Chung-En Lee created HDDS-16489:
-----------------------------------
Summary: Implement PutObjectRetention
Key: HDDS-16489
URL: https://issues.apache.org/jira/browse/HDDS-16489
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Chung-En Lee
mplement the S3 {{PutObjectRetention}} operation to configure or update
retention settings ({{{}GOVERNANCE{}}} or {{{}COMPLIANCE{}}}) on individual
keys in an Object-Lock-enabled bucket. This task covers S3 Gateway request
parsing, OM RPC messages, Ranger authorization, and OM HA validation rules.
{*}1. S3 Gateway ({{{}hadoop-ozone/s3gateway{}}}){*}:
* Route {{{}PUT /\{bucket}/\{key}?retention{}}}.
* Parse the incoming {{Retention}} XML payload ({{{}Mode{}}}: {{GOVERNANCE}}
or {{{}COMPLIANCE{}}}, and {{RetainUntilDate}} in ISO-8601 format).
* Parse the request header {{x-amz-bypass-governance-retention}} (boolean).
* Forward the parsed retention configuration and bypass flag to Ozone Manager
via client protocol.
* Map errors to standard S3 responses (e.g., {{{}InvalidArgument{}}},
{{{}AccessDenied{}}}, {{{}NoSuchKey{}}}).
{*}2. Protobuf Protocol ({{{}OmClientProtocol.proto{}}}){*}:
* Add client RPC messages:
** {{SetObjectRetentionRequest}} (contains {{{}volumeName{}}},
{{{}bucketName{}}}, {{{}keyName{}}}, {{{}RetentionConfig{}}}, and
{{bypassGovernanceRetention}} flag).
** {{{}SetObjectRetentionResponse{}}}.
* Register request in OM dispatching pipeline.
{*}3. {{OMKeySetRetentionRequest}}{*}:
* {*}{{preExecute}}{*}:
** Authorize the caller against Ranger action {{{}PutObjectRetention{}}}.
** If {{bypassGovernanceRetention}} is {{{}true{}}}, additionally authorize
against Ranger action {{{}BypassGovernanceRetention{}}}.
** Validate payload parameters (e.g., valid timestamp format,
{{RetainUntilDate}} must be in the future).
* {*}{{validateAndUpdateCache}}{*}:
** Acquire key write lock.
** Verify target bucket has {{{}objectLockEnabled == true{}}}; reject if
Object Lock is disabled on the bucket.
** Fetch current {{OmKeyInfo}} from {{{}KeyTable{}}}. If absent, throw
{{{}KEY_NOT_FOUND{}}}.
** Evaluate transition rules:
*** {*}Compliance Mode{*}: If the key is currently locked in {{COMPLIANCE}}
mode:
**** The new mode MUST remain {{COMPLIANCE}} (cannot switch to
{{{}GOVERNANCE{}}}).
**** The new {{RetainUntilDate}} MUST be $\ge$ the existing
{{RetainUntilDate}} (cannot shorten retention period).
*** {*}Governance Mode{*}: If shortening retention duration or overwriting an
unexpired governance lock:
**** Caller must have verified {{BypassGovernanceRetention}} permission AND
passed {{{}bypassGovernanceRetention == true{}}}; otherwise reject with
{{{}AccessDenied{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
