Access control of resources in a cloud-native storage system
A method for access control of resources in a distributed storage system using an API level model. An ownership object is created corresponding to a volume. The ownership object includes a string defining the owner of the resource. Access rights are given to collaborators or groups and stored as property list fields in the ownership object. Any requestor not listed as the owner, a collaborator, or part of a user group is denied access to the resource.
1. A method comprising:
receiving a request to create a volume, the request including a user token that comprises an issuance time and/or an expiration time and comprises an identifier of a user associated with the request;
creating a volume object in response to the request, the volume object corresponding to a physical or virtual volume of storage, wherein the volume is accessible to clients via a network, the clients associated with respective users;
based on the request, creating an ownership object corresponding to the volume object, the creating comprising obtaining the identifier of the user from the user token and including the obtained identifier in the ownership object, wherein the identifier in the ownership object indicates that the user is an owner of the volume;
including in the ownership object an access control list that is associated with a an operation type, the access control list comprising identifiers of users and/or user groups; and
receiving, from the clients, requests to perform respective operations on the volume object itself, and for each request, determining whether to perform a corresponding operation by checking the ownership object to determine whether a user associated with the request corresponds to one of the identifiers in the access control list and whether the operation associated with the request corresponds to the operation type associated with access control list.
2. The method recited in claim 1 , wherein the identifier in the ownership object comprises a name of the user.
3. The method recited in claim 1 , wherein the operation type comprises a read operation type, a write operation type, or an admin operation type.
4. The method recited in claim 1 , wherein the ownership object is embedded within the volume object.
5. The method recited in claim 1 , wherein the ownership object is stored as metadata in a database.
6. The method recited in claim 1 , further comprising: upon receiving a request from the user to add an access right to the volume for a specific user or user group, and adding or modifying a second access control list in the ownership object to give the access right to the specific user or user group.
7. The method according to claim 1 , wherein the volume is distributed among nodes of a clustered storage system.
8. A computing system comprising:
a processor; and
memory, the memory storing instructions to cause the processor to perform a method, the method comprising:
receiving a request to create a volume, the request associated with a user token representing a user associated with the request, the user token comprising an indication of a role of the user and comprising an identifier of the user;
creating a volume object in response to the request to create the volume, the volume object corresponding to a physical or virtual volume of storage;
based on the request to create the volume, creating an ownership object corresponding to the volume object, the creating the ownership object comprising copying the identifier of the user from the user token to the ownership object, the identifier in the ownership object specifying the user as an owner of the volume;
including in the ownership object an access control list that the ownership object associates with an operation type, the access control list comprising identifiers of users and/or user groups;
receiving requests to perform respective operations on the volume object itself, and, for each request, determining whether to perform a corresponding operation by checking the ownership object to determine whether a user associated with the request corresponds to one of the identifiers in the access control list and whether the operation associated with the request corresponds to the operation type associated with access control list.
9. The system recited in claim 8 , wherein the identifier in the ownership object comprises a name of the user derived from the user token.
10. The system recited in claim 8 , wherein the operation type comprises a read operation type, a write operation type, or an admin operation type.
11. The system recited in claim 8 , wherein the ownership object is embedded within the volume object.
12. The system recited in claim 8 , wherein the ownership object is stored as metadata in a database.
13. The system recited in claim 8 , wherein the method further comprises: receiving a subsequent request associated with the user, the subsequent request specifying the operation type and a user or a user group, and, based on the subsequent request, adding the specified user or user group to the access control list.
14. The system according to claim 8 , wherein the operation type comprises a delete operation corresponding to deleting the volume.
15. One or more non-transitory machine-readable media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:
receiving a request to create a volume, the request associated with a user token representing a user associated with the request;
creating a volume object in response to the request to create the volume, the volume object corresponding to a physical or virtual volume of storage;
based on the request to create the volume, creating an ownership object corresponding to the volume object, the creating the ownership object comprising extracting an identifier of the user from the user token and including the identifier of the user in the ownership object, the identifier in the ownership object specifying the user as an owner of the volume;
including in the ownership object an access control list that the ownership object associates with an operation type, the access control list comprising identifiers of users and/or user groups;
receiving requests to perform respective operations on the volume object itself, and, for each request, determining whether to perform a corresponding operation by checking the ownership object to determine whether a user associated with the request corresponds to one of the identifiers in the access control list and whether the operation associated with the request corresponds to the operation type associated with access control list.
16. The one or more non-transitory computer readable media recited in claim 15 , wherein the identifier in the ownership object comprises a name of the user derived from the user token.
17. The one or more non-transitory computer readable media recited in claim 15 , wherein the operation type comprises a read operation type, a write operation type, or an admin operation type.
18. The one or more non-transitory computer readable media recited in claim 15 , wherein the ownership object is embedded within the volume object.
19. The one or more non-transitory computer readable media recited in claim 15 , wherein the ownership object is stored as metadata in a database.
20. The one or more non-transitory computer readable media recited in claim 15 , wherein the volume is provided by a storage node cluster and is mounted by a client outside the storage node cluster.