mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-20 19:42:17 +00:00
refactor(admin): extract kms management route registration (#1801)
This commit is contained in:
@@ -14,13 +14,13 @@
|
|||||||
|
|
||||||
//! KMS admin handlers for HTTP API
|
//! KMS admin handlers for HTTP API
|
||||||
|
|
||||||
use super::{kms_dynamic, kms_keys};
|
use super::{kms_dynamic, kms_keys, kms_management};
|
||||||
use crate::admin::auth::validate_admin_request;
|
use crate::admin::auth::validate_admin_request;
|
||||||
use crate::admin::router::{AdminOperation, Operation, S3Router};
|
use crate::admin::router::{AdminOperation, Operation, S3Router};
|
||||||
use crate::auth::{check_key_valid, get_session_token};
|
use crate::auth::{check_key_valid, get_session_token};
|
||||||
use crate::server::{ADMIN_PREFIX, RemoteAddr};
|
use crate::server::RemoteAddr;
|
||||||
use base64::Engine;
|
use base64::Engine;
|
||||||
use hyper::{HeaderMap, Method, StatusCode};
|
use hyper::{HeaderMap, StatusCode};
|
||||||
use matchit::Params;
|
use matchit::Params;
|
||||||
use rustfs_config::MAX_ADMIN_REQUEST_BODY_SIZE;
|
use rustfs_config::MAX_ADMIN_REQUEST_BODY_SIZE;
|
||||||
use rustfs_kms::{get_global_encryption_service, types::*};
|
use rustfs_kms::{get_global_encryption_service, types::*};
|
||||||
@@ -111,59 +111,13 @@ fn extract_query_params(uri: &hyper::Uri) -> HashMap<String, String> {
|
|||||||
}
|
}
|
||||||
|
|
||||||
pub fn register_kms_route(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
|
pub fn register_kms_route(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
|
||||||
register_kms_management_route(r)?;
|
kms_management::register_kms_management_route(r)?;
|
||||||
kms_dynamic::register_kms_dynamic_route(r)?;
|
kms_dynamic::register_kms_dynamic_route(r)?;
|
||||||
kms_keys::register_kms_key_route(r)?;
|
kms_keys::register_kms_key_route(r)?;
|
||||||
|
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
fn register_kms_management_route(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
|
|
||||||
r.insert(
|
|
||||||
Method::POST,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/create-key").as_str(),
|
|
||||||
AdminOperation(&CreateKeyHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::GET,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/describe-key").as_str(),
|
|
||||||
AdminOperation(&DescribeKeyHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::GET,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/list-keys").as_str(),
|
|
||||||
AdminOperation(&ListKeysHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::POST,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/generate-data-key").as_str(),
|
|
||||||
AdminOperation(&GenerateDataKeyHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::GET,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/status").as_str(),
|
|
||||||
AdminOperation(&KmsStatusHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::GET,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/config").as_str(),
|
|
||||||
AdminOperation(&KmsConfigHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
r.insert(
|
|
||||||
Method::POST,
|
|
||||||
format!("{}{}", ADMIN_PREFIX, "/v3/kms/clear-cache").as_str(),
|
|
||||||
AdminOperation(&KmsClearCacheHandler {}),
|
|
||||||
)?;
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Create a new KMS master key
|
/// Create a new KMS master key
|
||||||
pub struct CreateKeyHandler {}
|
pub struct CreateKeyHandler {}
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,69 @@
|
|||||||
|
// Copyright 2024 RustFS Team
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
//! KMS management route registration.
|
||||||
|
|
||||||
|
use super::kms::{
|
||||||
|
CreateKeyHandler, DescribeKeyHandler, GenerateDataKeyHandler, KmsClearCacheHandler, KmsConfigHandler, KmsStatusHandler,
|
||||||
|
ListKeysHandler,
|
||||||
|
};
|
||||||
|
use crate::admin::router::{AdminOperation, S3Router};
|
||||||
|
use crate::server::ADMIN_PREFIX;
|
||||||
|
use hyper::Method;
|
||||||
|
|
||||||
|
pub fn register_kms_management_route(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
|
||||||
|
r.insert(
|
||||||
|
Method::POST,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/create-key").as_str(),
|
||||||
|
AdminOperation(&CreateKeyHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::GET,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/describe-key").as_str(),
|
||||||
|
AdminOperation(&DescribeKeyHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::GET,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/list-keys").as_str(),
|
||||||
|
AdminOperation(&ListKeysHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::POST,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/generate-data-key").as_str(),
|
||||||
|
AdminOperation(&GenerateDataKeyHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::GET,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/status").as_str(),
|
||||||
|
AdminOperation(&KmsStatusHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::GET,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/config").as_str(),
|
||||||
|
AdminOperation(&KmsConfigHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
r.insert(
|
||||||
|
Method::POST,
|
||||||
|
format!("{}{}", ADMIN_PREFIX, "/v3/kms/clear-cache").as_str(),
|
||||||
|
AdminOperation(&KmsClearCacheHandler {}),
|
||||||
|
)?;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
@@ -22,6 +22,7 @@ pub mod is_admin;
|
|||||||
pub mod kms;
|
pub mod kms;
|
||||||
pub mod kms_dynamic;
|
pub mod kms_dynamic;
|
||||||
pub mod kms_keys;
|
pub mod kms_keys;
|
||||||
|
pub mod kms_management;
|
||||||
pub mod metrics;
|
pub mod metrics;
|
||||||
pub mod policies;
|
pub mod policies;
|
||||||
pub mod pools;
|
pub mod pools;
|
||||||
|
|||||||
@@ -21,6 +21,8 @@ pub mod utils;
|
|||||||
|
|
||||||
#[cfg(test)]
|
#[cfg(test)]
|
||||||
mod console_test;
|
mod console_test;
|
||||||
|
#[cfg(test)]
|
||||||
|
mod route_registration_test;
|
||||||
|
|
||||||
use handlers::{bucket_meta, heal, health, kms, pools, profile_admin, quota, rebalance, replication, sts, system, tier, user};
|
use handlers::{bucket_meta, heal, health, kms, pools, profile_admin, quota, rebalance, replication, sts, system, tier, user};
|
||||||
use router::{AdminOperation, S3Router};
|
use router::{AdminOperation, S3Router};
|
||||||
|
|||||||
@@ -0,0 +1,99 @@
|
|||||||
|
// Copyright 2024 RustFS Team
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
use crate::admin::{
|
||||||
|
handlers::{bucket_meta, heal, health, kms, pools, profile_admin, quota, rebalance, replication, sts, system, tier, user},
|
||||||
|
router::{AdminOperation, S3Router},
|
||||||
|
};
|
||||||
|
use crate::server::{ADMIN_PREFIX, HEALTH_PREFIX, PROFILE_CPU_PATH, PROFILE_MEMORY_PATH};
|
||||||
|
use hyper::Method;
|
||||||
|
|
||||||
|
fn admin_path(path: &str) -> String {
|
||||||
|
format!("{}{}", ADMIN_PREFIX, path)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn assert_route(router: &S3Router<AdminOperation>, method: Method, path: &str) {
|
||||||
|
assert!(
|
||||||
|
router.contains_route(method.clone(), path),
|
||||||
|
"expected route missing: {} {}",
|
||||||
|
method.as_str(),
|
||||||
|
path
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_register_routes_cover_representative_admin_paths() {
|
||||||
|
let mut router: S3Router<AdminOperation> = S3Router::new(false);
|
||||||
|
|
||||||
|
health::register_health_route(&mut router).expect("register health route");
|
||||||
|
sts::register_admin_auth_route(&mut router).expect("register sts route");
|
||||||
|
user::register_user_route(&mut router).expect("register user route");
|
||||||
|
system::register_system_route(&mut router).expect("register system route");
|
||||||
|
pools::register_pool_route(&mut router).expect("register pool route");
|
||||||
|
rebalance::register_rebalance_route(&mut router).expect("register rebalance route");
|
||||||
|
heal::register_heal_route(&mut router).expect("register heal route");
|
||||||
|
tier::register_tier_route(&mut router).expect("register tier route");
|
||||||
|
quota::register_quota_route(&mut router).expect("register quota route");
|
||||||
|
bucket_meta::register_bucket_meta_route(&mut router).expect("register bucket meta route");
|
||||||
|
replication::register_replication_route(&mut router).expect("register replication route");
|
||||||
|
profile_admin::register_profiling_route(&mut router).expect("register profile route");
|
||||||
|
kms::register_kms_route(&mut router).expect("register kms route");
|
||||||
|
|
||||||
|
assert_route(&router, Method::GET, HEALTH_PREFIX);
|
||||||
|
assert_route(&router, Method::HEAD, HEALTH_PREFIX);
|
||||||
|
assert_route(&router, Method::GET, PROFILE_CPU_PATH);
|
||||||
|
assert_route(&router, Method::GET, PROFILE_MEMORY_PATH);
|
||||||
|
|
||||||
|
assert_route(&router, Method::POST, "/");
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/is-admin"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/list-users"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/add-user"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/set-user-status"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/groups"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/update-group-members"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/add-service-accounts"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/export-iam"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/import-iam"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/list-canned-policies"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/target/list"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/accountinfo"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/service"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/info"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/storageinfo"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/metrics"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/pools/list"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/rebalance/start"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/rebalance/status"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/heal/test-bucket"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/heal/test-bucket/prefix"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/tier"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/tier/clear"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/quota/test-bucket"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/quota-stats/test-bucket"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/export-bucket-metadata"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/import-bucket-metadata"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/list-remote-targets"));
|
||||||
|
assert_route(&router, Method::PUT, &admin_path("/v3/set-remote-target"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/debug/pprof/profile"));
|
||||||
|
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/kms/create-key"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/kms/configure"));
|
||||||
|
assert_route(&router, Method::POST, &admin_path("/v3/kms/keys"));
|
||||||
|
assert_route(&router, Method::GET, &admin_path("/v3/kms/keys/test-key"));
|
||||||
|
}
|
||||||
@@ -71,6 +71,14 @@ impl<T: Operation> S3Router<T> {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
impl<T: Operation> S3Router<T> {
|
||||||
|
pub(crate) fn contains_route(&self, method: Method, path: &str) -> bool {
|
||||||
|
let route = Self::make_route_str(method, path);
|
||||||
|
self.router.at(&route).is_ok()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
impl<T: Operation> Default for S3Router<T> {
|
impl<T: Operation> Default for S3Router<T> {
|
||||||
fn default() -> Self {
|
fn default() -> Self {
|
||||||
Self::new(false)
|
Self::new(false)
|
||||||
|
|||||||
Reference in New Issue
Block a user