blob

package
v0.12.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 11, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package blob is the blob storage service: the function-facing, binding-gated Facade (ADR-0127) over the blob.Bucket substrate, plus the blob services.TypeHandler the Service dispatcher routes type:blob to.

ADR-0127 makes context.blob the blob twin of context.kv (ADR-0069): blob bindings live on the consumer (Function.spec.blob), and authorization is the PDP's job. The facade resolves a caller's (function, alias) to a (bucket, prefix) — that is NAMING (ADR-0073 bind-as-grant, default-deny) — then asks the PDP the SAME per-object question the S3 frontend asks (ADR-0080's S3Capability): s3::read (get/list/sign-GET) or s3::write (put/delete/sign-PUT/DELETE) on the bound BlobPrefix, with the connection-scoped caller Function as the principal (whose spec.blob the capability materializes as its blobBindings). It acts on the SAME s3BucketFor substrate view under the SAME blobKey keyspace as the frontend, so context.blob objects and the S3-frontend objects are one and the same. A PDP deny maps to fault.Forbidden.

This supersedes the unused legacy ADR-0021 NewFacade (which authorized Kind:Service with no per-object Action — an RBAC-role question that could not enforce spec.blob bind-as-grant). The live Service- dispatcher TypeHandler is unchanged.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewHandler 

func NewHandler() services.TypeHandler

NewHandler returns the blob services.TypeHandler (Type() == ServiceTypeBlob).

Types

type Binding 

type Binding struct {
	Bucket v1.ObjectName
	Prefix string
}

Binding is the resolved blob binding for a (caller, alias) pair (ADR-0127/0073): the target bucket + prefix sub-domain the alias names. The binding IS the capability — everything the facade needs to key the object and name the BlobPrefix the S3 PDP authorizes.

type BindingResolver 

type BindingResolver interface {
	Resolve(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias string) (Binding, error)
}

BindingResolver maps a caller function + alias to its (bucket, prefix) (ADR-0127). It reads the caller's Function.spec.blob (the binding IS the capability) — fault.Forbidden when the caller has no spec.blob entry for the alias (default-deny, ADR-0073).

func NewResolver 

func NewResolver(r MetaReader) (BindingResolver, error)

NewResolver builds the metastore-backed BindingResolver. r is required.

type BucketResolver 

type BucketResolver func(ns v1.NamespaceName, bucket string) (blob.Bucket, bool)

BucketResolver maps an (ns, bucket-name) to a prefixed substrate view — the s3gateway BucketFor (pkg/funcd's s3BucketFor). A miss (no such bucket) ⇒ the facade returns fault.NotFound.

type Facade 

type Facade struct {
	// contains filtered or unexported fields
}

Facade is what a function calls via context.blob: binding-resolved + PDP-authorized + prefix-keyed blob storage (ADR-0127). It satisfies the worker-node local API's Blob port directly — it builds the Function principal internally, so no adapter is needed.

func NewFacade 

func NewFacade(d FacadeDeps) (*Facade, error)

NewFacade builds the blob facade. Resolver, BucketFor, and Authorizer are required.

func (*Facade) CheckRead added in v0.11.0 

func (f *Facade) CheckRead(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias string) error

CheckRead resolves the alias, asks the PDP s3::read on its prefix and resolves its bucket, as Get does, with no storage call: the dependency check of a caller's binding (ADR-0215 Decision 3).

func (*Facade) Delete 

func (f *Facade) Delete(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias, key string) error

Delete removes the alias's key. The PDP authorizes s3::write (owner-only).

func (*Facade) Get 

func (f *Facade) Get(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias, key string) ([]byte, bool, error)

Get returns the object's bytes for the alias's key (found=false on a missing object). The PDP authorizes s3::read on the bound prefix (ADR-0127).

func (*Facade) List 

func (f *Facade) List(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias, prefix string) ([]string, error)

List returns the alias's keys under prefix. Like Get, it authorizes s3::read (ADR-0127). Keys are returned relative to the bound prefix (the prefix sub-domain is stripped) so the caller sees only its own key space.

func (*Facade) Put 

func (f *Facade) Put(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias, key string, data []byte) error

Put stores data under the alias's key. The PDP authorizes s3::write — the built-in prefix-owner rule makes writes owner-only (ADR-0080/0127).

func (*Facade) SignedURL 

func (f *Facade) SignedURL(ctx context.Context, ns v1.NamespaceName, fn v1.ObjectName, alias, key string, opts blob.SignOptions) (string, error)

SignedURL returns a substrate-driver presigned URL for the object. It authorizes the CAPABILITY the URL grants (derived from opts.Method): a presigned PUT/DELETE bypasses the facade to write/delete, so it requires s3::write (no read→write escalation); a GET requires s3::read (ADR-0127).

type FacadeDeps 

type FacadeDeps struct {
	Resolver   BindingResolver
	BucketFor  BucketResolver
	Authorizer auth.Authorizer
	Logger     *slog.Logger
}

FacadeDeps configures the blob facade (the PEP). The Resolver (ADR-0127/0073) resolves the alias→(bucket,prefix) NAMING; the BucketFor maps (ns,bucket)→substrate; the Authorizer (ADR-0080 S3Capability) is the PDP that decides s3::read/s3::write.

type MetaReader 

type MetaReader interface {
	Get(ctx context.Context, gvk v1.GroupVersionKind, ns v1.NamespaceName, name v1.ObjectName) (v1.Object, error)
}

MetaReader is the read-only metastore view the resolver needs (a subset of store.Store), declared here so the blob package stays near-leaf; the wiring adapts the real store.Store to it.

type Reconciler added in v0.11.0 

type Reconciler struct {
	// contains filtered or unexported fields
}

Reconciler is the controller.Reconciler for KindBucket: it writes only a Bucket's status, from the blob storage probe.

func NewReconciler added in v0.11.0 

func NewReconciler(d ReconcilerDeps) (*Reconciler, error)

NewReconciler builds the Bucket reconciler.

func (*Reconciler) Reconcile added in v0.11.0 

func (r *Reconciler) Reconcile(ctx context.Context, req controller.Request) (controller.Result, error)

Reconcile sets a Bucket Ready while the blob storage probe passes, else Degraded StorageUnreachable, at its generation. It writes only a status that changed and never requeues: the prober enqueues every Bucket when its result flips.

type ReconcilerDeps added in v0.11.0 

type ReconcilerDeps struct {
	Store  store.Store
	Health *health.Prober
	Logger *slog.Logger
}

ReconcilerDeps configures the Bucket reconciler (ADR-0215 Decision 7). Store is required; a nil Health is always Ready.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.