errose28 commented on code in PR #3303:
URL: https://github.com/apache/ozone/pull/3303#discussion_r849806971
##########
hadoop-hdds/docs/content/feature/S3-Multi-Tenancy-Access-Control.md:
##########
@@ -66,3 +67,17 @@ The Ranger Sync thread does the following:
2. Checks if default tenant roles are out-of-sync (could be caused by OM crash
during user assign/revoke operation). Overwrites them if this is the case.
3. Performs all Ranger update (write) operations queued by Ozone tenant
commands from the last sync, if any.
- This implies there will be a delay before Ranger policies and roles are
updated for any tenant write operations (tenant create/delete, tenant user
assign/revoke/assignadmin/revokeadmin, etc.).
+
+
+## Sharing a bucket
+
+By default only the bucket owners have full access to the buckets they created.
+So in order to share a bucket with other users, a cluster admin or tenant
admin will needs to manually create a new Ozone policy in Ranger for that
bucket.
+
+Further, if a cluster admin or tenant admin wants the bucket owner (who is a
regular tenant user without any superuser privileges) to be able to edit that
bucket's policy,
+when manually creating a new Ozone policy in Ranger for that bucket,
+an admin will need to explicitly grant the bucket owner user (note: specify an
actual user name, `{OWNER}` tag should not be used here) ALL permission
Review Comment:
Can we add a quick explanation why {OWNER} cannot be used?
##########
hadoop-hdds/docs/content/feature/S3-Multi-Tenancy-Access-Control.md:
##########
@@ -66,3 +67,17 @@ The Ranger Sync thread does the following:
2. Checks if default tenant roles are out-of-sync (could be caused by OM crash
during user assign/revoke operation). Overwrites them if this is the case.
3. Performs all Ranger update (write) operations queued by Ozone tenant
commands from the last sync, if any.
- This implies there will be a delay before Ranger policies and roles are
updated for any tenant write operations (tenant create/delete, tenant user
assign/revoke/assignadmin/revokeadmin, etc.).
+
+
+## Sharing a bucket
+
+By default only the bucket owners have full access to the buckets they created.
+So in order to share a bucket with other users, a cluster admin or tenant
admin will needs to manually create a new Ozone policy in Ranger for that
bucket.
Review Comment:
Have we tested this process? Is the bucket policy going to conflict with the
bucket policy being created as part of the tenant?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
