Bug 1887417 - MCG Namespace Bucket uses bucket policy from its write resource
Summary: MCG Namespace Bucket uses bucket policy from its write resource
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat OpenShift Container Storage
Classification: Red Hat Storage
Component: Multi-Cloud Object Gateway
Version: 4.6
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: ---
Assignee: Nimrod Becker
QA Contact: Raz Tamir
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-10-12 12:07 UTC by Filip Balák
Modified: 2020-10-12 14:08 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-10-12 12:36:30 UTC
Embargoed:


Attachments (Terms of Use)

Description Filip Balák 2020-10-12 12:07:58 UTC
Description of problem (please be detailed as possible and provide log
snippests):
If MCG Namespace Bucket consists of multiple read resources with data and one write resource and the write resource is unavailable due to change of bucket policy (Deny bucket policy for Put, Get and List) then the whole MCG Namespace bucket is unavailable (including data that are accessible from read resources). 

Version of all relevant components (if applicable):
ocs-operator.v4.6.0-113.ci

Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?


Is there any workaround available to the best of your knowledge?


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
3

Can this issue reproducible?
yes

Can this issue reproduce from the UI?
no

If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1. Create 2 MCG Namespace resources and put data into them.
2. Create MCG Namespace bucket. Set both resources as read resources and one of them as write resource.
3. Set S3 bucket policy on write resource to deny Put, Get and List operations.
4. Download data from MCG Namespace bucket.
(e.g aws s3 --endpoint=***** sync s3://namespace-bucket /downloads)


Actual results:
Access is denied.

Expected results:
Part of the data that is stored in resource that is not set as write resource should be available. Bucket should not assume bucket policy from its write resource but should be set separately.

Additional info:


Note You need to log in before you can comment on or make changes to this bug.