[HDDS-4944] Multi-Tenant Support in Ozone

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Component/s: Ozone CLI, Ozone Datanode, Ozone Manager, S3, SCM, Security
• Labels: ozone-multitenancy pull-request-available
• Assignee: Prashant Pogde
• Reporter: Prashant Pogde
• Created: 09/Mar/21 20:01
• Updated: 03/Oct/22 22:13

Description

This Jira will be used to track a new feature for Multi-Tenant support in Ozone. Initially Multi-Tenant feature would be limited to ozone-users accessing Ozone over S3 interface.

Sub-Tasks

• Initial ProtoTyping for Ozone Multi-Tenant Feature: Resolved
• Support Ozone s3 authentication with arbitrary accessId that is not same as the kerberos ID.: Resolved
• Support revoking S3 secret: Resolved
• Add new OM DB tables for AssignUserToTenant: Resolved
• Chroot S3 requests for a tenant to their corresponding volume: Resolved
• [Multi-Tenant] Implement AssignUserToTenant: Resolved
• [Multi-Tenant] GetS3Secret should retrieve secret from new tables as well: Resolved
• [Multi-Tenant] Implement GetUserInfo: Resolved
• [Multi-Tenant] Implement AssignTenantAdmin, RevokeTenantAdmin, ListTenant, RevokeAccessID: Resolved
• [Multi-Tenant] Implement ListUsersInTenant: Resolved
• [Multi-Tenant] Implement `ozone tenant user getsecret` that does not generate secret when accessId does not exist: Resolved
• Move Ranger REST API interactions under same interface as Ranger client: Resolved
• [Multi-Tenant] Implement SetSecret: `ozone tenant user setsecret` and `ozone s3 setsecret`: Resolved
• Use changes from HDDS-5881 for volume chroot: Resolved
• [Multi-Tenant] Implement DeleteTenant: `ozone tenant delete`: Resolved
• [Multi-Tenant] Implement Cross-Tenant Bucket Sharing: Resolved
• [Multi-Tenant] Intermittent failure in TestOzoneTenantShell#testOzoneTenantBasicOperations: Resolved
• S3SecretManagerImpl#getS3Secret should (prefer to) use TenantAccessIdTable: Resolved
• [Multi-Tenant] Bucket owner should be set to the user principal when creating bucket through aws s3api: Resolved
• [Multi-Tenant] Use VOLUME_LOCK in read and write requests, and some minor refactoring: Resolved
• [Multi-Tenant] Properly iterate cache and table in OzoneManager#listTenant: Resolved
• [Multi-Tenant] Handle upgrades to version supporting S3 multi-tenancy: Resolved
• [Multi-Tenant] Fix KMS Encryption/Decryption: Resolved
• [Multi-Tenant] Add feature documentation and CLI quick start guide: Resolved
• [Multi-Tenant] Disallow specifying custom accessId in OzoneManager: Resolved
• [Multi-Tenant] Implement tenant request metrics: Resolved
• [Multi-Tenant] Refactor OMMultitenantManager and OMTenantRequestHelper: Resolved
• [Multi-Tenant] Merge and cleanup tenant group/role/policy tables, refactor protobuf messages and `isTenantAdmin`: Resolved
• [Multi-Tenant] Clean up unused tenantDefaultPolicyName field in CreateTenantRequest protobuf message: Resolved
• [Multi-Tenant] Fix a permission check bug that prevents non-delegated admins from assigning/revoking users to/from the tenant: Resolved
• [Multi-Tenant] Update documentation around Ranger policy creation on bucket sharing: Resolved
• [Multi-Tenant] Provide OM DB to Apache Ranger Sync mechanism: Resolved
• [Multi-Tenant] Add proper locking between Ranger background sync service and tenant requests; bug fixes: Resolved
• [Multi-Tenant] Use Ranger Java client: Resolved
• [Multi-Tenant] Add tenant CLI option to print results in JSON: Resolved
• [Multi-Tenant] Add a config key to enable or disable S3 Multi-Tenancy feature: Resolved
• [Multi-Tenant] Follow-up: Set owner of buckets created via S3 Gateway to actual user: Resolved
• [MultiTenancy] User get-secret throws USER_MISMATCH: Resolved
• [MultiTenancy] No user validation on assignUser API: Resolved
• [MultiTenancy] Tenant being created on existing volume: Resolved
• [MultiTenancy] Preferred list output for userList/userInfo APIs: Resolved
• [MultiTenancy] Create uniform output for AWS secrets across APIs: Resolved
• [MultiTenancy] Kerberos principal should be replaced with actual user: Resolved
• [MultiTenancy] Assign admin should not default to delegated admin: Resolved
• [MultiTenancy] User List and Tenant List to have --json output: Resolved
• [MultiTenancy] DBinfo message on console on missing accessId: Resolved
• [Multi-Tenant] Work around Ranger client not supporting service version call: Resolved
• [Multi-Tenant] Use RangerClient for Ranger operations: Resolved
• [Multi-Tenant] Move Ranger plugin version to a separate tag: Resolved
• [Multi-Tenant] Fix USER_MISMATCH error even on correct user: Resolved
• [Multi-Tenant] Set QuotaInBytes and QuotaInNamespace during Tenant Create: Resolved
• [Multi-Tenant] Fix warning message when OM BG Sync is unable to get Ozone service policy version from Ranger: Resolved
• Rebuilding tenant cache omits empty tenants: Resolved
• NPE when Ranger client throws RangerServiceException without Status: Resolved
• [Multi-Tenant] Allow tenant creation with volume name different than tenant name.: Open
• [MultiTenancy] User list should have admin information: Open
• [Multi-Tenant] Add a mock Ranger server to test Ranger HTTP endpoint calls: Open
• [MultiTenancy] Failed to assign user to tenant: Open
• [MultiTenancy] User info should have limited access except for admin: Open
• [Multi-Tenant] Add CLI Documentation: Resolved
• [Multi-Tenant] Add a Kerberized version of TestOzoneTenantShell: Open
• [Multi-Tenant] Use optimistic read in Ranger background sync: Resolved
• [Multi-Tenant] Add proper error message to TenantAssignAdmin and TenantRevokeAdmin: Resolved
• [Multi-Tenant] Add Volume Existence check in preExecute for OMTenantCreateRequest: Resolved
• Recon: Add multi-tenancy info display or statistics: Open
• [Multi-Tenant] Add CLI option to allow tenant creation on top of existing volumes: Patch Available