NSFS | NC | IAM Service - Root Accounts Manager

[shirady]

Explain the changes

1. Add more properties to nsfs_account_schema (not required):

• iam_operate_on_root_account = boolean (if an account was set with true. then it is a roots accounts manager).

2. Add the option of iam_operate_on_root_account in noobaa cli.
3. Edit all the functions in AccountSpaceFS (CRUD) to operate on root accounts when the requesting account is a root accounts manager.

Issues:

List of GAPs:

1. Parsing and validating the params (for example: username).
2. No NoobaaEvent at this point.
3. Change the IamError class to have a template message.

Testing Instructions:

Unit Tests

Please run:

1. sudo npx jest test_accountspace_fs.test.js
2. npx jest test_nc_nsfs_account_schema_validation.test.js
3. sudo npx jest test_nc_nsfs_account_cli.test.js
4. sudo npx jest test_nc_nsfs_bucket_cli.test.js
5. sudo node ./node_modules/.bin/_mocha src/test/unit_tests/test_nc_nsfs_cli.js

Manual Tests

IAM changes in NC NSFS
Currently, we do not validate the input, so the test should use only valid input.

1. Create the root accounts manager with the CLI: sudo node src/cmd/manage_nsfs account add --name <account-name> --new_buckets_path /tmp/nsfs_root1 --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid> --iam_operate_on_root_account
   Note: before creating the account need to give permission to the new_buckets_path: chmod 777 /tmp/nsfs_root1.
2. Start the NSFS server with: sudo node src/cmd/nsfs --debug 5 --https_port_iam 7005
   Note: before starting the server please add this line: process.env.NOOBAA_LOG_LEVEL = 'nsfs'; in the endpoint.js (before the condition if (process.env.NOOBAA_LOG_LEVEL) {)
3. Create the alias for IAM service: alias s3-nc-user-manager-iam='AWS_ACCESS_KEY_ID=<acess-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'.
4. Use AWS CLI to send requests to the IAM service, for example:
   s3-nc-manager-1-iam iam create-user --user-name Bob-root --path '/division_abc/subdivision_xyz/'
s3-nc-manager-1-iam iam create-access-key --user-name Bob-root
s3-nc-manager-1-iam iam get-access-key-last-used --access-key-id <access-key>
s3-nc-manager-1-iam iam update-access-key --access-key-id <access-key> --user-name Bob-root --status Inactive
s3-nc-manager-1-iam iam delete-access-key --access-key-id <access-key> --user-name Bob-root
s3-nc-manager-1-iam iam list-access-keys --user-name Bob-root
   Note: the account created by a root accounts manager using the IAM API is a root account.

• Doc added/updated
• Tests added