54 lines
2.9 KiB
Markdown
54 lines
2.9 KiB
Markdown
|
# 8.6 — `X-Service: s3` adapter, read-only object surface (GREEN)
|
||
|
|
|
||
|
|
Phase: 8 — ServiceAdapter CRD rollout
|
||
|
|
Stage: RED
|
||
|
|
Depends on: 8.1, 8.2, 8.3
|
||
|
|
|
||
|
|
Design contract: [API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §2
|
||
|
|
(`bucket/{key}` resource shape). No prior task or doc names the actual MinIO Service
|
||
|
|
— `grep -ri minio` across this repo turns up only prose in `REQUIREMENTS.md`/
|
||
|
|
`README.md`/`tasks/INDEX.md`/`tasks/7.4-db-prefix.md`, no manifest. **Confirm the
|
||
|
|
real Service name/namespace/port in-cluster before writing the CR** — do not guess
|
||
|
|
a hostname.
|
||
|
|
|
||
|
|
**G2 boundary, same as [7.4](7.4-db-prefix.md):** the gateway holds no MinIO access
|
||
|
|
key or secret key. If this adapter's design wants the gateway to hold a credential,
|
||
|
|
the design is wrong — put the credential-holding logic in a service behind the
|
||
|
|
gateway (e.g. a small internal proxy that signs requests) and adapt to *that*, not
|
||
|
|
to MinIO directly, unless MinIO itself supports anonymous/read-only bucket policies
|
||
|
|
that make a credential unnecessary for the specific buckets exposed here.
|
||
|
|
|
||
|
|
- [ ] `k8s/serviceadapter-s3.yaml` CR: `serviceName: s3`, `auth.capability: s3:read`
|
||
|
|
- [ ] Resource `bucket` maps `GET bucket/{key}` → object read, `DELETE bucket/{key}`
|
||
|
|
→ object delete — **only if** a write/delete capability is explicitly wanted;
|
||
|
|
default to read-only (`GET` only) unless told otherwise, consistent with 7.4's
|
||
|
|
"no write, no delete" rule for the `/db/*` surface this supersedes
|
||
|
|
- [ ] Result listing (if a bucket-list resource is added) is paginated with a
|
||
|
|
bounded page size — no unbounded listing, same rule 7.4 already established
|
||
|
|
- [ ] `requestSchema`/`responseSchema` per the KV+type DSL (8.3) — define once the
|
||
|
|
actual MinIO/proxy response shape is confirmed, not invented ahead of it
|
||
|
|
- [ ] NetworkPolicy reaches only the confirmed MinIO Service, nothing broader
|
||
|
|
- [ ] `/db/*` prefix-mounted MinIO read paths (if any exist from 7.4) are removed
|
||
|
|
once this adapter is verified live, to avoid two auth paths to the same data
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
|
||
|
|
-H 'X-Service: s3' -H 'X-Resource: bucket/some-key'
|
||
|
|
# expected: 401 without a token
|
||
|
|
|
||
|
|
curl -s -X DELETE -o /dev/null -w '%{http_code}\n' \
|
||
|
|
-H "Authorization: Bearer $S3_READ_TOKEN" \
|
||
|
|
https://api.riotpiao.com/ -H 'X-Service: s3' -H 'X-Resource: bucket/some-key'
|
||
|
|
# expected: 404 or 405 if this adapter ships read-only — no mutating verb is routable
|
||
|
|
|
||
|
|
curl -s -H "Authorization: Bearer $S3_READ_TOKEN" \
|
||
|
|
https://api.riotpiao.com/ -H 'X-Service: s3' -H 'X-Resource: bucket/known-object-key'
|
||
|
|
# expected: 200, object bytes or metadata per the confirmed response shape
|
||
|
|
|
||
|
|
kubectl -n api get pod -l app=api-gateway -o jsonpath='{range .items[0].spec.containers[0].env[*]}{.name}{"\n"}{end}' \
|
||
|
|
| grep -Ei 'minio|access_key|secret_key'
|
||
|
|
# expected: no output — gateway carries no MinIO credential
|
||
|
|
```
|