Skip to content

Comments

s3: reenable tenanted bucket policy test#577

Merged
cbodley merged 1 commit intoceph:masterfrom
cbodley:wip-cross-tenant
Aug 14, 2024
Merged

s3: reenable tenanted bucket policy test#577
cbodley merged 1 commit intoceph:masterfrom
cbodley:wip-cross-tenant

Conversation

@cbodley
Copy link
Contributor

@cbodley cbodley commented Aug 13, 2024

the before-call hook url-encodes the ':' part of tenanted bucket names to resolve SignatureDoesNotMatch errors

removed the list-v2 version of the test since it isn't relevant to bucket policy test coverage

add a new test case that creates the bucket under the tenanted user, then uses the main client to access it

@cbodley
Copy link
Contributor Author

cbodley commented Aug 13, 2024

the existing test case test_bucket_policy_different_tenant() passes against rgw

add a new test case that creates the bucket under the tenanted user, then uses the main client to access it

this new test case test_bucket_policy_tenanted_bucket() fails against rgw without ceph/ceph#59169, and passes with 👍

Comment on lines 697 to 699
def get_tenant_name():
s = config.tenant_display_name
return s[:s.index('$')]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this works for the default value from s3tests.conf.SAMPLE:

[s3 tenant]
# tenant display_name set in vstart.sh
display_name = testx$tenanteduser

but fails in teuthology where qa/tasks/s3tests.py sets display_name to Mr.testx$tenanteduser. rgw sees these requests as:

REQUEST_URI=/Mr.testx%3Atest-fak34zuywqcog5fhyh4e22bc-475?encoding-type=url

and rejects it with 400 InvalidTenantName because of the . in Mr.testx

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since we need the tenant name for this test new case, i added a new tenant variable to the [s3 tenant] config section. i added a new commit to ceph/ceph#59169 that configures this in teuthology

the before-call hook url-encodes the ':' part of tenanted bucket names
to resolve SignatureDoesNotMatch errors

removed the list-v2 version of the test since it isn't relevant to
bucket policy test coverage

add a new test case that creates the bucket under the tenanted user,
then uses the main client to access it

Signed-off-by: Casey Bodley <[email protected]>
@cbodley cbodley merged commit 3458971 into ceph:master Aug 14, 2024
@cbodley
Copy link
Contributor Author

cbodley commented Aug 23, 2024

cherry-picked to ceph-master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants