Skip to content

Commit afd2edd

Browse files
alanprotalanprot
committed
no encrypting bucket index
1 parent 7b51a48 commit afd2edd

File tree

13 files changed

+10
-216
lines changed

13 files changed

+10
-216
lines changed

‎pkg/compactor/blocks_cleaner.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -325,10 +325,6 @@ func (c *BlocksCleaner) cleanUser(ctx context.Context, userID string, firstRun b
325325
idx, err := bucketindex.ReadIndex(ctx, c.bucketClient, userID, c.cfgProvider, c.logger)
326326
if errors.Is(err, bucketindex.ErrIndexCorrupted) {
327327
level.Warn(userLogger).Log("msg", "found a corrupted bucket index, recreating it")
328-
} else if errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
329-
// Give up cleaning if we get access denied
330-
level.Warn(userLogger).Log("msg", err.Error())
331-
return nil
332328
} else if err != nil && !errors.Is(err, bucketindex.ErrIndexNotFound) {
333329
return err
334330
}

‎pkg/querier/blocks_finder_bucket_index.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ import (
1010
"github.com/prometheus/client_golang/prometheus"
1111
"github.com/thanos-io/objstore"
1212

13-
"github.com/cortexproject/cortex/pkg/util/validation"
14-
1513
"github.com/cortexproject/cortex/pkg/storage/bucket"
1614
"github.com/cortexproject/cortex/pkg/storage/tsdb/bucketindex"
1715
"github.com/cortexproject/cortex/pkg/util/services"
@@ -65,10 +63,6 @@ func (f *BucketIndexBlocksFinder) GetBlocks(ctx context.Context, userID string,
6563
return nil, nil, nil
6664
}
6765

68-
if errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
69-
return nil, nil, validation.AccessDeniedError(err.Error())
70-
}
71-
7266
if err != nil {
7367
return nil, nil, err
7468
}

‎pkg/storage/bucket/client.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@ var (
4040
SupportedBackends = []string{S3, GCS, Azure, Swift, Filesystem}
4141

4242
ErrUnsupportedStorageBackend = errors.New("unsupported storage backend")
43-
44-
ErrCustomerManagedKeyAccessDenied = errors.New("access denied: customer key")
4543
)
4644

4745
// Config holds configuration for accessing long-term storage.

‎pkg/storage/tsdb/bucketindex/index.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ type Index struct {
4141
// UpdatedAt is a unix timestamp (seconds precision) of when the index has been updated
4242
// (written in the storage) the last time.
4343
UpdatedAt int64 `json:"updated_at"`
44+
45+
UnavailableBlocks []string `json:"unavailable_blocks"`
4446
}
4547

4648
func (idx *Index) GetUpdatedAt() time.Time {

‎pkg/storage/tsdb/bucketindex/loader.go

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,6 @@ func (l *Loader) GetIndex(ctx context.Context, userID string) (*Index, error) {
115115

116116
if errors.Is(err, ErrIndexNotFound) {
117117
level.Warn(l.logger).Log("msg", "bucket index not found", "user", userID)
118-
} else if errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
119-
level.Warn(l.logger).Log("msg", "key access denied when reading bucket index", "user", userID)
120118
} else {
121119
// We don't track ErrIndexNotFound as failure because it's a legit case (eg. a tenant just
122120
// started to remote write and its blocks haven't uploaded to storage yet).
@@ -198,7 +196,7 @@ func (l *Loader) updateCachedIndex(ctx context.Context, userID string) {
198196
l.loadAttempts.Inc()
199197
startTime := time.Now()
200198
idx, err := ReadIndex(readCtx, l.bkt, userID, l.cfgProvider, l.logger)
201-
if err != nil && !errors.Is(err, ErrIndexNotFound) && !errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
199+
if err != nil && !errors.Is(err, ErrIndexNotFound) {
202200
l.loadFailures.Inc()
203201
level.Warn(l.logger).Log("msg", "unable to update bucket index", "user", userID, "err", err)
204202
return

‎pkg/storage/tsdb/bucketindex/loader_test.go

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,11 @@ import (
1010

1111
"github.com/go-kit/log"
1212
"github.com/oklog/ulid"
13-
"github.com/pkg/errors"
1413
"github.com/prometheus/client_golang/prometheus"
1514
"github.com/prometheus/client_golang/prometheus/testutil"
1615
"github.com/stretchr/testify/assert"
1716
"github.com/stretchr/testify/require"
1817

19-
"github.com/cortexproject/cortex/pkg/storage/bucket"
20-
2118
cortex_testutil "github.com/cortexproject/cortex/pkg/storage/tsdb/testutil"
2219
"github.com/cortexproject/cortex/pkg/util/services"
2320
"github.com/cortexproject/cortex/pkg/util/test"
@@ -602,9 +599,6 @@ func TestLoader_ShouldUpdateIndexInBackgroundOnPreviousKeyAcessDenied(t *testing
602599
require.NoError(t, services.StopAndAwaitTerminated(ctx, loader))
603600
})
604601

605-
_, err := loader.GetIndex(ctx, user)
606-
require.True(t, errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied))
607-
608602
// Check cached
609603
require.NoError(t, loader.checkCachedIndexes(ctx))
610604

@@ -646,50 +640,6 @@ func TestLoader_ShouldUpdateIndexInBackgroundOnPreviousKeyAcessDenied(t *testing
646640
))
647641
}
648642

649-
func TestLoader_GetIndex_ShouldCacheKeyDeniedErrors(t *testing.T) {
650-
user := "user-1"
651-
ctx := context.Background()
652-
reg := prometheus.NewPedanticRegistry()
653-
bkt, _ := cortex_testutil.PrepareFilesystemBucket(t)
654-
655-
bkt = &cortex_testutil.MockBucketFailure{
656-
Bucket: bkt,
657-
GetFailures: map[string]error{
658-
path.Join(user, "bucket-index.json.gz"): cortex_testutil.ErrKeyAccessDeniedError,
659-
},
660-
}
661-
662-
// Create the loader.
663-
loader := NewLoader(prepareLoaderConfig(), bkt, nil, log.NewNopLogger(), reg)
664-
require.NoError(t, services.StartAndAwaitRunning(ctx, loader))
665-
t.Cleanup(func() {
666-
require.NoError(t, services.StopAndAwaitTerminated(ctx, loader))
667-
})
668-
669-
// Request the index multiple times.
670-
for i := 0; i < 10; i++ {
671-
_, err := loader.GetIndex(ctx, "user-1")
672-
require.True(t, errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied))
673-
}
674-
675-
// Ensure metrics have been updated accordingly.
676-
assert.NoError(t, testutil.GatherAndCompare(reg, bytes.NewBufferString(`
677-
# HELP cortex_bucket_index_load_failures_total Total number of bucket index loading failures.
678-
# TYPE cortex_bucket_index_load_failures_total counter
679-
cortex_bucket_index_load_failures_total 0
680-
# HELP cortex_bucket_index_loaded Number of bucket indexes currently loaded in-memory.
681-
# TYPE cortex_bucket_index_loaded gauge
682-
cortex_bucket_index_loaded 0
683-
# HELP cortex_bucket_index_loads_total Total number of bucket index loading attempts.
684-
# TYPE cortex_bucket_index_loads_total counter
685-
cortex_bucket_index_loads_total 1
686-
`),
687-
"cortex_bucket_index_loads_total",
688-
"cortex_bucket_index_load_failures_total",
689-
"cortex_bucket_index_loaded",
690-
))
691-
}
692-
693643
func prepareLoaderConfig() LoaderConfig {
694644
return LoaderConfig{
695645
CheckInterval: time.Minute,

‎pkg/storage/tsdb/bucketindex/storage.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"github.com/cortexproject/cortex/pkg/storage/tsdb"
1414

1515
"github.com/cortexproject/cortex/pkg/storage/bucket"
16-
cortex_errors "github.com/cortexproject/cortex/pkg/util/errors"
1716
"github.com/cortexproject/cortex/pkg/util/runutil"
1817
)
1918

@@ -32,11 +31,6 @@ func ReadIndex(ctx context.Context, bkt objstore.Bucket, userID string, cfgProvi
3231
if userBkt.IsObjNotFoundErr(err) {
3332
return nil, ErrIndexNotFound
3433
}
35-
36-
if userBkt.IsCustomerManagedKeyError(err) {
37-
return nil, cortex_errors.WithCause(bucket.ErrCustomerManagedKeyAccessDenied, err)
38-
}
39-
4034
return nil, errors.Wrap(err, "read bucket index")
4135
}
4236
defer runutil.CloseWithLogOnErr(logger, reader, "close bucket index reader")

‎pkg/storage/tsdb/bucketindex/storage_test.go

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package bucketindex
22

33
import (
44
"context"
5-
"errors"
65
"path"
76
"strings"
87
"testing"
@@ -11,8 +10,6 @@ import (
1110
"github.com/stretchr/testify/assert"
1211
"github.com/stretchr/testify/require"
1312

14-
"github.com/cortexproject/cortex/pkg/storage/bucket"
15-
1613
"github.com/cortexproject/cortex/pkg/storage/tsdb/testutil"
1714
cortex_testutil "github.com/cortexproject/cortex/pkg/storage/tsdb/testutil"
1815
)
@@ -39,19 +36,6 @@ func TestReadIndex_ShouldReturnErrorIfIndexIsCorrupted(t *testing.T) {
3936
require.Nil(t, idx)
4037
}
4138

42-
func TestReadIndex_ShouldReturnErrorIfKeyAccessDeniedErr(t *testing.T) {
43-
bkt, _ := cortex_testutil.PrepareFilesystemBucket(t)
44-
bkt = &cortex_testutil.MockBucketFailure{
45-
Bucket: bkt,
46-
GetFailures: map[string]error{
47-
path.Join("user-1", "bucket-index.json.gz"): cortex_testutil.ErrKeyAccessDeniedError,
48-
},
49-
}
50-
idx, err := ReadIndex(context.Background(), bkt, "user-1", nil, log.NewNopLogger())
51-
require.True(t, errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied))
52-
require.Nil(t, idx)
53-
}
54-
5539
func TestReadIndex_ShouldReturnTheParsedIndexOnSuccess(t *testing.T) {
5640
const userID = "user-1"
5741

‎pkg/storage/tsdb/bucketindex/updater.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,7 @@ func (w *Updater) updateBlocks(ctx context.Context, old []*Block) (blocks []*Blo
113113
continue
114114
}
115115
if errors.Is(err, errBlockMetaKeyAccessDeniedErr) {
116-
partials[id] = err
117-
level.Warn(w.logger).Log("msg", "skipped partial block when updating bucket index due key permission", "block", id.String())
116+
level.Warn(w.logger).Log("msg", "skipped block when updating bucket index due key permission", "block", id.String())
118117
continue
119118
}
120119
if errors.Is(err, ErrBlockMetaCorrupted) {

‎pkg/storegateway/bucket_index_metadata_fetcher.go

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919

2020
const (
2121
corruptedBucketIndex = "corrupted-bucket-index"
22-
keyAccessDenied = "key-access-denied"
2322
noBucketIndex = "no-bucket-index"
2423
)
2524

@@ -68,7 +67,7 @@ func (f *BucketIndexMetadataFetcher) Fetch(ctx context.Context) (metas map[ulid.
6867
start := time.Now()
6968
defer func() {
7069
f.metrics.SyncDuration.Observe(time.Since(start).Seconds())
71-
if err != nil && !errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
70+
if err != nil {
7271
f.metrics.SyncFailures.Inc()
7372
}
7473
}()
@@ -95,16 +94,6 @@ func (f *BucketIndexMetadataFetcher) Fetch(ctx context.Context) (metas map[ulid.
9594
return nil, nil, nil
9695
}
9796

98-
if errors.Is(err, bucket.ErrCustomerManagedKeyAccessDenied) {
99-
// stop the job and return the error
100-
// this error should be used to return Access Denied to the caller
101-
level.Error(f.logger).Log("msg", "bucket index key permission revoked", "user", f.userID, "err", err)
102-
f.metrics.Synced.WithLabelValues(keyAccessDenied).Set(1)
103-
f.metrics.Submit()
104-
105-
return nil, nil, err
106-
}
107-
10897
if err != nil {
10998
f.metrics.Synced.WithLabelValues(block.FailedMeta).Set(1)
11099
f.metrics.Submit()

0 commit comments

Comments
 (0)