Ceph » rgw

The fix is been submitted to the link https://github.com/ceph/ceph/pull/54767

The test results are shown below.
The request to delete an object does not contain the x-amz-bypass-governance-retention header. The test script is as follow.

#!/usr/bin/python
from boto3.session import Session
import boto3
import logging
import os,sys
bucketname= 'buck-lock2'
objectname= '50M'
access_key = 'user1'
secret_key = 'user1'
endpoint = 'http://127.0.0.1:8000'
session = Session(access_key, secret_key)
config = boto3.session.Config(connect_timeout=3000000, read_timeout=3000000, retries={'max_attempts': 0}, signature_version="s3")
session = Session(access_key, secret_key)
s3_client = session.client('s3', endpoint_url=endpoint, config=config)
resp = s3_client.get_object_retention(Bucket=bucketname, Key=objectname)
print(resp['Retention'])

s3_client.delete_object(Bucket=bucketname, Key=objectname)

The following is the result of the script. Objects cannot be deleted without the x-amz-bypass-governance-retention header, returning a 403 error.

root@18d470fd3a9d ▶ python3 worm_multi.py
{'Mode': 'GOVERNANCE', 'RetainUntilDate': datetime.datetime(2023, 12, 5, 3, 28, 5, tzinfo=tzlocal())}

Traceback (most recent call last):
  File "/home/djf/ceph/build/worm_multi.py", line 72, in <module>
    s3_client.delete_object(Bucket=bucketname, Key=objectname, BypassGovernanceRetention=True, VersionId='WMwjhMNcByR6Sc-CC7HlmrkHwB5XCxh')#  BypassGovernanceRetention=True,
  File "/usr/local/lib/python3.9/site-packages/botocore/client.py", line 386, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.9/site-packages/botocore/client.py", line 705, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the DeleteObject operation: forbidden by object lock

The request to delete an object contains the x-amz-bypass-governance-retention header. The test script is as follow.

resp = s3_client.get_object_retention(Bucket=bucketname, Key=objectname)
print(resp['Retention'])

esp = s3_client.put_object_legal_hold(Bucket=bucketname, Key=objectname, LegalHold={'Status': 'OFF'})
resp = s3_client.get_object_legal_hold(Bucket=bucketname,Key=objectname)
print(resp)
s3_client.delete_object(Bucket=bucketname, Key=objectname, BypassGovernanceRetention=True)

The script is executed as follows. In the case with the x-amz-bypass-governance-retention header and with the LegalHold equal oFF, the object is successfully deleted.

root@18d470fd3a9d ▶ python3 worm_multi.py
{'Mode': 'GOVERNANCE', 'RetainUntilDate': datetime.datetime(2023, 12, 5, 11, 31, 45, tzinfo=tzlocal())}
{'ResponseMetadata': {'RequestId': 'tx0000077d81a1239d0c405-00656db8c7-1196-default', 'HostId': '', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amz-request-id': 'tx0000077d81a1239d0c405-00656db8c7-1196-default', 'content-type': 'application/xml', 'server': 'Ceph Object Gateway (reef)', 'content-length': '81', 'date': 'Mon, 04 Dec 2023 11:32:23 GMT', 'connection': 'Keep-Alive'}, 'RetryAttempts': 0}, 'LegalHold': {'Status': 'OFF'}}