ChenSammi commented on code in PR #523: URL: https://github.com/apache/ozone-site/pull/523#discussion_r3720718748
########## docs/08-developer-guide/04-project/01-git/03-feature-branches/03-merged-branches/18-hdds-13323-sts.md: ########## @@ -0,0 +1,95 @@ +# HDDS-13323: Ozone S3 Security Token Service (STS) + +Epic: [HDDS-13323](https://issues.apache.org/jira/browse/HDDS-13323) +Feature branch: https://github.com/apache/ozone/tree/HDDS-13323-sts + +## 1. Builds/intermittent test failures + +There are no intermittent failures specific to the HDDS-13323-sts branch as of now. During development, it was ensured that all CI checks were clean prior to every commit merge. + +The plan is to run repeated CI checks on the merge commit to master. + +## 2. Documentation + +[User documentation](https://ozone.apache.org/docs/next/administrator-guide/operations/s3/sts) for Ozone S3 Security Token Service (STS) has been added. + +## 3. Design, attached the docs + +Design document can be found here: [AWS STS Design for Ozone S3](https://github.com/apache/ozone/blob/HDDS-13323-sts/hadoop-hdds/docs/content/design/ozone-sts.md). + +## 4. S3 compatibility + +See sections [3.2](https://github.com/apache/ozone/blob/HDDS-13323-sts/hadoop-hdds/docs/content/design/ozone-sts.md#32-limitations-in-assumerole-api-support) and [3.3](https://github.com/apache/ozone/blob/HDDS-13323-sts/hadoop-hdds/docs/content/design/ozone-sts.md#33-limitations-in-iam-session-policy-support) in the design document for limitations in the AssumeRole API compatibility. + +Also **please note** that the Ranger feature flag (along with the Ozone feature flag) must be enabled in order to get AWS compatibility in terms of the requested actions and resulting actions the STS tokens have. + +## 5. Docker-compose / Acceptance tests + +New robot tests `ozone-secure-sts.robot` and `ozone-secure-sts-multitenant.robot` are being added. Furthermore, a shell script to test Polaris with Ozone STS (`polaris-smoketest.sh`) is being added. + +## 6. Support of containers / Kubernetes + +No addition. No change in existing support. + +## 7. Coverage / Code quality + +[New Code Coverage](https://sonarcloud.io/summary/new_code?id=hadoop-ozone&branch=HDDS-13323-sts) for STS (HDDS-13323-sts) is **89.1%** and [Overall Code Coverage](https://sonarcloud.io/summary/overall?id=hadoop-ozone&branch=HDDS-13323-sts) is **75.4%**. +[Overall Code Coverage](https://sonarcloud.io/summary/overall?id=hadoop-ozone&branch=master) for master is **78.5%**. + +## 8. Build time + +[Build time for the latest commit](https://github.com/apache/ozone/actions/runs/30604883966/job/91075071143) from HDDS-13323-sts branch is **11m 32s**. +[Build time for the latest commit](https://github.com/apache/ozone/actions/runs/30662032542/job/91260363408) from the master branch is **11m 48s**. + +## 9. Possible incompatible changes/used feature flag + +STS is disabled by default and gated by configuration flags. **Both** flags below must be enabled for correct, fine-grained authorization behavior. + +### Ozone feature flag + +Enable in `ozone-site.xml`: + +```xml +<property> + <name>ozone.s3g.sts.http.enabled</name> + <value>true</value> + <description>Enable the Ozone S3 Gateway STS endpoint.</description> +</property> +``` + +### Ranger feature flag (action-matches Policy Condition) + +Enable in `ranger-admin-site.xml`: + +```xml +<property> + <name>ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition</name> + <value>true</value> +</property> +``` + +A new RocksDB table stores revoked STS token entries. No OM versioning-framework feature flag is used. Review Comment: We can add the table name here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
