Skip to content

Add object locking and retention support to Bucket CRD#133

Open
mr-083 wants to merge 1 commit intoInseeFrLab:mainfrom
mr-083:feature/object-locking
Open

Add object locking and retention support to Bucket CRD#133
mr-083 wants to merge 1 commit intoInseeFrLab:mainfrom
mr-083:feature/object-locking

Conversation

@mr-083
Copy link
Copy Markdown

@mr-083 mr-083 commented Apr 2, 2026

Summary

  • Add objectLocking (bool, immutable) and retention (mode + days) fields to BucketSpec
  • CreateBucket passes ObjectLocking: true to minio.MakeBucketOptions when enabled
  • SetBucketRetention sets default governance/compliance retention after bucket creation
  • CRDs regenerated with kubebuilder validation (enum, minimum, immutability)
  • All existing tests updated and passing

Example

apiVersion: s3.onyxia.sh/v1alpha1
kind: Bucket
metadata:
  name: backup-immutable
spec:
  name: backup-immutable
  quota:
    default: 5Gi
  objectLocking: true
  retention:
    mode: governance
    days: 90
  s3InstanceRef: s3-operator/default

Test plan

  • go build ./... passes
  • go test ./internal/controller/bucket/ -v passes
  • Tested on live AIStor cluster: bucket created with object locking + 90-day governance retention via CRD
  • mc retention info confirms GOVERNANCE configured for 90DAYS

Add objectLocking and retention fields to BucketSpec, enabling
declarative immutable bucket creation via Kubernetes CRDs.

- BucketSpec: add objectLocking (bool, immutable) and retention
  (mode: governance|compliance, days: uint) fields
- S3Client: CreateBucket now accepts objectLocking parameter,
  new SetBucketRetention method for default retention config
- Controller: pass objectLocking to MakeBucket, apply retention
  after bucket creation when both objectLocking and retention are set
- CRDs: regenerated with kubebuilder validation markers
- Tests: updated mocks and test utils for new CreateBucket signature

Example usage:
  apiVersion: s3.onyxia.sh/v1alpha1
  kind: Bucket
  spec:
    name: backup-immutable
    objectLocking: true
    retention:
      mode: governance
      days: 90
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant