feat(bucket): add readonly S3 access credentials#2105
Conversation
Add a readonly BucketAccessClass to the seaweedfs COSI chart and a second fixed BucketAccess per bucket so each bucket automatically gets both readWrite and readonly S3 credentials. Signed-off-by: IvanHunters <[email protected]>
IvanHunters
requested review from
androndo,
kvaps,
lexfrei,
lllamnyp and
sircthulhu
as code owners
dosubot
bot
added
size:S
Summary of ChangesHello @IvanHunters, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances object storage capabilities by introducing a mechanism for generating and managing readonly S3 access credentials. This allows for more granular control over bucket permissions, providing a dedicated set of credentials that can only perform read and list operations, thereby improving security and access management for applications interacting with object storage. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
📝 WalkthroughWalkthroughThe changes introduce read-only variants of bucket access configurations by adding a new BucketAccess resource, a corresponding BucketAccessClass, associated role resource names, and secret resource mappings across multiple Kubernetes manifest templates. Changes
Possibly related issues
Poem
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](proxy.php?url=https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces readonly S3 access credentials for buckets. The changes are well-structured and consistently implemented across the affected Helm charts and Kubernetes resource definitions. A new BucketAccessClass with a readonly access policy is added, and corresponding BucketAccess resources are created to generate the readonly credentials. The RBAC roles and application definitions are correctly updated to include the new readonly secret. The implementation looks correct and complete for the intended feature.
![coderabbitai[bot]](proxy.php?url=https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml`:
- Around line 16-24: You added a BucketAccessClass resource directly inside a
vendored Helm template (the manifest that uses .Values.cosi.bucketClassName and
.Values.cosi.driverName to create a -readonly BucketAccessClass with
authenticationType KEY and parameters accessPolicy: "readonly"); revert that
direct edit in the vendored cosi-bucket-class.yaml and instead add the same
templated manifest via the project's Helm/chart vendoring or patch overlay
mechanism (create a chart patch/overlay that renders the BucketAccessClass using
.Values.cosi.bucketClassName and .Values.cosi.driverName) so upstream vendored
files remain untouched.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
packages/apps/bucket/templates/bucketclaim.yamlpackages/apps/bucket/templates/dashboard-resourcemap.yamlpackages/system/bucket-rd/cozyrds/bucket.yamlpackages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
packages/system/seaweedfs/charts/seaweedfs/templates/cosi/cosi-bucket-class.yaml
Show resolved
Hide resolved
2 participants
Summary
BucketAccessClassto the seaweedfs COSI chart withaccessPolicy: "readonly"parameterTest plan
BucketAccessClassresources (readWrite and readonly)BucketClaim+ 2BucketAccess(readWrite + readonly)Summary by CodeRabbit