Add Bucket CORS configuration

apis/provider-ceph/v1alpha1/bucket_types.go

@@ -107,6 +107,10 @@ type BucketParameters struct {
 	// Before adding it, you should validate the JSON string.
 	// +optional
 	Policy string `json:"policy,omitempty"`
+
+	// CORSConfiguration describes the cross-origin access configuration for the bucket.
+	// +optional
+	CORSConfiguration *CORSConfiguration `json:"corsConfiguration,omitempty"`
 }
 
 // BackendInfo contains relevant information about an S3 backend for
@@ -134,6 +138,11 @@ type BackendInfo struct {
 	// side encryption configuration on the S3 backend. Use a pointer to allow nil
 	// value when there is no serverside encryption configuration.
 	ServerSideEncryptionConfigurationCondition *xpv1.Condition `json:"serverSideEncryptionConfigurationCondition,omitempty"`
+	// +optional
+	// CORSConfigurationCondition is the condition of the CORS configuration
+	// on the S3 backend. Use a pointer to allow nil value when there is
+	// no CORS configuration.
+	CORSConfigurationCondition *xpv1.Condition `json:"corsConfigurationCondition,omitempty"`
 }
 
 // Backends is a map of the names of the S3 backends to BackendInfo.
@@ -174,6 +183,10 @@ type BucketSpec struct {
 	// for the bucket on all of the bucket's backends. The Bucket CR's
 	// status is updated accordingly.
 	ServerSideEncryptionConfigurationDisabled bool `json:"serverSideEncryptionConfigurationDisabled,omitempty"`
+	// CORSConfigurationDisabled causes provider-ceph to attempt deletion
+	// and/or avoid create/updates of the CORS config for the bucket on
+	// all of the bucket's backends. The Bucket CR's status is updated accordingly.
+	CORSConfigurationDisabled bool `json:"corsConfigurationDisabled,omitempty"`
 
 	// +optional
 	// AutoPause allows the user to disable further reconciliation

apis/provider-ceph/v1alpha1/corsconfiguration_types.go

@@ -0,0 +1,40 @@
+package v1alpha1
+
+// CORSConfiguration describes the cross-origin access configuration for a bucket.
+type CORSConfiguration struct {
+	// A set of origins and methods (cross-origin access that you want to allow).
+	// You can add up to 100 rules to the configuration.
+	Rules []CORSRule `json:"rules"`
+}
+
+// CORSRule specifies a cross-origin access rule for a bucket.
+type CORSRule struct {
+	// Headers that are specified in the Access-Control-Request-Headers header.
+	// These headers are allowed in a preflight OPTIONS request. In response to
+	// any preflight OPTIONS request, Amazon S3 returns any requested headers that
+	// are allowed.
+	// +optional
+	AllowedHeaders []string `json:"allowedHeaders,omitempty"`
+
+	// An HTTP method that you allow the origin to execute. Valid values are GET,
+	// PUT, HEAD, POST, and DELETE.
+	AllowedMethods []string `json:"allowedMethods"`
+
+	// One or more origins you want customers to be able to access the bucket from.
+	AllowedOrigins []string `json:"allowedOrigins"`
+
+	// One or more headers in the response that you want customers to be able to
+	// access from their applications (for example, from a JavaScript XMLHttpRequest
+	// object).
+	// +optional
+	ExposeHeaders []string `json:"exposeHeaders,omitempty"`
+
+	// Unique identifier for the rule. The value cannot be longer than 255 characters.
+	// +optional
+	ID *string `json:"id,omitempty"`
+
+	// The time in seconds that your browser is to cache the preflight response
+	// for the specified resource.
+	// +optional
+	MaxAgeSeconds *int32 `json:"maxAgeSeconds,omitempty"`
+}

cmd/provider/main.go

@@ -207,6 +207,7 @@ func createBucketConnector(
 	disableVersioningConfigReconcile *bool,
 	disableObjectLockConfigReconcile *bool,
 	disableSSEConfigReconcile *bool,
+	disableCORSConfigReconcile *bool,
 ) *bucket.Connector {
 	return bucket.NewConnector(
 		bucket.WithAutoPause(autoPauseBucket),
@@ -229,7 +230,8 @@ func createBucketConnector(
 					PolicyClientDisabled:                            *disablePolicyReconcile,
 					VersioningConfigurationClientDisabled:           *disableVersioningConfigReconcile,
 					ObjectLockConfigurationClientDisabled:           *disableObjectLockConfigReconcile,
-					ServerSideEncryptionConfigurationClientDisabled: *disableSSEConfigReconcile},
+					ServerSideEncryptionConfigurationClientDisabled: *disableSSEConfigReconcile,
+					CORSConfigurationClientDisabled:                 *disableCORSConfigReconcile},
 				log)),
 		bucket.WithS3ClientHandler(s3ClientHandler),
 		bucket.WithUsage(resource.NewLegacyProviderConfigUsageTracker(mgr.GetClient(), &v1alpha1.ProviderConfigUsage{})),
@@ -347,6 +349,7 @@ func main() {
 		disableVersioningConfigReconcile = app.Flag("disable-versioning-config-reconcile", "Disable reconciliation of Bucket Versioning Configurations.").Default("false").Envar("DISABLE_VERSIONING_CONFIG_RECONCILE").Bool()
 		disableObjectLockConfigReconcile = app.Flag("disable-object-lock-config-reconcile", "Disable reconciliation of Object Lock Configurations.").Default("false").Envar("DISABLE_OBJECT_LOCK_CONFIG_RECONCILE").Bool()
 		disableSSEConfigReconcile        = app.Flag("disable-sse-config-reconcile", "Disable reconciliation of Server Side Encryption Configurations.").Default("false").Envar("DISABLE_SSE_CONFIG_RECONCILE").Bool()
+		disableCORSConfigReconcile       = app.Flag("disable-cors-config-reconcile", "Disable reconciliation of CORS Configurations.").Default("false").Envar("DISABLE_CORS_CONFIG_RECONCILE").Bool()
 	)
 
 	debugFlag := app.Flag("debug", "Enable debug logging (sets zap-log-level to debug)").Default("false").Bool()
@@ -517,6 +520,7 @@ func main() {
 		disableVersioningConfigReconcile,
 		disableObjectLockConfigReconcile,
 		disableSSEConfigReconcile,
+		disableCORSConfigReconcile,
 	)
 
 	setupControllers(mgr, o, connector, canSafeStart, log)

e2e/tests/ceph/chainsaw-test.yaml

@@ -158,6 +158,22 @@ spec:
                     mode: "COMPLIANCE"
               versioningConfiguration:
                 status: "Enabled"
+              corsConfiguration:
+                rules:
+                - allowedOrigins:
+                  - "*"
+                  allowedMethods:
+                  - GET
+                  - PUT
+                  - POST
+                  - DELETE
+                  - HEAD
+                  allowedHeaders:
+                  - "*"
+                  exposeHeaders:
+                  - ETag
+                  - x-amz-request-id
+                  maxAgeSeconds: 3600
               lifecycleConfiguration:
                 # Example rules from https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-configuration-examples.html
                 rules:
@@ -214,6 +230,10 @@ spec:
                     reason: Available
                     status: "True"
                     type: Ready
+                  corsConfigurationCondition:
+                    reason: Available
+                    status: "True"
+                    type: Ready
             conditions:
             - reason: Available
               status: "True"

e2e/tests/stable/chainsaw-test.yaml

@@ -144,6 +144,16 @@ spec:
                     prefix: "images/"
               versioningConfiguration:
                 status: "Enabled"
+              corsConfiguration:
+                rules:
+                - allowedOrigins:
+                  - "*"
+                  allowedMethods:
+                  - GET
+                  - PUT
+                  allowedHeaders:
+                  - "*"
+                  maxAgeSeconds: 3600
               objectLockEnabledForBucket: true
               objectLockConfiguration:
                 objectLockEnabled: "Enabled"
@@ -200,6 +210,10 @@ spec:
                     reason: Available
                     status: "True"
                     type: Ready
+                  corsConfigurationCondition:
+                    reason: Available
+                    status: "True"
+                    type: Ready
                 localstack-b:
                   bucketCondition:
                     reason: Available
@@ -221,6 +235,10 @@ spec:
                     reason: Available
                     status: "True"
                     type: Ready
+                  corsConfigurationCondition:
+                    reason: Available
+                    status: "True"
+                    type: Ready
                 localstack-c:
                   bucketCondition:
                     reason: Available
@@ -242,6 +260,10 @@ spec:
                     reason: Available
                     status: "True"
                     type: Ready
+                  corsConfigurationCondition:
+                    reason: Available
+                    status: "True"
+                    type: Ready
     # Extra assertion for overall Bucket conditions.
     # This method of iterative assertions is necessary here because
     # these conditions do not always appear in the same order.
@@ -331,6 +353,16 @@ spec:
                     prefix: "images/"
               versioningConfiguration:
                 status: "Enabled"
+              corsConfiguration:
+                rules:
+                - allowedOrigins:
+                  - "*"
+                  allowedMethods:
+                  - GET
+                  - PUT
+                  allowedHeaders:
+                  - "*"
+                  maxAgeSeconds: 3600
               objectLockEnabledForBucket: true
               objectLockConfiguration:
     # Assert that the LC config and SSE config have been removed from subresource-configs.

examples/sample/bucket-cors.yaml

@@ -0,0 +1,22 @@
+apiVersion: provider-ceph.ceph.crossplane.io/v1alpha1
+kind: Bucket
+metadata:
+  name: test-bucket-cors
+spec:
+  forProvider:
+    corsConfiguration:
+      rules:
+        - allowedOrigins:
+            - "*"
+          allowedMethods:
+            - GET
+            - PUT
+            - POST
+            - DELETE
+            - HEAD
+          allowedHeaders:
+            - "*"
+          exposeHeaders:
+            - ETag
+            - x-amz-request-id
+          maxAgeSeconds: 3600

internal/backendstore/backend.go

@@ -49,6 +49,9 @@ type S3Client interface {
 	PutBucketEncryption(context.Context, *s3.PutBucketEncryptionInput, ...func(*s3.Options)) (*s3.PutBucketEncryptionOutput, error)
 	GetBucketEncryption(context.Context, *s3.GetBucketEncryptionInput, ...func(*s3.Options)) (*s3.GetBucketEncryptionOutput, error)
 	DeleteBucketEncryption(context.Context, *s3.DeleteBucketEncryptionInput, ...func(*s3.Options)) (*s3.DeleteBucketEncryptionOutput, error)
+	PutBucketCors(context.Context, *s3.PutBucketCorsInput, ...func(*s3.Options)) (*s3.PutBucketCorsOutput, error)
+	GetBucketCors(context.Context, *s3.GetBucketCorsInput, ...func(*s3.Options)) (*s3.GetBucketCorsOutput, error)
+	DeleteBucketCors(context.Context, *s3.DeleteBucketCorsInput, ...func(*s3.Options)) (*s3.DeleteBucketCorsOutput, error)
 }
 
 //counterfeiter:generate . STSClient