From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 8A4D11FF16F for ; Tue, 22 Jul 2025 12:11:03 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 5876235CAD; Tue, 22 Jul 2025 12:12:08 +0200 (CEST) From: Christian Ebner To: pbs-devel@lists.proxmox.com Date: Tue, 22 Jul 2025 12:10:24 +0200 Message-ID: <20250722101106.526438-9-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.2 In-Reply-To: <20250722101106.526438-1-c.ebner@proxmox.com> References: <20250722101106.526438-1-c.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1753179079722 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.045 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] [PATCH proxmox-backup v11 04/46] api: datastore: check s3 backend bucket access on datastore create X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Backup Server development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pbs-devel-bounces@lists.proxmox.com Sender: "pbs-devel" Check if the configured S3 object store backend can be reached and the provided secrets have the permissions to access the bucket. Perform the check before creating the chunk store, so it is not left behind if the bucket cannot be reached. Signed-off-by: Christian Ebner --- changes since version 10: - merge secrest with client config Cargo.toml | 2 +- src/api2/config/datastore.rs | 40 +++++++++++++++++++++++++++++++----- 2 files changed, 36 insertions(+), 6 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 28c78cc1d..30d2a74f4 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -77,7 +77,7 @@ proxmox-rest-server = { version = "1", features = [ "templates" ] } proxmox-router = { version = "3.2.2", default-features = false } proxmox-rrd = "1" proxmox-rrd-api-types = "1.0.2" -proxmox-s3-client = "1.0.0" +proxmox-s3-client = { version = "1.0.0", features = [ "impl" ] } # everything but pbs-config and pbs-client use "api-macro" proxmox-schema = "4" proxmox-section-config = "3" diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs index b133be707..82831d3a1 100644 --- a/src/api2/config/datastore.rs +++ b/src/api2/config/datastore.rs @@ -1,22 +1,24 @@ use std::path::{Path, PathBuf}; use ::serde::{Deserialize, Serialize}; -use anyhow::{bail, Context, Error}; +use anyhow::{bail, format_err, Context, Error}; use hex::FromHex; use serde_json::Value; use tracing::{info, warn}; use proxmox_router::{http_bail, Permission, Router, RpcEnvironment, RpcEnvironmentType}; +use proxmox_s3_client::{S3Client, S3ClientConfig, S3ClientOptions}; use proxmox_schema::{api, param_bail, ApiType}; use proxmox_section_config::SectionConfigData; use proxmox_uuid::Uuid; use pbs_api_types::{ - Authid, DataStoreConfig, DataStoreConfigUpdater, DatastoreNotify, DatastoreTuning, KeepOptions, - MaintenanceMode, PruneJobConfig, PruneJobOptions, DATASTORE_SCHEMA, PRIV_DATASTORE_ALLOCATE, - PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA, - UPID_SCHEMA, + Authid, DataStoreConfig, DataStoreConfigUpdater, DatastoreBackendConfig, DatastoreBackendType, + DatastoreNotify, DatastoreTuning, KeepOptions, MaintenanceMode, PruneJobConfig, + PruneJobOptions, DATASTORE_SCHEMA, PRIV_DATASTORE_ALLOCATE, PRIV_DATASTORE_AUDIT, + PRIV_DATASTORE_MODIFY, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA, UPID_SCHEMA, }; +use pbs_config::s3::S3_CFG_TYPE_ID; use pbs_config::BackupLockGuard; use pbs_datastore::chunk_store::ChunkStore; @@ -116,6 +118,34 @@ pub(crate) fn do_create_datastore( .parse_property_string(datastore.tuning.as_deref().unwrap_or(""))?, )?; + if let Some(ref backend_config) = datastore.backend { + let backend_config: DatastoreBackendConfig = backend_config.parse()?; + match backend_config.ty.unwrap_or_default() { + DatastoreBackendType::Filesystem => (), + DatastoreBackendType::S3 => { + let s3_client_id = backend_config + .client + .as_ref() + .ok_or_else(|| format_err!("missing required client"))?; + let bucket = backend_config + .bucket + .clone() + .ok_or_else(|| format_err!("missing required bucket"))?; + let (config, _config_digest) = + pbs_config::s3::config().context("failed to get s3 config")?; + let config: S3ClientConfig = config + .lookup(S3_CFG_TYPE_ID, s3_client_id) + .with_context(|| format!("no '{s3_client_id}' in config"))?; + let options = + S3ClientOptions::from_config(config, bucket, datastore.name.to_owned()); + let s3_client = S3Client::new(options).context("failed to create s3 client")?; + // Fine to block since this runs in worker task + proxmox_async::runtime::block_on(s3_client.head_bucket()) + .context("failed to access bucket")?; + } + } + } + let unmount_guard = if datastore.backing_device.is_some() { do_mount_device(datastore.clone())?; UnmountGuard::new(Some(path.clone())) -- 2.47.2 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel