with shrinking even if some data will be left on unavailable OSDs" }
}
@@ -812,7 +818,8 @@
"scrub_interval": { "type": "string", "pattern": "^\\d+[smhdMy]$", "description": "Automatic scrub interval" },
"level_placement": { "type": "string", "description": "Additional failure domain rules" },
"raw_placement": { "type": "string", "description": "Raw PG generation rules" },
"max_osd_combinations": { "type": "integer", "format": "uint64", "description": "Maximum number of random combinations during PG generation" }
"max_osd_combinations": { "type": "integer", "format": "uint64", "description": "Maximum number of random combinations during PG generation" },
"creator_group": { "type": "string", "description": "User group allowed to create images in this pool" }
}
},
"PoolList": {