diff --git a/client/.kubeapilint.yaml b/client/.kubeapilint.yaml index 6bc873fc..ec251563 100644 --- a/client/.kubeapilint.yaml +++ b/client/.kubeapilint.yaml @@ -18,6 +18,7 @@ linters: - statussubresource - optionalfields # instead of nonpointerstructs - requiredfields # instead of nonpointerstructs + - maxlength disable: - nonpointerstructs # not intended for CRDs - statusoptional diff --git a/client/apis/objectstorage/v1alpha2/bucket_types.go b/client/apis/objectstorage/v1alpha2/bucket_types.go index de61d68a..9797f933 100644 --- a/client/apis/objectstorage/v1alpha2/bucket_types.go +++ b/client/apis/objectstorage/v1alpha2/bucket_types.go @@ -42,8 +42,13 @@ const ( // +kubebuilder:validation:XValidation:message="existingBucketID cannot be added or removed after creation",rule="has(oldSelf.existingBucketID) == has(self.existingBucketID)" type BucketSpec struct { // driverName is the name of the driver that fulfills requests for this Bucket. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` // +kubebuilder:validation:XValidation:message="driverName is immutable",rule="self == oldSelf" DriverName string `json:"driverName,omitempty"` @@ -57,29 +62,41 @@ type BucketSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this Bucket. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 // +kubebuilder:validation:XValidation:message="parameters map is immutable",rule="self == oldSelf" Parameters map[string]string `json:"parameters,omitempty"` // protocols lists object store protocols that the provisioned Bucket must support. // If specified, COSI will verify that each item is advertised as supported by the driver. + // See driver documentation to determine supported protocols. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 // +kubebuilder:validation:XValidation:message="protocols list is immutable",rule="self == oldSelf" Protocols []ObjectProtocol `json:"protocols,omitempty"` - // bucketClaim references the BucketClaim that resulted in the creation of this Bucket. + // bucketClaimRef references the BucketClaim that resulted in the creation of this Bucket. // For statically-provisioned buckets, set the namespace and name of the BucketClaim that is - // allowed to bind to this Bucket. + // allowed to bind to this Bucket; UID may be left unset if desired and will be updated by COSI. // +required - BucketClaimRef BucketClaimReference `json:"bucketClaim,omitzero"` + BucketClaimRef BucketClaimReference `json:"bucketClaimRef,omitzero"` // existingBucketID is the unique identifier for an existing backend bucket known to the driver. - // Use driver documentation to determine how to set this value. - // This field is used only for Bucket static provisioning. + // Use driver documentation to determine the correct value to set. + // This field is used only for static Bucket provisioning. // This field will be empty when the Bucket is dynamically provisioned from a BucketClaim. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="existingBucketID is immutable",rule="self == oldSelf" ExistingBucketID string `json:"existingBucketID,omitempty"` } @@ -89,21 +106,34 @@ type BucketSpec struct { // +kubebuilder:validation:XValidation:message="uid cannot be removed once set",rule="!has(oldSelf.uid) || has(self.uid)" type BucketClaimReference struct { // name is the name of the BucketClaim being referenced. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="name is immutable",rule="self == oldSelf" Name string `json:"name,omitempty"` // namespace is the namespace of the BucketClaim being referenced. + // Must be a valid Kubernetes Namespace name: at most 63 characters, consisting only of + // lower-case alphanumeric characters and hyphens, starting and ending with alphanumerics. // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:message="namespace must be a valid namespace name",rule="!format.dns1123Label().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="namespace is immutable",rule="self == oldSelf" Namespace string `json:"namespace,omitempty"` // uid is the UID of the BucketClaim being referenced. + // Must be a valid Kubernetes UID: RFC 4122 form with lowercase hexadecimal characters + // (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). // +optional + // +kubebuilder:validation:MinLength=36 + // +kubebuilder:validation:MaxLength=36 + // +kubebuilder:validation:Type=string + // +kubebuilder:validation:Pattern=`^[0-9a-f]{8}-([0-9a-f]{4}\-){3}[0-9a-f]{12}$` // +kubebuilder:validation:XValidation:message="uid is immutable once set",rule="oldSelf == '' || self == oldSelf" UID types.UID `json:"uid,omitempty"` } @@ -117,15 +147,22 @@ type BucketStatus struct { ReadyToUse *bool `json:"readyToUse,omitempty"` // bucketID is the unique identifier for the backend bucket known to the driver. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="boundBucketName is immutable once set",rule="self == oldSelf" BucketID string `json:"bucketID,omitempty"` // protocols is the set of protocols the Bucket reports to support. BucketAccesses can request - // access to this BucketClaim using any of the protocols reported here. + // access to this Bucket using any of the protocols reported here. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 Protocols []ObjectProtocol `json:"protocols,omitempty"` // bucketInfo contains info about the bucket reported by the driver, rendered in the same @@ -133,6 +170,8 @@ type BucketStatus struct { // e.g., COSI_S3_ENDPOINT, COSI_AZURE_STORAGE_ACCOUNT. // This should not contain any sensitive information. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=128 BucketInfo map[string]string `json:"bucketInfo,omitempty"` // error holds the most recent error message, with a timestamp. diff --git a/client/apis/objectstorage/v1alpha2/bucketaccess_types.go b/client/apis/objectstorage/v1alpha2/bucketaccess_types.go index 2cde1de1..04fbcaa1 100644 --- a/client/apis/objectstorage/v1alpha2/bucketaccess_types.go +++ b/client/apis/objectstorage/v1alpha2/bucketaccess_types.go @@ -58,11 +58,13 @@ type BucketAccessSpec struct { // bucketClaims is a list of BucketClaims the provisioned access must have permissions for, // along with per-BucketClaim access parameters and system output definitions. // At least one BucketClaim must be referenced. + // A maximum of 128 BucketClaims may be referenced. // Multiple references to the same BucketClaim are not permitted. // +required // +listType=map // +listMapKey=bucketClaimName // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=128 // +kubebuilder:validation:XValidation:message="bucketClaims list is immutable",rule="self == oldSelf" BucketClaims []BucketClaimAccess `json:"bucketClaims,omitempty"` @@ -74,16 +76,18 @@ type BucketAccessSpec struct { BucketAccessClassName string `json:"bucketAccessClassName,omitempty"` // protocol is the object storage protocol that the provisioned access must use. + // Access can only be granted for BucketClaims that support the requested protocol. + // Each BucketClaim status reports which protocols are supported for the BucketClaim's bucket. + // Possible values: 'S3', 'Azure', 'GCS'. // +required // +kubebuilder:validation:XValidation:message="protocol is immutable",rule="self == oldSelf" Protocol ObjectProtocol `json:"protocol,omitempty"` // serviceAccountName is the name of the Kubernetes ServiceAccount that user application Pods // intend to use for access to referenced BucketClaims. - // This has different behavior based on the BucketAccessClass's defined AuthenticationType: - // - Key: This field is ignored. - // - ServiceAccount: This field is required. The driver should configure the system so that Pods - // using the ServiceAccount authenticate to the object storage backend automatically. + // Required when the BucketAccessClass is configured to use ServiceAccount authentication type. + // Ignored for all other authentication types. + // It is recommended to specify this for all BucketAccesses to improve portability. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 @@ -104,8 +108,12 @@ type BucketAccessStatus struct { // accountID is the unique identifier for the backend access known to the driver. // This field is populated by the COSI Sidecar once access has been successfully granted. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="accountId is immutable once set",rule="self == oldSelf" AccountID string `json:"accountID,omitempty"` @@ -116,18 +124,26 @@ type BucketAccessStatus struct { // +listType=map // +listMapKey=bucketName // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=128 // +kubebuilder:validation:XValidation:message="accessedBuckets is immutable once set",rule="self == oldSelf" AccessedBuckets []AccessedBucket `json:"accessedBuckets,omitempty"` // driverName holds a copy of the BucketAccessClass driver name from the time of BucketAccess // provisioning. This field is populated by the COSI Controller. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` // +kubebuilder:validation:XValidation:message="driverName is immutable once set",rule="self == oldSelf" DriverName string `json:"driverName,omitempty"` // authenticationType holds a copy of the BucketAccessClass authentication type from the time of // BucketAccess provisioning. This field is populated by the COSI Controller. + // Possible values: + // - Key: clients may use a protocol-appropriate access key to authenticate to the backend object store. + // - ServiceAccount: Pods using the ServiceAccount given in spec.serviceAccountName may authenticate to the backend object store automatically. // +optional // +kubebuilder:validation:XValidation:message="authenticationType is immutable once set",rule="self == oldSelf" AuthenticationType BucketAccessAuthenticationType `json:"authenticationType,omitempty"` @@ -135,6 +151,8 @@ type BucketAccessStatus struct { // parameters holds a copy of the BucketAccessClass parameters from the time of BucketAccess // provisioning. This field is populated by the COSI Controller. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 // +kubebuilder:validation:XValidation:message="accessedBuckets is immutable once set",rule="self == oldSelf" Parameters map[string]string `json:"parameters,omitempty"` @@ -150,13 +168,22 @@ type BucketAccessStatus struct { type BucketClaimAccess struct { // bucketClaimName is the name of a BucketClaim the access should have permissions for. // The BucketClaim must be in the same Namespace as the BucketAccess. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketClaimName string `json:"bucketClaimName,omitempty"` // accessMode is the Read/Write access mode that the access should have for the bucket. - // Possible values: ReadWrite, ReadOnly, WriteOnly. + // The provisioned access will have the corresponding permissions to read and/or write objects + // the BucketClaim's bucket. + // The provisioned access can also assume to have corresponding permissions to read and/or write + // object metadata and object metadata (e.g., tags) except when metadata changes would change + // object store behaviors or permissions (e.g., changes to object caching behaviors). + // Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. // +required AccessMode BucketAccessMode `json:"accessMode,omitempty"` @@ -166,24 +193,36 @@ type BucketClaimAccess struct { // BucketAccess is deleted and deprovisioned. // The Secret name must be unique across all bucketClaimRefs for all BucketAccesses in the same // Namespace. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" AccessSecretName string `json:"accessSecretName,omitempty"` } // AccessedBucket identifies a Bucket and correlates it to a BucketClaimAccess from the spec. type AccessedBucket struct { // bucketName is the name of a Bucket the access should have permissions for. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketName string `json:"bucketName,omitempty"` // bucketClaimName must match a BucketClaimAccess's BucketClaimName from the spec. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketClaimName string `json:"bucketClaimName,omitempty"` } diff --git a/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go b/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go index ed645d08..107a37f4 100644 --- a/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go +++ b/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go @@ -23,11 +23,17 @@ import ( // BucketAccessClassSpec defines the desired state of BucketAccessClass type BucketAccessClassSpec struct { // driverName is the name of the driver that fulfills requests for this BucketAccessClass. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` DriverName string `json:"driverName,omitempty"` // authenticationType specifies which authentication mechanism is used bucket access. + // See driver documentation to determine which values are supported. // Possible values: // - Key: The driver should generate a protocol-appropriate access key that clients can use to // authenticate to the backend object store. @@ -38,7 +44,11 @@ type BucketAccessClassSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this BucketAccessClass. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 Parameters map[string]string `json:"parameters,omitempty"` // featureOptions can be used to adjust various COSI access provisioning behaviors. @@ -53,8 +63,13 @@ type BucketAccessFeatureOptions struct { // disallowedBucketAccessModes is a list of disallowed Read/Write access modes. A BucketAccess // using this class will not be allowed to request access to a BucketClaim with any access mode // listed here. + // This is particularly useful for administrators to restrict access to a statically-provisioned + // bucket that is managed outside the BucketAccess Namespace or Kubernetes cluster. + // Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 DisallowedBucketAccessModes []BucketAccessMode `json:"disallowedBucketAccessModes,omitempty"` // disallowMultiBucketAccess disables the ability for a BucketAccess to reference multiple diff --git a/client/apis/objectstorage/v1alpha2/bucketclaim_types.go b/client/apis/objectstorage/v1alpha2/bucketclaim_types.go index a71d31a0..be83c445 100644 --- a/client/apis/objectstorage/v1alpha2/bucketclaim_types.go +++ b/client/apis/objectstorage/v1alpha2/bucketclaim_types.go @@ -30,16 +30,25 @@ type BucketClaimSpec struct { // bucketClassName selects the BucketClass for provisioning the BucketClaim. // This field is used only for BucketClaim dynamic provisioning. // If unspecified, existingBucketName must be specified for binding to an existing Bucket. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="bucketClassName is immutable",rule="self == oldSelf" BucketClassName string `json:"bucketClassName,omitempty"` // protocols lists object storage protocols that the provisioned Bucket must support. // If specified, COSI will verify that each item is advertised as supported by the driver. + // It is recommended to specify all protocols that applications will rely on in BucketAccesses + // referencing this BucketClaim. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 // +kubebuilder:validation:XValidation:message="protocols list is immutable",rule="self == oldSelf" Protocols []ObjectProtocol `json:"protocols,omitempty"` @@ -47,9 +56,13 @@ type BucketClaimSpec struct { // should bind to. // This field is used only for BucketClaim static provisioning. // If unspecified, bucketClassName must be specified for dynamically provisioning a new bucket. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="existingBucketName is immutable",rule="self == oldSelf" ExistingBucketName string `json:"existingBucketName,omitempty"` } @@ -59,9 +72,13 @@ type BucketClaimSpec struct { // +kubebuilder:validation:XValidation:message="protocols cannot be removed once set",rule="!has(oldSelf.protocols) || has(self.protocols)" type BucketClaimStatus struct { // boundBucketName is the name of the Bucket this BucketClaim is bound to. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="boundBucketName is immutable once set",rule="self == oldSelf" BoundBucketName string `json:"boundBucketName,omitempty"` @@ -71,8 +88,11 @@ type BucketClaimStatus struct { // protocols is the set of protocols the bound Bucket reports to support. BucketAccesses can // request access to this BucketClaim using any of the protocols reported here. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 Protocols []ObjectProtocol `json:"protocols,omitempty"` // error holds the most recent error message, with a timestamp. diff --git a/client/apis/objectstorage/v1alpha2/bucketclass_types.go b/client/apis/objectstorage/v1alpha2/bucketclass_types.go index d9087216..d40e0061 100644 --- a/client/apis/objectstorage/v1alpha2/bucketclass_types.go +++ b/client/apis/objectstorage/v1alpha2/bucketclass_types.go @@ -23,8 +23,13 @@ import ( // BucketClassSpec defines the BucketClass. type BucketClassSpec struct { // driverName is the name of the driver that fulfills requests for this BucketClass. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` DriverName string `json:"driverName,omitempty"` // deletionPolicy determines whether a Bucket created through the BucketClass should be deleted @@ -37,7 +42,11 @@ type BucketClassSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this BucketClass. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 Parameters map[string]string `json:"parameters,omitempty"` } diff --git a/client/apis/objectstorage/v1alpha2/shared_types.go b/client/apis/objectstorage/v1alpha2/shared_types.go index c27ee6b8..e22aaedc 100644 --- a/client/apis/objectstorage/v1alpha2/shared_types.go +++ b/client/apis/objectstorage/v1alpha2/shared_types.go @@ -35,7 +35,10 @@ type TimestampedError struct { // message is a string detailing the encountered error. // NOTE: message will be logged, and it should not contain sensitive information. + // Must not exceed 1.5MB. // +optional + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=1572864 Message *string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"` } diff --git a/client/config/crd/objectstorage.k8s.io_bucketaccessclasses.yaml b/client/config/crd/objectstorage.k8s.io_bucketaccessclasses.yaml index 14bebdc3..714931ab 100644 --- a/client/config/crd/objectstorage.k8s.io_bucketaccessclasses.yaml +++ b/client/config/crd/objectstorage.k8s.io_bucketaccessclasses.yaml @@ -43,6 +43,7 @@ spec: authenticationType: description: |- authenticationType specifies which authentication mechanism is used bucket access. + See driver documentation to determine which values are supported. Possible values: - Key: The driver should generate a protocol-appropriate access key that clients can use to authenticate to the backend object store. @@ -53,9 +54,14 @@ spec: - ServiceAccount type: string driverName: - description: driverName is the name of the driver that fulfills requests - for this BucketAccessClass. + description: |- + driverName is the name of the driver that fulfills requests for this BucketAccessClass. + See driver documentation to determine the correct value to set. + Must be 63 characters or less, beginning and ending with an alphanumeric character + ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. + maxLength: 63 minLength: 1 + pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$ type: string featureOptions: description: |- @@ -73,6 +79,9 @@ spec: disallowedBucketAccessModes is a list of disallowed Read/Write access modes. A BucketAccess using this class will not be allowed to request access to a BucketClaim with any access mode listed here. + This is particularly useful for administrators to restrict access to a statically-provisioned + bucket that is managed outside the BucketAccess Namespace or Kubernetes cluster. + Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. items: description: BucketAccessMode describes the Read/Write mode an access should have for a bucket. @@ -81,6 +90,8 @@ spec: - ReadOnly - WriteOnly type: string + maxItems: 3 + minItems: 1 type: array x-kubernetes-list-type: set type: object @@ -90,6 +101,10 @@ spec: description: |- parameters is an opaque map of driver-specific configuration items passed to the driver that fulfills requests for this BucketAccessClass. + See driver documentation to determine supported parameters and their effects. + A maximum of 512 parameters are allowed. + maxProperties: 512 + minProperties: 1 type: object required: - authenticationType diff --git a/client/config/crd/objectstorage.k8s.io_bucketaccesses.yaml b/client/config/crd/objectstorage.k8s.io_bucketaccesses.yaml index 5db22b55..a0e6a269 100644 --- a/client/config/crd/objectstorage.k8s.io_bucketaccesses.yaml +++ b/client/config/crd/objectstorage.k8s.io_bucketaccesses.yaml @@ -54,6 +54,7 @@ spec: bucketClaims is a list of BucketClaims the provisioned access must have permissions for, along with per-BucketClaim access parameters and system output definitions. At least one BucketClaim must be referenced. + A maximum of 128 BucketClaims may be referenced. Multiple references to the same BucketClaim are not permitted. items: description: |- @@ -64,7 +65,12 @@ spec: accessMode: description: |- accessMode is the Read/Write access mode that the access should have for the bucket. - Possible values: ReadWrite, ReadOnly, WriteOnly. + The provisioned access will have the corresponding permissions to read and/or write objects + the BucketClaim's bucket. + The provisioned access can also assume to have corresponding permissions to read and/or write + object metadata and object metadata (e.g., tags) except when metadata changes would change + object store behaviors or permissions (e.g., changes to object caching behaviors). + Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. enum: - ReadWrite - ReadOnly @@ -78,21 +84,34 @@ spec: BucketAccess is deleted and deprovisioned. The Secret name must be unique across all bucketClaimRefs for all BucketAccesses in the same Namespace. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string + x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' bucketClaimName: description: |- bucketClaimName is the name of a BucketClaim the access should have permissions for. The BucketClaim must be in the same Namespace as the BucketAccess. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string + x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' required: - accessMode - accessSecretName - bucketClaimName type: object + maxItems: 128 minItems: 1 type: array x-kubernetes-list-map-keys: @@ -102,8 +121,11 @@ spec: - message: bucketClaims list is immutable rule: self == oldSelf protocol: - description: protocol is the object storage protocol that the provisioned - access must use. + description: |- + protocol is the object storage protocol that the provisioned access must use. + Access can only be granted for BucketClaims that support the requested protocol. + Each BucketClaim status reports which protocols are supported for the BucketClaim's bucket. + Possible values: 'S3', 'Azure', 'GCS'. enum: - S3 - Azure @@ -116,10 +138,9 @@ spec: description: |- serviceAccountName is the name of the Kubernetes ServiceAccount that user application Pods intend to use for access to referenced BucketClaims. - This has different behavior based on the BucketAccessClass's defined AuthenticationType: - - Key: This field is ignored. - - ServiceAccount: This field is required. The driver should configure the system so that Pods - using the ServiceAccount authenticate to the object storage backend automatically. + Required when the BucketAccessClass is configured to use ServiceAccount authentication type. + Ignored for all other authentication types. + It is recommended to specify this for all BucketAccesses to improve portability. maxLength: 253 minLength: 1 type: string @@ -147,21 +168,34 @@ spec: to a BucketClaimAccess from the spec. properties: bucketClaimName: - description: bucketClaimName must match a BucketClaimAccess's - BucketClaimName from the spec. + description: |- + bucketClaimName must match a BucketClaimAccess's BucketClaimName from the spec. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string + x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' bucketName: - description: bucketName is the name of a Bucket the access should - have permissions for. + description: |- + bucketName is the name of a Bucket the access should have permissions for. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string + x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' required: - bucketClaimName - bucketName type: object + maxItems: 128 minItems: 1 type: array x-kubernetes-list-map-keys: @@ -174,7 +208,11 @@ spec: description: |- accountID is the unique identifier for the backend access known to the driver. This field is populated by the COSI Sidecar once access has been successfully granted. + Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + dashes (-), dots (.), underscores (_), and forward slash (/). + maxLength: 2048 minLength: 1 + pattern: ^[a-zA-Z0-9/._-]+$ type: string x-kubernetes-validations: - message: accountId is immutable once set @@ -183,6 +221,9 @@ spec: description: |- authenticationType holds a copy of the BucketAccessClass authentication type from the time of BucketAccess provisioning. This field is populated by the COSI Controller. + Possible values: + - Key: clients may use a protocol-appropriate access key to authenticate to the backend object store. + - ServiceAccount: Pods using the ServiceAccount given in spec.serviceAccountName may authenticate to the backend object store automatically. enum: - Key - ServiceAccount @@ -194,7 +235,11 @@ spec: description: |- driverName holds a copy of the BucketAccessClass driver name from the time of BucketAccess provisioning. This field is populated by the COSI Controller. + Must be 63 characters or less, beginning and ending with an alphanumeric character + ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. + maxLength: 63 minLength: 1 + pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$ type: string x-kubernetes-validations: - message: driverName is immutable once set @@ -208,6 +253,9 @@ spec: description: |- message is a string detailing the encountered error. NOTE: message will be logged, and it should not contain sensitive information. + Must not exceed 1.5MB. + maxLength: 1572864 + minLength: 0 type: string time: description: time is the timestamp when the error was encountered. @@ -220,6 +268,8 @@ spec: description: |- parameters holds a copy of the BucketAccessClass parameters from the time of BucketAccess provisioning. This field is populated by the COSI Controller. + maxProperties: 512 + minProperties: 1 type: object x-kubernetes-validations: - message: accessedBuckets is immutable once set diff --git a/client/config/crd/objectstorage.k8s.io_bucketclaims.yaml b/client/config/crd/objectstorage.k8s.io_bucketclaims.yaml index 129920e6..89825f4a 100644 --- a/client/config/crd/objectstorage.k8s.io_bucketclaims.yaml +++ b/client/config/crd/objectstorage.k8s.io_bucketclaims.yaml @@ -46,10 +46,15 @@ spec: bucketClassName selects the BucketClass for provisioning the BucketClaim. This field is used only for BucketClaim dynamic provisioning. If unspecified, existingBucketName must be specified for binding to an existing Bucket. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' - message: bucketClassName is immutable rule: self == oldSelf existingBucketName: @@ -58,16 +63,24 @@ spec: should bind to. This field is used only for BucketClaim static provisioning. If unspecified, bucketClassName must be specified for dynamically provisioning a new bucket. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' - message: existingBucketName is immutable rule: self == oldSelf protocols: description: |- protocols lists object storage protocols that the provisioned Bucket must support. If specified, COSI will verify that each item is advertised as supported by the driver. + It is recommended to specify all protocols that applications will rely on in BucketAccesses + referencing this BucketClaim. + Possible values: 'S3', 'Azure', 'GCS'. items: description: ObjectProtocol represents an object protocol type. enum: @@ -75,6 +88,8 @@ spec: - Azure - GCS type: string + maxItems: 3 + minItems: 1 type: array x-kubernetes-list-type: set x-kubernetes-validations: @@ -96,12 +111,17 @@ spec: description: status defines the observed state of BucketClaim properties: boundBucketName: - description: boundBucketName is the name of the Bucket this BucketClaim - is bound to. + description: |- + boundBucketName is the name of the Bucket this BucketClaim is bound to. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' - message: boundBucketName is immutable once set rule: self == oldSelf error: @@ -113,6 +133,9 @@ spec: description: |- message is a string detailing the encountered error. NOTE: message will be logged, and it should not contain sensitive information. + Must not exceed 1.5MB. + maxLength: 1572864 + minLength: 0 type: string time: description: time is the timestamp when the error was encountered. @@ -123,6 +146,7 @@ spec: description: |- protocols is the set of protocols the bound Bucket reports to support. BucketAccesses can request access to this BucketClaim using any of the protocols reported here. + Possible values: 'S3', 'Azure', 'GCS'. items: description: ObjectProtocol represents an object protocol type. enum: @@ -130,6 +154,8 @@ spec: - Azure - GCS type: string + maxItems: 3 + minItems: 1 type: array x-kubernetes-list-type: set readyToUse: diff --git a/client/config/crd/objectstorage.k8s.io_bucketclasses.yaml b/client/config/crd/objectstorage.k8s.io_bucketclasses.yaml index efebe8e5..8b314abc 100644 --- a/client/config/crd/objectstorage.k8s.io_bucketclasses.yaml +++ b/client/config/crd/objectstorage.k8s.io_bucketclasses.yaml @@ -56,9 +56,14 @@ spec: - Delete type: string driverName: - description: driverName is the name of the driver that fulfills requests - for this BucketClass. + description: |- + driverName is the name of the driver that fulfills requests for this BucketClass. + See driver documentation to determine the correct value to set. + Must be 63 characters or less, beginning and ending with an alphanumeric character + ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. + maxLength: 63 minLength: 1 + pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$ type: string parameters: additionalProperties: @@ -66,6 +71,10 @@ spec: description: |- parameters is an opaque map of driver-specific configuration items passed to the driver that fulfills requests for this BucketClass. + See driver documentation to determine supported parameters and their effects. + A maximum of 512 parameters are allowed. + maxProperties: 512 + minProperties: 1 type: object required: - deletionPolicy diff --git a/client/config/crd/objectstorage.k8s.io_buckets.yaml b/client/config/crd/objectstorage.k8s.io_buckets.yaml index ea52a80c..0840853a 100644 --- a/client/config/crd/objectstorage.k8s.io_buckets.yaml +++ b/client/config/crd/objectstorage.k8s.io_buckets.yaml @@ -40,31 +40,47 @@ spec: spec: description: spec defines the desired state of Bucket properties: - bucketClaim: + bucketClaimRef: description: |- - bucketClaim references the BucketClaim that resulted in the creation of this Bucket. + bucketClaimRef references the BucketClaim that resulted in the creation of this Bucket. For statically-provisioned buckets, set the namespace and name of the BucketClaim that is - allowed to bind to this Bucket. + allowed to bind to this Bucket; UID may be left unset if desired and will be updated by COSI. properties: name: - description: name is the name of the BucketClaim being referenced. + description: |- + name is the name of the BucketClaim being referenced. + Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + alphanumeric character. maxLength: 253 minLength: 1 type: string x-kubernetes-validations: + - message: name must be a valid resource name + rule: '!format.dns1123Subdomain().validate(self).hasValue()' - message: name is immutable rule: self == oldSelf namespace: - description: namespace is the namespace of the BucketClaim being - referenced. - maxLength: 253 + description: |- + namespace is the namespace of the BucketClaim being referenced. + Must be a valid Kubernetes Namespace name: at most 63 characters, consisting only of + lower-case alphanumeric characters and hyphens, starting and ending with alphanumerics. + maxLength: 63 minLength: 1 type: string x-kubernetes-validations: + - message: namespace must be a valid namespace name + rule: '!format.dns1123Label().validate(self).hasValue()' - message: namespace is immutable rule: self == oldSelf uid: - description: uid is the UID of the BucketClaim being referenced. + description: |- + uid is the UID of the BucketClaim being referenced. + Must be a valid Kubernetes UID: RFC 4122 form with lowercase hexadecimal characters + (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). + maxLength: 36 + minLength: 36 + pattern: ^[0-9a-f]{8}-([0-9a-f]{4}\-){3}[0-9a-f]{12}$ type: string x-kubernetes-validations: - message: uid is immutable once set @@ -90,9 +106,14 @@ spec: - Delete type: string driverName: - description: driverName is the name of the driver that fulfills requests - for this Bucket. + description: |- + driverName is the name of the driver that fulfills requests for this Bucket. + See driver documentation to determine the correct value to set. + Must be 63 characters or less, beginning and ending with an alphanumeric character + ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. + maxLength: 63 minLength: 1 + pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$ type: string x-kubernetes-validations: - message: driverName is immutable @@ -100,10 +121,14 @@ spec: existingBucketID: description: |- existingBucketID is the unique identifier for an existing backend bucket known to the driver. - Use driver documentation to determine how to set this value. - This field is used only for Bucket static provisioning. + Use driver documentation to determine the correct value to set. + This field is used only for static Bucket provisioning. This field will be empty when the Bucket is dynamically provisioned from a BucketClaim. + Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + dashes (-), dots (.), underscores (_), and forward slash (/). + maxLength: 2048 minLength: 1 + pattern: ^[a-zA-Z0-9/._-]+$ type: string x-kubernetes-validations: - message: existingBucketID is immutable @@ -114,6 +139,10 @@ spec: description: |- parameters is an opaque map of driver-specific configuration items passed to the driver that fulfills requests for this Bucket. + See driver documentation to determine supported parameters and their effects. + A maximum of 512 parameters are allowed. + maxProperties: 512 + minProperties: 1 type: object x-kubernetes-validations: - message: parameters map is immutable @@ -122,6 +151,8 @@ spec: description: |- protocols lists object store protocols that the provisioned Bucket must support. If specified, COSI will verify that each item is advertised as supported by the driver. + See driver documentation to determine supported protocols. + Possible values: 'S3', 'Azure', 'GCS'. items: description: ObjectProtocol represents an object protocol type. enum: @@ -129,13 +160,15 @@ spec: - Azure - GCS type: string + maxItems: 3 + minItems: 1 type: array x-kubernetes-list-type: set x-kubernetes-validations: - message: protocols list is immutable rule: self == oldSelf required: - - bucketClaim + - bucketClaimRef - deletionPolicy - driverName type: object @@ -150,9 +183,13 @@ spec: description: status defines the observed state of Bucket properties: bucketID: - description: bucketID is the unique identifier for the backend bucket - known to the driver. + description: |- + bucketID is the unique identifier for the backend bucket known to the driver. + Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + dashes (-), dots (.), underscores (_), and forward slash (/). + maxLength: 2048 minLength: 1 + pattern: ^[a-zA-Z0-9/._-]+$ type: string x-kubernetes-validations: - message: boundBucketName is immutable once set @@ -165,6 +202,8 @@ spec: COSI__ format used for the BucketAccess Secret. e.g., COSI_S3_ENDPOINT, COSI_AZURE_STORAGE_ACCOUNT. This should not contain any sensitive information. + maxProperties: 128 + minProperties: 1 type: object error: description: |- @@ -175,6 +214,9 @@ spec: description: |- message is a string detailing the encountered error. NOTE: message will be logged, and it should not contain sensitive information. + Must not exceed 1.5MB. + maxLength: 1572864 + minLength: 0 type: string time: description: time is the timestamp when the error was encountered. @@ -184,7 +226,8 @@ spec: protocols: description: |- protocols is the set of protocols the Bucket reports to support. BucketAccesses can request - access to this BucketClaim using any of the protocols reported here. + access to this Bucket using any of the protocols reported here. + Possible values: 'S3', 'Azure', 'GCS'. items: description: ObjectProtocol represents an object protocol type. enum: @@ -192,6 +235,8 @@ spec: - Azure - GCS type: string + maxItems: 3 + minItems: 1 type: array x-kubernetes-list-type: set readyToUse: diff --git a/docs/src/api/out.md b/docs/src/api/out.md index e1c5ff6c..91bb7cfc 100644 --- a/docs/src/api/out.md +++ b/docs/src/api/out.md @@ -35,8 +35,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `bucketName` _string_ | bucketName is the name of a Bucket the access should have permissions for. | | MaxLength: 253
MinLength: 1
| -| `bucketClaimName` _string_ | bucketClaimName must match a BucketClaimAccess's BucketClaimName from the spec. | | MaxLength: 253
MinLength: 1
| +| `bucketName` _string_ | bucketName is the name of a Bucket the access should have permissions for.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| +| `bucketClaimName` _string_ | bucketClaimName must match a BucketClaimAccess's BucketClaimName from the spec.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| #### Bucket @@ -153,9 +153,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this BucketAccessClass. | | MinLength: 1
| -| `authenticationType` _[BucketAccessAuthenticationType](#bucketaccessauthenticationtype)_ | authenticationType specifies which authentication mechanism is used bucket access.
Possible values:
- Key: The driver should generate a protocol-appropriate access key that clients can use to
authenticate to the backend object store.
- ServiceAccount: The driver should configure the system such that Pods using the given
ServiceAccount authenticate to the backend object store automatically. | | Enum: [Key ServiceAccount]
| -| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this BucketAccessClass. | | | +| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this BucketAccessClass.
See driver documentation to determine the correct value to set.
Must be 63 characters or less, beginning and ending with an alphanumeric character
([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. | | MaxLength: 63
MinLength: 1
Pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]\{0,61\}[a-zA-Z0-9])?$`
| +| `authenticationType` _[BucketAccessAuthenticationType](#bucketaccessauthenticationtype)_ | authenticationType specifies which authentication mechanism is used bucket access.
See driver documentation to determine which values are supported.
Possible values:
- Key: The driver should generate a protocol-appropriate access key that clients can use to
authenticate to the backend object store.
- ServiceAccount: The driver should configure the system such that Pods using the given
ServiceAccount authenticate to the backend object store automatically. | | Enum: [Key ServiceAccount]
| +| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this BucketAccessClass.
See driver documentation to determine supported parameters and their effects.
A maximum of 512 parameters are allowed. | | MaxProperties: 512
MinProperties: 1
| | `featureOptions` _[BucketAccessFeatureOptions](#bucketaccessfeatureoptions)_ | featureOptions can be used to adjust various COSI access provisioning behaviors.
If specified, at least one option must be set. | | MinProperties: 1
| @@ -173,7 +173,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `disallowedBucketAccessModes` _[BucketAccessMode](#bucketaccessmode) array_ | disallowedBucketAccessModes is a list of disallowed Read/Write access modes. A BucketAccess
using this class will not be allowed to request access to a BucketClaim with any access mode
listed here. | | Enum: [ReadWrite ReadOnly WriteOnly]
| +| `disallowedBucketAccessModes` _[BucketAccessMode](#bucketaccessmode) array_ | disallowedBucketAccessModes is a list of disallowed Read/Write access modes. A BucketAccess
using this class will not be allowed to request access to a BucketClaim with any access mode
listed here.
This is particularly useful for administrators to restrict access to a statically-provisioned
bucket that is managed outside the BucketAccess Namespace or Kubernetes cluster.
Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. | | Enum: [ReadWrite ReadOnly WriteOnly]
MaxItems: 3
MinItems: 1
| | `disallowMultiBucketAccess` _boolean_ | disallowMultiBucketAccess disables the ability for a BucketAccess to reference multiple
BucketClaims when set. | | | @@ -230,10 +230,10 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `bucketClaims` _[BucketClaimAccess](#bucketclaimaccess) array_ | bucketClaims is a list of BucketClaims the provisioned access must have permissions for,
along with per-BucketClaim access parameters and system output definitions.
At least one BucketClaim must be referenced.
Multiple references to the same BucketClaim are not permitted. | | MinItems: 1
| +| `bucketClaims` _[BucketClaimAccess](#bucketclaimaccess) array_ | bucketClaims is a list of BucketClaims the provisioned access must have permissions for,
along with per-BucketClaim access parameters and system output definitions.
At least one BucketClaim must be referenced.
A maximum of 128 BucketClaims may be referenced.
Multiple references to the same BucketClaim are not permitted. | | MaxItems: 128
MinItems: 1
| | `bucketAccessClassName` _string_ | bucketAccessClassName selects the BucketAccessClass for provisioning the access. | | MaxLength: 253
MinLength: 1
| -| `protocol` _[ObjectProtocol](#objectprotocol)_ | protocol is the object storage protocol that the provisioned access must use. | | Enum: [S3 Azure GCS]
| -| `serviceAccountName` _string_ | serviceAccountName is the name of the Kubernetes ServiceAccount that user application Pods
intend to use for access to referenced BucketClaims.
This has different behavior based on the BucketAccessClass's defined AuthenticationType:
- Key: This field is ignored.
- ServiceAccount: This field is required. The driver should configure the system so that Pods
using the ServiceAccount authenticate to the object storage backend automatically. | | MaxLength: 253
MinLength: 1
| +| `protocol` _[ObjectProtocol](#objectprotocol)_ | protocol is the object storage protocol that the provisioned access must use.
Access can only be granted for BucketClaims that support the requested protocol.
Each BucketClaim status reports which protocols are supported for the BucketClaim's bucket.
Possible values: 'S3', 'Azure', 'GCS'. | | Enum: [S3 Azure GCS]
| +| `serviceAccountName` _string_ | serviceAccountName is the name of the Kubernetes ServiceAccount that user application Pods
intend to use for access to referenced BucketClaims.
Required when the BucketAccessClass is configured to use ServiceAccount authentication type.
Ignored for all other authentication types.
It is recommended to specify this for all BucketAccesses to improve portability. | | MaxLength: 253
MinLength: 1
| #### BucketAccessStatus @@ -250,11 +250,11 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `readyToUse` _boolean_ | readyToUse indicates that the BucketAccess is ready for consumption by workloads. | | | -| `accountID` _string_ | accountID is the unique identifier for the backend access known to the driver.
This field is populated by the COSI Sidecar once access has been successfully granted. | | MinLength: 1
| -| `accessedBuckets` _[AccessedBucket](#accessedbucket) array_ | accessedBuckets is a list of Buckets the provisioned access must have permissions for, along
with per-Bucket access options. This field is populated by the COSI Controller based on the
referenced BucketClaims in the spec. | | MinItems: 1
| -| `driverName` _string_ | driverName holds a copy of the BucketAccessClass driver name from the time of BucketAccess
provisioning. This field is populated by the COSI Controller. | | MinLength: 1
| -| `authenticationType` _[BucketAccessAuthenticationType](#bucketaccessauthenticationtype)_ | authenticationType holds a copy of the BucketAccessClass authentication type from the time of
BucketAccess provisioning. This field is populated by the COSI Controller. | | Enum: [Key ServiceAccount]
| -| `parameters` _object (keys:string, values:string)_ | parameters holds a copy of the BucketAccessClass parameters from the time of BucketAccess
provisioning. This field is populated by the COSI Controller. | | | +| `accountID` _string_ | accountID is the unique identifier for the backend access known to the driver.
This field is populated by the COSI Sidecar once access has been successfully granted.
Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]),
dashes (-), dots (.), underscores (_), and forward slash (/). | | MaxLength: 2048
MinLength: 1
Pattern: `^[a-zA-Z0-9/._-]+$`
| +| `accessedBuckets` _[AccessedBucket](#accessedbucket) array_ | accessedBuckets is a list of Buckets the provisioned access must have permissions for, along
with per-Bucket access options. This field is populated by the COSI Controller based on the
referenced BucketClaims in the spec. | | MaxItems: 128
MinItems: 1
| +| `driverName` _string_ | driverName holds a copy of the BucketAccessClass driver name from the time of BucketAccess
provisioning. This field is populated by the COSI Controller.
Must be 63 characters or less, beginning and ending with an alphanumeric character
([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. | | MaxLength: 63
MinLength: 1
Pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]\{0,61\}[a-zA-Z0-9])?$`
| +| `authenticationType` _[BucketAccessAuthenticationType](#bucketaccessauthenticationtype)_ | authenticationType holds a copy of the BucketAccessClass authentication type from the time of
BucketAccess provisioning. This field is populated by the COSI Controller.
Possible values:
- Key: clients may use a protocol-appropriate access key to authenticate to the backend object store.
- ServiceAccount: Pods using the ServiceAccount given in spec.serviceAccountName may authenticate to the backend object store automatically. | | Enum: [Key ServiceAccount]
| +| `parameters` _object (keys:string, values:string)_ | parameters holds a copy of the BucketAccessClass parameters from the time of BucketAccess
provisioning. This field is populated by the COSI Controller. | | MaxProperties: 512
MinProperties: 1
| | `error` _[TimestampedError](#timestampederror)_ | error holds the most recent error message, with a timestamp.
This is cleared when provisioning is successful. | | | @@ -295,9 +295,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `bucketClaimName` _string_ | bucketClaimName is the name of a BucketClaim the access should have permissions for.
The BucketClaim must be in the same Namespace as the BucketAccess. | | MaxLength: 253
MinLength: 1
| -| `accessMode` _[BucketAccessMode](#bucketaccessmode)_ | accessMode is the Read/Write access mode that the access should have for the bucket.
Possible values: ReadWrite, ReadOnly, WriteOnly. | | Enum: [ReadWrite ReadOnly WriteOnly]
| -| `accessSecretName` _string_ | accessSecretName is the name of a Kubernetes Secret that COSI should create and populate with
bucket info and access credentials for the bucket.
The Secret is created in the same Namespace as the BucketAccess and is deleted when the
BucketAccess is deleted and deprovisioned.
The Secret name must be unique across all bucketClaimRefs for all BucketAccesses in the same
Namespace. | | MaxLength: 253
MinLength: 1
| +| `bucketClaimName` _string_ | bucketClaimName is the name of a BucketClaim the access should have permissions for.
The BucketClaim must be in the same Namespace as the BucketAccess.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| +| `accessMode` _[BucketAccessMode](#bucketaccessmode)_ | accessMode is the Read/Write access mode that the access should have for the bucket.
The provisioned access will have the corresponding permissions to read and/or write objects
the BucketClaim's bucket.
The provisioned access can also assume to have corresponding permissions to read and/or write
object metadata and object metadata (e.g., tags) except when metadata changes would change
object store behaviors or permissions (e.g., changes to object caching behaviors).
Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. | | Enum: [ReadWrite ReadOnly WriteOnly]
| +| `accessSecretName` _string_ | accessSecretName is the name of a Kubernetes Secret that COSI should create and populate with
bucket info and access credentials for the bucket.
The Secret is created in the same Namespace as the BucketAccess and is deleted when the
BucketAccess is deleted and deprovisioned.
The Secret name must be unique across all bucketClaimRefs for all BucketAccesses in the same
Namespace.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| #### BucketClaimList @@ -333,9 +333,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `name` _string_ | name is the name of the BucketClaim being referenced. | | MaxLength: 253
MinLength: 1
| -| `namespace` _string_ | namespace is the namespace of the BucketClaim being referenced. | | MaxLength: 253
MinLength: 1
| -| `uid` _[UID](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#uid-types-pkg)_ | uid is the UID of the BucketClaim being referenced. | | | +| `name` _string_ | name is the name of the BucketClaim being referenced.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| +| `namespace` _string_ | namespace is the namespace of the BucketClaim being referenced.
Must be a valid Kubernetes Namespace name: at most 63 characters, consisting only of
lower-case alphanumeric characters and hyphens, starting and ending with alphanumerics. | | MaxLength: 63
MinLength: 1
| +| `uid` _[UID](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#uid-types-pkg)_ | uid is the UID of the BucketClaim being referenced.
Must be a valid Kubernetes UID: RFC 4122 form with lowercase hexadecimal characters
(xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). | | MaxLength: 36
MinLength: 36
Pattern: `^[0-9a-f]\{8\}-([0-9a-f]\{4\}\-)\{3\}[0-9a-f]\{12\}$`
Type: string
| #### BucketClaimSpec @@ -352,9 +352,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `bucketClassName` _string_ | bucketClassName selects the BucketClass for provisioning the BucketClaim.
This field is used only for BucketClaim dynamic provisioning.
If unspecified, existingBucketName must be specified for binding to an existing Bucket. | | MaxLength: 253
MinLength: 1
| -| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols lists object storage protocols that the provisioned Bucket must support.
If specified, COSI will verify that each item is advertised as supported by the driver. | | Enum: [S3 Azure GCS]
| -| `existingBucketName` _string_ | existingBucketName selects the name of an existing Bucket resource that this BucketClaim
should bind to.
This field is used only for BucketClaim static provisioning.
If unspecified, bucketClassName must be specified for dynamically provisioning a new bucket. | | MaxLength: 253
MinLength: 1
| +| `bucketClassName` _string_ | bucketClassName selects the BucketClass for provisioning the BucketClaim.
This field is used only for BucketClaim dynamic provisioning.
If unspecified, existingBucketName must be specified for binding to an existing Bucket.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| +| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols lists object storage protocols that the provisioned Bucket must support.
If specified, COSI will verify that each item is advertised as supported by the driver.
It is recommended to specify all protocols that applications will rely on in BucketAccesses
referencing this BucketClaim.
Possible values: 'S3', 'Azure', 'GCS'. | | Enum: [S3 Azure GCS]
MaxItems: 3
MinItems: 1
| +| `existingBucketName` _string_ | existingBucketName selects the name of an existing Bucket resource that this BucketClaim
should bind to.
This field is used only for BucketClaim static provisioning.
If unspecified, bucketClassName must be specified for dynamically provisioning a new bucket.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| #### BucketClaimStatus @@ -370,9 +370,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `boundBucketName` _string_ | boundBucketName is the name of the Bucket this BucketClaim is bound to. | | MaxLength: 253
MinLength: 1
| +| `boundBucketName` _string_ | boundBucketName is the name of the Bucket this BucketClaim is bound to.
Must be a valid Kubernetes resource name: at most 253 characters, consisting only of
lower-case alphanumeric characters, hyphens, and periods, starting and ending with an
alphanumeric character. | | MaxLength: 253
MinLength: 1
| | `readyToUse` _boolean_ | readyToUse indicates that the bucket is ready for consumption by workloads. | | | -| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols is the set of protocols the bound Bucket reports to support. BucketAccesses can
request access to this BucketClaim using any of the protocols reported here. | | Enum: [S3 Azure GCS]
| +| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols is the set of protocols the bound Bucket reports to support. BucketAccesses can
request access to this BucketClaim using any of the protocols reported here.
Possible values: 'S3', 'Azure', 'GCS'. | | Enum: [S3 Azure GCS]
MaxItems: 3
MinItems: 1
| | `error` _[TimestampedError](#timestampederror)_ | error holds the most recent error message, with a timestamp.
This is cleared when provisioning is successful. | | | @@ -433,9 +433,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this BucketClass. | | MinLength: 1
| +| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this BucketClass.
See driver documentation to determine the correct value to set.
Must be 63 characters or less, beginning and ending with an alphanumeric character
([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. | | MaxLength: 63
MinLength: 1
Pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]\{0,61\}[a-zA-Z0-9])?$`
| | `deletionPolicy` _[BucketDeletionPolicy](#bucketdeletionpolicy)_ | deletionPolicy determines whether a Bucket created through the BucketClass should be deleted
when its bound BucketClaim is deleted.
Possible values:
- Retain: keep both the Bucket object and the backend bucket
- Delete: delete both the Bucket object and the backend bucket | | Enum: [Retain Delete]
| -| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this BucketClass. | | | +| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this BucketClass.
See driver documentation to determine supported parameters and their effects.
A maximum of 512 parameters are allowed. | | MaxProperties: 512
MinProperties: 1
| #### BucketDeletionPolicy @@ -492,12 +492,12 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this Bucket. | | MinLength: 1
| +| `driverName` _string_ | driverName is the name of the driver that fulfills requests for this Bucket.
See driver documentation to determine the correct value to set.
Must be 63 characters or less, beginning and ending with an alphanumeric character
([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. | | MaxLength: 63
MinLength: 1
Pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]\{0,61\}[a-zA-Z0-9])?$`
| | `deletionPolicy` _[BucketDeletionPolicy](#bucketdeletionpolicy)_ | deletionPolicy determines whether a Bucket should be deleted when its bound BucketClaim is
deleted. This is mutable to allow Admins to change the policy after creation.
Possible values:
- Retain: keep both the Bucket object and the backend bucket
- Delete: delete both the Bucket object and the backend bucket | | Enum: [Retain Delete]
| -| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this Bucket. | | | -| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols lists object store protocols that the provisioned Bucket must support.
If specified, COSI will verify that each item is advertised as supported by the driver. | | Enum: [S3 Azure GCS]
| -| `bucketClaim` _[BucketClaimReference](#bucketclaimreference)_ | bucketClaim references the BucketClaim that resulted in the creation of this Bucket.
For statically-provisioned buckets, set the namespace and name of the BucketClaim that is
allowed to bind to this Bucket. | | | -| `existingBucketID` _string_ | existingBucketID is the unique identifier for an existing backend bucket known to the driver.
Use driver documentation to determine how to set this value.
This field is used only for Bucket static provisioning.
This field will be empty when the Bucket is dynamically provisioned from a BucketClaim. | | MinLength: 1
| +| `parameters` _object (keys:string, values:string)_ | parameters is an opaque map of driver-specific configuration items passed to the driver that
fulfills requests for this Bucket.
See driver documentation to determine supported parameters and their effects.
A maximum of 512 parameters are allowed. | | MaxProperties: 512
MinProperties: 1
| +| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols lists object store protocols that the provisioned Bucket must support.
If specified, COSI will verify that each item is advertised as supported by the driver.
See driver documentation to determine supported protocols.
Possible values: 'S3', 'Azure', 'GCS'. | | Enum: [S3 Azure GCS]
MaxItems: 3
MinItems: 1
| +| `bucketClaimRef` _[BucketClaimReference](#bucketclaimreference)_ | bucketClaimRef references the BucketClaim that resulted in the creation of this Bucket.
For statically-provisioned buckets, set the namespace and name of the BucketClaim that is
allowed to bind to this Bucket; UID may be left unset if desired and will be updated by COSI. | | | +| `existingBucketID` _string_ | existingBucketID is the unique identifier for an existing backend bucket known to the driver.
Use driver documentation to determine the correct value to set.
This field is used only for static Bucket provisioning.
This field will be empty when the Bucket is dynamically provisioned from a BucketClaim.
Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]),
dashes (-), dots (.), underscores (_), and forward slash (/). | | MaxLength: 2048
MinLength: 1
Pattern: `^[a-zA-Z0-9/._-]+$`
| #### BucketStatus @@ -514,9 +514,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `readyToUse` _boolean_ | readyToUse indicates that the bucket is ready for consumption by workloads. | | | -| `bucketID` _string_ | bucketID is the unique identifier for the backend bucket known to the driver. | | MinLength: 1
| -| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols is the set of protocols the Bucket reports to support. BucketAccesses can request
access to this BucketClaim using any of the protocols reported here. | | Enum: [S3 Azure GCS]
| -| `bucketInfo` _object (keys:string, values:string)_ | bucketInfo contains info about the bucket reported by the driver, rendered in the same
COSI__ format used for the BucketAccess Secret.
e.g., COSI_S3_ENDPOINT, COSI_AZURE_STORAGE_ACCOUNT.
This should not contain any sensitive information. | | | +| `bucketID` _string_ | bucketID is the unique identifier for the backend bucket known to the driver.
Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]),
dashes (-), dots (.), underscores (_), and forward slash (/). | | MaxLength: 2048
MinLength: 1
Pattern: `^[a-zA-Z0-9/._-]+$`
| +| `protocols` _[ObjectProtocol](#objectprotocol) array_ | protocols is the set of protocols the Bucket reports to support. BucketAccesses can request
access to this Bucket using any of the protocols reported here.
Possible values: 'S3', 'Azure', 'GCS'. | | Enum: [S3 Azure GCS]
MaxItems: 3
MinItems: 1
| +| `bucketInfo` _object (keys:string, values:string)_ | bucketInfo contains info about the bucket reported by the driver, rendered in the same
COSI__ format used for the BucketAccess Secret.
e.g., COSI_S3_ENDPOINT, COSI_AZURE_STORAGE_ACCOUNT.
This should not contain any sensitive information. | | MaxProperties: 128
MinProperties: 1
| | `error` _[TimestampedError](#timestampederror)_ | error holds the most recent error message, with a timestamp.
This is cleared when provisioning is successful. | | | @@ -582,6 +582,6 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `time` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#time-v1-meta)_ | time is the timestamp when the error was encountered. | | | -| `message` _string_ | message is a string detailing the encountered error.
NOTE: message will be logged, and it should not contain sensitive information. | | | +| `message` _string_ | message is a string detailing the encountered error.
NOTE: message will be logged, and it should not contain sensitive information.
Must not exceed 1.5MB. | | MaxLength: 1572864
MinLength: 0
| diff --git a/proto/cosi.pb.go b/proto/cosi.pb.go index 177abc85..3aa149b7 100644 --- a/proto/cosi.pb.go +++ b/proto/cosi.pb.go @@ -1080,6 +1080,8 @@ type DriverCreateBucketResponse struct { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: At least one protocol bucket info result MUST be non-nil. // @@ -1151,6 +1153,8 @@ type DriverGetExistingBucketRequest struct { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). ExistingBucketId string `protobuf:"bytes,1,opt,name=existing_bucket_id,json=existingBucketId,proto3" json:"existing_bucket_id,omitempty"` // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. // If none are given, the provisioner MAY provision with a set of default protocol(s) or return @@ -1221,6 +1225,8 @@ type DriverGetExistingBucketResponse struct { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: At least one protocol bucket info result MUST be non-nil. // @@ -1290,6 +1296,8 @@ func (x *DriverGetExistingBucketResponse) GetProtocols() *ObjectProtocolAndBucke type DriverDeleteBucketRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. Parameters map[string]string `protobuf:"bytes,4,rep,name=parameters,proto3" json:"parameters,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` @@ -1492,6 +1500,8 @@ type DriverGrantBucketAccessResponse struct { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"` // REQUIRED. The Provisioner MUST return info for all `buckets` in the request. Buckets []*DriverGrantBucketAccessResponse_BucketInfo `protobuf:"bytes,2,rep,name=buckets,proto3" json:"buckets,omitempty"` @@ -1555,6 +1565,8 @@ func (x *DriverGrantBucketAccessResponse) GetCredentials() *CredentialInfo { type DriverRevokeBucketAccessRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"` // REQUIRED. The object storage protocol associated with the provisioned access. Protocol *ObjectProtocol `protobuf:"bytes,2,opt,name=protocol,proto3" json:"protocol,omitempty"` @@ -1683,6 +1695,8 @@ func (*DriverRevokeBucketAccessResponse) Descriptor() ([]byte, []int) { type DriverGrantBucketAccessRequest_AccessedBucket struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket // associated with `bucket_id`. @@ -1738,6 +1752,8 @@ func (x *DriverGrantBucketAccessRequest_AccessedBucket) GetAccessMode() *AccessM type DriverGrantBucketAccessResponse_BucketInfo struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. // The Provisioner MUST fill in all required bucket info for the requested protocol. diff --git a/proto/cosi.proto b/proto/cosi.proto index 78179070..8492ec6b 100644 --- a/proto/cosi.proto +++ b/proto/cosi.proto @@ -298,6 +298,8 @@ message DriverCreateBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -323,6 +325,8 @@ message DriverGetExistingBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string existing_bucket_id = 1; // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. @@ -341,6 +345,8 @@ message DriverGetExistingBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -364,6 +370,8 @@ message DriverGetExistingBucketResponse { message DriverDeleteBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. @@ -410,6 +418,8 @@ message DriverGrantBucketAccessRequest { message AccessedBucket { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket @@ -426,10 +436,14 @@ message DriverGrantBucketAccessResponse { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; message BucketInfo { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. @@ -451,6 +465,8 @@ message DriverGrantBucketAccessResponse { message DriverRevokeBucketAccessRequest { // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; // REQUIRED. The object storage protocol associated with the provisioned access. diff --git a/proto/spec.md b/proto/spec.md index 6e6b62ac..01d3f3b7 100644 --- a/proto/spec.md +++ b/proto/spec.md @@ -468,6 +468,8 @@ message DriverCreateBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -507,6 +509,8 @@ message DriverGetExistingBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string existing_bucket_id = 1; // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. @@ -525,6 +529,8 @@ message DriverGetExistingBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -557,6 +563,8 @@ the Plugin MUST reply OK. ```protobuf message DriverDeleteBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. @@ -618,6 +626,8 @@ message DriverGrantBucketAccessRequest { message AccessedBucket { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket @@ -634,10 +644,14 @@ message DriverGrantBucketAccessResponse { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; message BucketInfo { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. @@ -668,6 +682,8 @@ exist, the Plugin MUST reply OK. ```protobuf message DriverRevokeBucketAccessRequest { // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; // REQUIRED. The object storage protocol associated with the provisioned access. diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucket_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucket_types.go index de61d68a..9797f933 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucket_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucket_types.go @@ -42,8 +42,13 @@ const ( // +kubebuilder:validation:XValidation:message="existingBucketID cannot be added or removed after creation",rule="has(oldSelf.existingBucketID) == has(self.existingBucketID)" type BucketSpec struct { // driverName is the name of the driver that fulfills requests for this Bucket. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` // +kubebuilder:validation:XValidation:message="driverName is immutable",rule="self == oldSelf" DriverName string `json:"driverName,omitempty"` @@ -57,29 +62,41 @@ type BucketSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this Bucket. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 // +kubebuilder:validation:XValidation:message="parameters map is immutable",rule="self == oldSelf" Parameters map[string]string `json:"parameters,omitempty"` // protocols lists object store protocols that the provisioned Bucket must support. // If specified, COSI will verify that each item is advertised as supported by the driver. + // See driver documentation to determine supported protocols. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 // +kubebuilder:validation:XValidation:message="protocols list is immutable",rule="self == oldSelf" Protocols []ObjectProtocol `json:"protocols,omitempty"` - // bucketClaim references the BucketClaim that resulted in the creation of this Bucket. + // bucketClaimRef references the BucketClaim that resulted in the creation of this Bucket. // For statically-provisioned buckets, set the namespace and name of the BucketClaim that is - // allowed to bind to this Bucket. + // allowed to bind to this Bucket; UID may be left unset if desired and will be updated by COSI. // +required - BucketClaimRef BucketClaimReference `json:"bucketClaim,omitzero"` + BucketClaimRef BucketClaimReference `json:"bucketClaimRef,omitzero"` // existingBucketID is the unique identifier for an existing backend bucket known to the driver. - // Use driver documentation to determine how to set this value. - // This field is used only for Bucket static provisioning. + // Use driver documentation to determine the correct value to set. + // This field is used only for static Bucket provisioning. // This field will be empty when the Bucket is dynamically provisioned from a BucketClaim. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="existingBucketID is immutable",rule="self == oldSelf" ExistingBucketID string `json:"existingBucketID,omitempty"` } @@ -89,21 +106,34 @@ type BucketSpec struct { // +kubebuilder:validation:XValidation:message="uid cannot be removed once set",rule="!has(oldSelf.uid) || has(self.uid)" type BucketClaimReference struct { // name is the name of the BucketClaim being referenced. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="name is immutable",rule="self == oldSelf" Name string `json:"name,omitempty"` // namespace is the namespace of the BucketClaim being referenced. + // Must be a valid Kubernetes Namespace name: at most 63 characters, consisting only of + // lower-case alphanumeric characters and hyphens, starting and ending with alphanumerics. // +required // +kubebuilder:validation:MinLength=1 - // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:message="namespace must be a valid namespace name",rule="!format.dns1123Label().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="namespace is immutable",rule="self == oldSelf" Namespace string `json:"namespace,omitempty"` // uid is the UID of the BucketClaim being referenced. + // Must be a valid Kubernetes UID: RFC 4122 form with lowercase hexadecimal characters + // (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). // +optional + // +kubebuilder:validation:MinLength=36 + // +kubebuilder:validation:MaxLength=36 + // +kubebuilder:validation:Type=string + // +kubebuilder:validation:Pattern=`^[0-9a-f]{8}-([0-9a-f]{4}\-){3}[0-9a-f]{12}$` // +kubebuilder:validation:XValidation:message="uid is immutable once set",rule="oldSelf == '' || self == oldSelf" UID types.UID `json:"uid,omitempty"` } @@ -117,15 +147,22 @@ type BucketStatus struct { ReadyToUse *bool `json:"readyToUse,omitempty"` // bucketID is the unique identifier for the backend bucket known to the driver. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="boundBucketName is immutable once set",rule="self == oldSelf" BucketID string `json:"bucketID,omitempty"` // protocols is the set of protocols the Bucket reports to support. BucketAccesses can request - // access to this BucketClaim using any of the protocols reported here. + // access to this Bucket using any of the protocols reported here. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 Protocols []ObjectProtocol `json:"protocols,omitempty"` // bucketInfo contains info about the bucket reported by the driver, rendered in the same @@ -133,6 +170,8 @@ type BucketStatus struct { // e.g., COSI_S3_ENDPOINT, COSI_AZURE_STORAGE_ACCOUNT. // This should not contain any sensitive information. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=128 BucketInfo map[string]string `json:"bucketInfo,omitempty"` // error holds the most recent error message, with a timestamp. diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccess_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccess_types.go index 2cde1de1..04fbcaa1 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccess_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccess_types.go @@ -58,11 +58,13 @@ type BucketAccessSpec struct { // bucketClaims is a list of BucketClaims the provisioned access must have permissions for, // along with per-BucketClaim access parameters and system output definitions. // At least one BucketClaim must be referenced. + // A maximum of 128 BucketClaims may be referenced. // Multiple references to the same BucketClaim are not permitted. // +required // +listType=map // +listMapKey=bucketClaimName // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=128 // +kubebuilder:validation:XValidation:message="bucketClaims list is immutable",rule="self == oldSelf" BucketClaims []BucketClaimAccess `json:"bucketClaims,omitempty"` @@ -74,16 +76,18 @@ type BucketAccessSpec struct { BucketAccessClassName string `json:"bucketAccessClassName,omitempty"` // protocol is the object storage protocol that the provisioned access must use. + // Access can only be granted for BucketClaims that support the requested protocol. + // Each BucketClaim status reports which protocols are supported for the BucketClaim's bucket. + // Possible values: 'S3', 'Azure', 'GCS'. // +required // +kubebuilder:validation:XValidation:message="protocol is immutable",rule="self == oldSelf" Protocol ObjectProtocol `json:"protocol,omitempty"` // serviceAccountName is the name of the Kubernetes ServiceAccount that user application Pods // intend to use for access to referenced BucketClaims. - // This has different behavior based on the BucketAccessClass's defined AuthenticationType: - // - Key: This field is ignored. - // - ServiceAccount: This field is required. The driver should configure the system so that Pods - // using the ServiceAccount authenticate to the object storage backend automatically. + // Required when the BucketAccessClass is configured to use ServiceAccount authentication type. + // Ignored for all other authentication types. + // It is recommended to specify this for all BucketAccesses to improve portability. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 @@ -104,8 +108,12 @@ type BucketAccessStatus struct { // accountID is the unique identifier for the backend access known to the driver. // This field is populated by the COSI Sidecar once access has been successfully granted. + // Must be at most 2048 characters and consist only of alphanumeric characters ([a-z0-9A-Z]), + // dashes (-), dots (.), underscores (_), and forward slash (/). // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9/._-]+$` // +kubebuilder:validation:XValidation:message="accountId is immutable once set",rule="self == oldSelf" AccountID string `json:"accountID,omitempty"` @@ -116,18 +124,26 @@ type BucketAccessStatus struct { // +listType=map // +listMapKey=bucketName // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=128 // +kubebuilder:validation:XValidation:message="accessedBuckets is immutable once set",rule="self == oldSelf" AccessedBuckets []AccessedBucket `json:"accessedBuckets,omitempty"` // driverName holds a copy of the BucketAccessClass driver name from the time of BucketAccess // provisioning. This field is populated by the COSI Controller. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +optional // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` // +kubebuilder:validation:XValidation:message="driverName is immutable once set",rule="self == oldSelf" DriverName string `json:"driverName,omitempty"` // authenticationType holds a copy of the BucketAccessClass authentication type from the time of // BucketAccess provisioning. This field is populated by the COSI Controller. + // Possible values: + // - Key: clients may use a protocol-appropriate access key to authenticate to the backend object store. + // - ServiceAccount: Pods using the ServiceAccount given in spec.serviceAccountName may authenticate to the backend object store automatically. // +optional // +kubebuilder:validation:XValidation:message="authenticationType is immutable once set",rule="self == oldSelf" AuthenticationType BucketAccessAuthenticationType `json:"authenticationType,omitempty"` @@ -135,6 +151,8 @@ type BucketAccessStatus struct { // parameters holds a copy of the BucketAccessClass parameters from the time of BucketAccess // provisioning. This field is populated by the COSI Controller. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 // +kubebuilder:validation:XValidation:message="accessedBuckets is immutable once set",rule="self == oldSelf" Parameters map[string]string `json:"parameters,omitempty"` @@ -150,13 +168,22 @@ type BucketAccessStatus struct { type BucketClaimAccess struct { // bucketClaimName is the name of a BucketClaim the access should have permissions for. // The BucketClaim must be in the same Namespace as the BucketAccess. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketClaimName string `json:"bucketClaimName,omitempty"` // accessMode is the Read/Write access mode that the access should have for the bucket. - // Possible values: ReadWrite, ReadOnly, WriteOnly. + // The provisioned access will have the corresponding permissions to read and/or write objects + // the BucketClaim's bucket. + // The provisioned access can also assume to have corresponding permissions to read and/or write + // object metadata and object metadata (e.g., tags) except when metadata changes would change + // object store behaviors or permissions (e.g., changes to object caching behaviors). + // Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. // +required AccessMode BucketAccessMode `json:"accessMode,omitempty"` @@ -166,24 +193,36 @@ type BucketClaimAccess struct { // BucketAccess is deleted and deprovisioned. // The Secret name must be unique across all bucketClaimRefs for all BucketAccesses in the same // Namespace. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" AccessSecretName string `json:"accessSecretName,omitempty"` } // AccessedBucket identifies a Bucket and correlates it to a BucketClaimAccess from the spec. type AccessedBucket struct { // bucketName is the name of a Bucket the access should have permissions for. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketName string `json:"bucketName,omitempty"` // bucketClaimName must match a BucketClaimAccess's BucketClaimName from the spec. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +required // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" BucketClaimName string `json:"bucketClaimName,omitempty"` } diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go index ed645d08..107a37f4 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketaccessclass_types.go @@ -23,11 +23,17 @@ import ( // BucketAccessClassSpec defines the desired state of BucketAccessClass type BucketAccessClassSpec struct { // driverName is the name of the driver that fulfills requests for this BucketAccessClass. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` DriverName string `json:"driverName,omitempty"` // authenticationType specifies which authentication mechanism is used bucket access. + // See driver documentation to determine which values are supported. // Possible values: // - Key: The driver should generate a protocol-appropriate access key that clients can use to // authenticate to the backend object store. @@ -38,7 +44,11 @@ type BucketAccessClassSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this BucketAccessClass. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 Parameters map[string]string `json:"parameters,omitempty"` // featureOptions can be used to adjust various COSI access provisioning behaviors. @@ -53,8 +63,13 @@ type BucketAccessFeatureOptions struct { // disallowedBucketAccessModes is a list of disallowed Read/Write access modes. A BucketAccess // using this class will not be allowed to request access to a BucketClaim with any access mode // listed here. + // This is particularly useful for administrators to restrict access to a statically-provisioned + // bucket that is managed outside the BucketAccess Namespace or Kubernetes cluster. + // Possible values: 'ReadWrite', 'ReadOnly', 'WriteOnly'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 DisallowedBucketAccessModes []BucketAccessMode `json:"disallowedBucketAccessModes,omitempty"` // disallowMultiBucketAccess disables the ability for a BucketAccess to reference multiple diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclaim_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclaim_types.go index a71d31a0..be83c445 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclaim_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclaim_types.go @@ -30,16 +30,25 @@ type BucketClaimSpec struct { // bucketClassName selects the BucketClass for provisioning the BucketClaim. // This field is used only for BucketClaim dynamic provisioning. // If unspecified, existingBucketName must be specified for binding to an existing Bucket. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="bucketClassName is immutable",rule="self == oldSelf" BucketClassName string `json:"bucketClassName,omitempty"` // protocols lists object storage protocols that the provisioned Bucket must support. // If specified, COSI will verify that each item is advertised as supported by the driver. + // It is recommended to specify all protocols that applications will rely on in BucketAccesses + // referencing this BucketClaim. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 // +kubebuilder:validation:XValidation:message="protocols list is immutable",rule="self == oldSelf" Protocols []ObjectProtocol `json:"protocols,omitempty"` @@ -47,9 +56,13 @@ type BucketClaimSpec struct { // should bind to. // This field is used only for BucketClaim static provisioning. // If unspecified, bucketClassName must be specified for dynamically provisioning a new bucket. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="existingBucketName is immutable",rule="self == oldSelf" ExistingBucketName string `json:"existingBucketName,omitempty"` } @@ -59,9 +72,13 @@ type BucketClaimSpec struct { // +kubebuilder:validation:XValidation:message="protocols cannot be removed once set",rule="!has(oldSelf.protocols) || has(self.protocols)" type BucketClaimStatus struct { // boundBucketName is the name of the Bucket this BucketClaim is bound to. + // Must be a valid Kubernetes resource name: at most 253 characters, consisting only of + // lower-case alphanumeric characters, hyphens, and periods, starting and ending with an + // alphanumeric character. // +optional // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:message="name must be a valid resource name",rule="!format.dns1123Subdomain().validate(self).hasValue()" // +kubebuilder:validation:XValidation:message="boundBucketName is immutable once set",rule="self == oldSelf" BoundBucketName string `json:"boundBucketName,omitempty"` @@ -71,8 +88,11 @@ type BucketClaimStatus struct { // protocols is the set of protocols the bound Bucket reports to support. BucketAccesses can // request access to this BucketClaim using any of the protocols reported here. + // Possible values: 'S3', 'Azure', 'GCS'. // +optional // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=3 Protocols []ObjectProtocol `json:"protocols,omitempty"` // error holds the most recent error message, with a timestamp. diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclass_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclass_types.go index d9087216..d40e0061 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclass_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/bucketclass_types.go @@ -23,8 +23,13 @@ import ( // BucketClassSpec defines the BucketClass. type BucketClassSpec struct { // driverName is the name of the driver that fulfills requests for this BucketClass. + // See driver documentation to determine the correct value to set. + // Must be 63 characters or less, beginning and ending with an alphanumeric character + // ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. // +required // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9\-\.]{0,61}[a-zA-Z0-9])?$` DriverName string `json:"driverName,omitempty"` // deletionPolicy determines whether a Bucket created through the BucketClass should be deleted @@ -37,7 +42,11 @@ type BucketClassSpec struct { // parameters is an opaque map of driver-specific configuration items passed to the driver that // fulfills requests for this BucketClass. + // See driver documentation to determine supported parameters and their effects. + // A maximum of 512 parameters are allowed. // +optional + // +kubebuilder:validation:MinProperties=1 + // +kubebuilder:validation:MaxProperties=512 Parameters map[string]string `json:"parameters,omitempty"` } diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/shared_types.go b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/shared_types.go index c27ee6b8..e22aaedc 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/shared_types.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/client/apis/objectstorage/v1alpha2/shared_types.go @@ -35,7 +35,10 @@ type TimestampedError struct { // message is a string detailing the encountered error. // NOTE: message will be logged, and it should not contain sensitive information. + // Must not exceed 1.5MB. // +optional + // +kubebuilder:validation:MinLength=0 + // +kubebuilder:validation:MaxLength=1572864 Message *string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"` } diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.pb.go b/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.pb.go index 177abc85..3aa149b7 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.pb.go +++ b/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.pb.go @@ -1080,6 +1080,8 @@ type DriverCreateBucketResponse struct { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: At least one protocol bucket info result MUST be non-nil. // @@ -1151,6 +1153,8 @@ type DriverGetExistingBucketRequest struct { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). ExistingBucketId string `protobuf:"bytes,1,opt,name=existing_bucket_id,json=existingBucketId,proto3" json:"existing_bucket_id,omitempty"` // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. // If none are given, the provisioner MAY provision with a set of default protocol(s) or return @@ -1221,6 +1225,8 @@ type DriverGetExistingBucketResponse struct { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: At least one protocol bucket info result MUST be non-nil. // @@ -1290,6 +1296,8 @@ func (x *DriverGetExistingBucketResponse) GetProtocols() *ObjectProtocolAndBucke type DriverDeleteBucketRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. Parameters map[string]string `protobuf:"bytes,4,rep,name=parameters,proto3" json:"parameters,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` @@ -1492,6 +1500,8 @@ type DriverGrantBucketAccessResponse struct { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"` // REQUIRED. The Provisioner MUST return info for all `buckets` in the request. Buckets []*DriverGrantBucketAccessResponse_BucketInfo `protobuf:"bytes,2,rep,name=buckets,proto3" json:"buckets,omitempty"` @@ -1555,6 +1565,8 @@ func (x *DriverGrantBucketAccessResponse) GetCredentials() *CredentialInfo { type DriverRevokeBucketAccessRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"` // REQUIRED. The object storage protocol associated with the provisioned access. Protocol *ObjectProtocol `protobuf:"bytes,2,opt,name=protocol,proto3" json:"protocol,omitempty"` @@ -1683,6 +1695,8 @@ func (*DriverRevokeBucketAccessResponse) Descriptor() ([]byte, []int) { type DriverGrantBucketAccessRequest_AccessedBucket struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket // associated with `bucket_id`. @@ -1738,6 +1752,8 @@ func (x *DriverGrantBucketAccessRequest_AccessedBucket) GetAccessMode() *AccessM type DriverGrantBucketAccessResponse_BucketInfo struct { state protoimpl.MessageState `protogen:"open.v1"` // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). BucketId string `protobuf:"bytes,1,opt,name=bucket_id,json=bucketId,proto3" json:"bucket_id,omitempty"` // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. // The Provisioner MUST fill in all required bucket info for the requested protocol. diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.proto b/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.proto index 78179070..8492ec6b 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.proto +++ b/vendor/sigs.k8s.io/container-object-storage-interface/proto/cosi.proto @@ -298,6 +298,8 @@ message DriverCreateBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -323,6 +325,8 @@ message DriverGetExistingBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string existing_bucket_id = 1; // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. @@ -341,6 +345,8 @@ message DriverGetExistingBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -364,6 +370,8 @@ message DriverGetExistingBucketResponse { message DriverDeleteBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. @@ -410,6 +418,8 @@ message DriverGrantBucketAccessRequest { message AccessedBucket { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket @@ -426,10 +436,14 @@ message DriverGrantBucketAccessResponse { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; message BucketInfo { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. @@ -451,6 +465,8 @@ message DriverGrantBucketAccessResponse { message DriverRevokeBucketAccessRequest { // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; // REQUIRED. The object storage protocol associated with the provisioned access. diff --git a/vendor/sigs.k8s.io/container-object-storage-interface/proto/spec.md b/vendor/sigs.k8s.io/container-object-storage-interface/proto/spec.md index 6e6b62ac..01d3f3b7 100644 --- a/vendor/sigs.k8s.io/container-object-storage-interface/proto/spec.md +++ b/vendor/sigs.k8s.io/container-object-storage-interface/proto/spec.md @@ -468,6 +468,8 @@ message DriverCreateBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -507,6 +509,8 @@ message DriverGetExistingBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string existing_bucket_id = 1; // OPTIONAL. A list of all object storage protocols the provisioned bucket MUST support. @@ -525,6 +529,8 @@ message DriverGetExistingBucketResponse { // This value WILL be used by COSI to make subsequent calls related to the bucket, so the // Provisioner MUST be able to correlate `bucket_id` to the backend bucket. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: At least one protocol bucket info result MUST be non-nil. @@ -557,6 +563,8 @@ the Plugin MUST reply OK. ```protobuf message DriverDeleteBucketRequest { // REQUIRED. The unique identifier for the existing backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // OPTIONAL. Plugin specific parameters associated with the provisioned bucket. @@ -618,6 +626,8 @@ message DriverGrantBucketAccessRequest { message AccessedBucket { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED. The read/write access mode that the Provisioner SHOULD provision for the bucket @@ -634,10 +644,14 @@ message DriverGrantBucketAccessResponse { // This value WILL be used by COSI to make subsequent calls related to the access, so the // Provisioner MUST be able to correlate `account_id` to the backend access. // It is RECOMMENDED to use the backend storage system's bucket ID. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; message BucketInfo { // REQUIRED. The unique identifier for the backend bucket known to the Provisioner. + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string bucket_id = 1; // REQUIRED: EXACTLY one protocol bucket info result MUST be non-nil. @@ -668,6 +682,8 @@ exist, the Plugin MUST reply OK. ```protobuf message DriverRevokeBucketAccessRequest { // REQUIRED. The unique identifier for the backend access account + // To prevent abuse, this must be at most 2048 characters long, consisting of alphanumeric + // characters ([a-z0-9A-Z]), dashes (-), and dots (.). string account_id = 1; // REQUIRED. The object storage protocol associated with the provisioned access.