[jira] [Created] (HDDS-16489) Implement PutObjectRetention

["Chung-En Lee (Jira)" <ji...@apache.org>]

Chung-En Lee created HDDS-16489:
-----------------------------------

             Summary: Implement PutObjectRetention
                 Key: HDDS-16489
                 URL: https://issues.apache.org/jira/browse/HDDS-16489
             Project: Apache Ozone
          Issue Type: Sub-task
            Reporter: Chung-En Lee


mplement the S3 {{PutObjectRetention}} operation to configure or update retention settings ({{{}GOVERNANCE{}}} or {{{}COMPLIANCE{}}}) on individual keys in an Object-Lock-enabled bucket. This task covers S3 Gateway request parsing, OM RPC messages, Ranger authorization, and OM HA validation rules.

{*}1. S3 Gateway ({{{}hadoop-ozone/s3gateway{}}}){*}:
 * Route {{{}PUT /\{bucket}/\{key}?retention{}}}.

 * Parse the incoming {{Retention}} XML payload ({{{}Mode{}}}: {{GOVERNANCE}} or {{{}COMPLIANCE{}}}, and {{RetainUntilDate}} in ISO-8601 format).

 * Parse the request header {{x-amz-bypass-governance-retention}} (boolean).

 * Forward the parsed retention configuration and bypass flag to Ozone Manager via client protocol.

 * Map errors to standard S3 responses (e.g., {{{}InvalidArgument{}}}, {{{}AccessDenied{}}}, {{{}NoSuchKey{}}}).

{*}2. Protobuf Protocol ({{{}OmClientProtocol.proto{}}}){*}:
 * Add client RPC messages:

 ** {{SetObjectRetentionRequest}} (contains {{{}volumeName{}}}, {{{}bucketName{}}}, {{{}keyName{}}}, {{{}RetentionConfig{}}}, and {{bypassGovernanceRetention}} flag).

 ** {{{}SetObjectRetentionResponse{}}}.

 * Register request in OM dispatching pipeline.

{*}3. {{OMKeySetRetentionRequest}}{*}:
 * {*}{{preExecute}}{*}:

 ** Authorize the caller against Ranger action {{{}PutObjectRetention{}}}.

 ** If {{bypassGovernanceRetention}} is {{{}true{}}}, additionally authorize against Ranger action {{{}BypassGovernanceRetention{}}}.

 ** Validate payload parameters (e.g., valid timestamp format, {{RetainUntilDate}} must be in the future).

 * {*}{{validateAndUpdateCache}}{*}:

 ** Acquire key write lock.

 ** Verify target bucket has {{{}objectLockEnabled == true{}}}; reject if Object Lock is disabled on the bucket.

 ** Fetch current {{OmKeyInfo}} from {{{}KeyTable{}}}. If absent, throw {{{}KEY_NOT_FOUND{}}}.

 ** Evaluate transition rules:

 *** {*}Compliance Mode{*}: If the key is currently locked in {{COMPLIANCE}} mode:

 **** The new mode MUST remain {{COMPLIANCE}} (cannot switch to {{{}GOVERNANCE{}}}).

 **** The new {{RetainUntilDate}} MUST be $\ge$ the existing {{RetainUntilDate}} (cannot shorten retention period).

 *** {*}Governance Mode{*}: If shortening retention duration or overwriting an unexpired governance lock:

 **** Caller must have verified {{BypassGovernanceRetention}} permission AND passed {{{}bypassGovernanceRetention == true{}}}; otherwise reject with {{{}AccessDenied{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org