Bring in safe mode support (#8478)
This PR refactors object layer handling such that upon failure in sub-system initialization server reaches a stage of safe-mode operation wherein only certain API operations are enabled and available. This allows for fixing many scenarios such as - incorrect configuration in vault, etcd, notification targets - missing files, incomplete config migrations unable to read encrypted content etc - any other issues related to notification, policies, lifecycle etcmaster
Harshavardhana
5 years ago
committed by
kannappanr
parent
1c90a6bd49
commit
822eb5ddc7
@ -0,0 +1,529 @@ |
||||
/* |
||||
* MinIO Cloud Storage, (C) 2019 MinIO, Inc. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package cmd |
||||
|
||||
import ( |
||||
"context" |
||||
"encoding/json" |
||||
"io" |
||||
"io/ioutil" |
||||
"net/http" |
||||
|
||||
"github.com/gorilla/mux" |
||||
"github.com/minio/minio/cmd/logger" |
||||
iampolicy "github.com/minio/minio/pkg/iam/policy" |
||||
"github.com/minio/minio/pkg/madmin" |
||||
) |
||||
|
||||
func validateAdminUsersReq(ctx context.Context, w http.ResponseWriter, r *http.Request) ObjectLayer { |
||||
// Get current object layer instance.
|
||||
objectAPI := newObjectLayerWithoutSafeModeFn() |
||||
if objectAPI == nil || globalNotificationSys == nil || globalIAMSys == nil { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL) |
||||
return nil |
||||
} |
||||
|
||||
// Validate request signature.
|
||||
adminAPIErr := checkAdminRequestAuthType(ctx, r, "") |
||||
if adminAPIErr != ErrNone { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(adminAPIErr), r.URL) |
||||
return nil |
||||
} |
||||
|
||||
return objectAPI |
||||
} |
||||
|
||||
// RemoveUser - DELETE /minio/admin/v2/remove-user?accessKey=<access_key>
|
||||
func (a adminAPIHandlers) RemoveUser(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "RemoveUser") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
accessKey := vars["accessKey"] |
||||
|
||||
if err := globalIAMSys.DeleteUser(accessKey); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to delete user.
|
||||
for _, nerr := range globalNotificationSys.DeleteUser(accessKey) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// ListUsers - GET /minio/admin/v2/list-users
|
||||
func (a adminAPIHandlers) ListUsers(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "ListUsers") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
allCredentials, err := globalIAMSys.ListUsers() |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
data, err := json.Marshal(allCredentials) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
password := globalActiveCred.SecretKey |
||||
econfigData, err := madmin.EncryptData(password, data) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
writeSuccessResponseJSON(w, econfigData) |
||||
} |
||||
|
||||
// GetUserInfo - GET /minio/admin/v2/user-info
|
||||
func (a adminAPIHandlers) GetUserInfo(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "GetUserInfo") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
name := vars["accessKey"] |
||||
|
||||
userInfo, err := globalIAMSys.GetUserInfo(name) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
data, err := json.Marshal(userInfo) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
writeSuccessResponseJSON(w, data) |
||||
} |
||||
|
||||
// UpdateGroupMembers - PUT /minio/admin/v2/update-group-members
|
||||
func (a adminAPIHandlers) UpdateGroupMembers(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "UpdateGroupMembers") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
defer r.Body.Close() |
||||
data, err := ioutil.ReadAll(r.Body) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) |
||||
return |
||||
} |
||||
|
||||
var updReq madmin.GroupAddRemove |
||||
err = json.Unmarshal(data, &updReq) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) |
||||
return |
||||
} |
||||
|
||||
if updReq.IsRemove { |
||||
err = globalIAMSys.RemoveUsersFromGroup(updReq.Group, updReq.Members) |
||||
} else { |
||||
err = globalIAMSys.AddUsersToGroup(updReq.Group, updReq.Members) |
||||
} |
||||
|
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to load group.
|
||||
for _, nerr := range globalNotificationSys.LoadGroup(updReq.Group) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// GetGroup - /minio/admin/v2/group?group=mygroup1
|
||||
func (a adminAPIHandlers) GetGroup(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "GetGroup") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
group := vars["group"] |
||||
|
||||
gdesc, err := globalIAMSys.GetGroupDescription(group) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
body, err := json.Marshal(gdesc) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
writeSuccessResponseJSON(w, body) |
||||
} |
||||
|
||||
// ListGroups - GET /minio/admin/v2/groups
|
||||
func (a adminAPIHandlers) ListGroups(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "ListGroups") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
groups, err := globalIAMSys.ListGroups() |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
body, err := json.Marshal(groups) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
writeSuccessResponseJSON(w, body) |
||||
} |
||||
|
||||
// SetGroupStatus - PUT /minio/admin/v2/set-group-status?group=mygroup1&status=enabled
|
||||
func (a adminAPIHandlers) SetGroupStatus(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "SetGroupStatus") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
group := vars["group"] |
||||
status := vars["status"] |
||||
|
||||
var err error |
||||
if status == statusEnabled { |
||||
err = globalIAMSys.SetGroupStatus(group, true) |
||||
} else if status == statusDisabled { |
||||
err = globalIAMSys.SetGroupStatus(group, false) |
||||
} else { |
||||
err = errInvalidArgument |
||||
} |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to reload user.
|
||||
for _, nerr := range globalNotificationSys.LoadGroup(group) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// SetUserStatus - PUT /minio/admin/v2/set-user-status?accessKey=<access_key>&status=[enabled|disabled]
|
||||
func (a adminAPIHandlers) SetUserStatus(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "SetUserStatus") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
accessKey := vars["accessKey"] |
||||
status := vars["status"] |
||||
|
||||
// Custom IAM policies not allowed for admin user.
|
||||
if accessKey == globalActiveCred.AccessKey { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err := globalIAMSys.SetUserStatus(accessKey, madmin.AccountStatus(status)); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to reload user.
|
||||
for _, nerr := range globalNotificationSys.LoadUser(accessKey, false) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// AddUser - PUT /minio/admin/v2/add-user?accessKey=<access_key>
|
||||
func (a adminAPIHandlers) AddUser(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "AddUser") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
accessKey := vars["accessKey"] |
||||
|
||||
// Custom IAM policies not allowed for admin user.
|
||||
if accessKey == globalActiveCred.AccessKey { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAddUserInvalidArgument), r.URL) |
||||
return |
||||
} |
||||
|
||||
if r.ContentLength > maxEConfigJSONSize || r.ContentLength == -1 { |
||||
// More than maxConfigSize bytes were available
|
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigTooLarge), r.URL) |
||||
return |
||||
} |
||||
|
||||
password := globalActiveCred.SecretKey |
||||
configBytes, err := madmin.DecryptData(password, io.LimitReader(r.Body, r.ContentLength)) |
||||
if err != nil { |
||||
logger.LogIf(ctx, err) |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL) |
||||
return |
||||
} |
||||
|
||||
var uinfo madmin.UserInfo |
||||
if err = json.Unmarshal(configBytes, &uinfo); err != nil { |
||||
logger.LogIf(ctx, err) |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminConfigBadJSON), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err = globalIAMSys.SetUser(accessKey, uinfo); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other Minio peers to reload user
|
||||
for _, nerr := range globalNotificationSys.LoadUser(accessKey, false) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// InfoCannedPolicy - GET /minio/admin/v2/info-canned-policy?name={policyName}
|
||||
func (a adminAPIHandlers) InfoCannedPolicy(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "InfoCannedPolicy") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
data, err := globalIAMSys.InfoPolicy(mux.Vars(r)["name"]) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
w.Write(data) |
||||
w.(http.Flusher).Flush() |
||||
} |
||||
|
||||
// ListCannedPolicies - GET /minio/admin/v2/list-canned-policies
|
||||
func (a adminAPIHandlers) ListCannedPolicies(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "ListCannedPolicies") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
policies, err := globalIAMSys.ListPolicies() |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err = json.NewEncoder(w).Encode(policies); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
w.(http.Flusher).Flush() |
||||
} |
||||
|
||||
// RemoveCannedPolicy - DELETE /minio/admin/v2/remove-canned-policy?name=<policy_name>
|
||||
func (a adminAPIHandlers) RemoveCannedPolicy(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "RemoveCannedPolicy") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
policyName := vars["name"] |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err := globalIAMSys.DeletePolicy(policyName); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to delete policy
|
||||
for _, nerr := range globalNotificationSys.DeletePolicy(policyName) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// AddCannedPolicy - PUT /minio/admin/v2/add-canned-policy?name=<policy_name>
|
||||
func (a adminAPIHandlers) AddCannedPolicy(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "AddCannedPolicy") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
policyName := vars["name"] |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Error out if Content-Length is missing.
|
||||
if r.ContentLength <= 0 { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMissingContentLength), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Error out if Content-Length is beyond allowed size.
|
||||
if r.ContentLength > maxBucketPolicySize { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrEntityTooLarge), r.URL) |
||||
return |
||||
} |
||||
|
||||
iamPolicy, err := iampolicy.ParseConfig(io.LimitReader(r.Body, r.ContentLength)) |
||||
if err != nil { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMalformedPolicy), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Version in policy must not be empty
|
||||
if iamPolicy.Version == "" { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMalformedPolicy), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err = globalIAMSys.SetPolicy(policyName, *iamPolicy); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to reload policy
|
||||
for _, nerr := range globalNotificationSys.LoadPolicy(policyName) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// SetPolicyForUserOrGroup - PUT /minio/admin/v2/set-policy?policy=xxx&user-or-group=?[&is-group]
|
||||
func (a adminAPIHandlers) SetPolicyForUserOrGroup(w http.ResponseWriter, r *http.Request) { |
||||
ctx := newContext(r, w, "SetPolicyForUserOrGroup") |
||||
|
||||
objectAPI := validateAdminUsersReq(ctx, w, r) |
||||
if objectAPI == nil { |
||||
return |
||||
} |
||||
|
||||
vars := mux.Vars(r) |
||||
policyName := vars["policyName"] |
||||
entityName := vars["userOrGroup"] |
||||
isGroup := vars["isGroup"] == "true" |
||||
|
||||
// Deny if WORM is enabled
|
||||
if globalWORMEnabled { |
||||
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrMethodNotAllowed), r.URL) |
||||
return |
||||
} |
||||
|
||||
if err := globalIAMSys.PolicyDBSet(entityName, policyName, isGroup); err != nil { |
||||
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) |
||||
return |
||||
} |
||||
|
||||
// Notify all other MinIO peers to reload policy
|
||||
for _, nerr := range globalNotificationSys.LoadPolicyMapping(entityName, isGroup) { |
||||
if nerr.Err != nil { |
||||
logger.GetReqInfo(ctx).SetTags("peerAddress", nerr.Host.String()) |
||||
logger.LogIf(ctx, nerr.Err) |
||||
} |
||||
} |
||||
} |
||||
Loading…
Reference in new issue