https://lakefs.io/ logo
Join Slack
Powered by
Hi All, I am trying to give permission to one of o...
# help
n
Hi All, I am trying to give permission to one of our developer to set the GC rules, but they are getting the below error 
request failed: [401 Unauthorized] insufficient permissions
They have these two policies attached
Copy code
RepoManagementFullAccess
FSFullAccess
Any help, what else, we need to provide them permissions.
y
Hey @Nagarajan SG! These policies should be enough to set the GC rules. We may have had a bug in generating these policies. Let me check
n
Hi @Yoni Augarten Thanks for your quick response
y
@Nagarajan SG, do you have 
lakectl
configured?
n
No, how do I configure?
y
It's ok, we can use the UI for now.
n
fine, even I would like to configure, if you have any doc, please share, let me setup in sometimes
y
Can you please go to the Administration page > Policies > RepoManagementFullAccess?
n
Ok
y
Then click Edit, and paste here the json that appears
n
Copy code
{
  "statement": [
    {
      "action": [
        "ci:*"
      ],
      "effect": "allow",
      "resource": "*"
    }
  ]
}
y
Thanks
It seems like we had a bug when adding the retention policies.
Can you please change the JSON to the following:
Copy code
{
  "statement": [
    {
      "action": [
        "ci:*",
        "retention:*",
        "fs:ReadConfig"
      ],
      "effect": "allow",
      "resource": "*"
    }
  ]
}
Afterwards, try setting the rules again
n
Getting error while saving 
retention:*: invalid service name
y
Let me check
n
Ok
y
Can you please tell me which version of lakeFS you're using?
n
Just a min, let me check and share
👍🏻 1
lakefs version 0.44.0
y
I'm sorry for the trouble @Nagarajan SG, I'm afraid that this version did have a bug where the retention policies could not be added. If it's possible for you to upgrade to the latest version, let's do that. Otherwise, I will try to come up with a workaround.
n
I can do the upgrade, but I need to check how can I do that
y
I can help with that if you want
n
But, if you share the workaround for now, it will be great !!!
y
I'm afraid the workaround will include running a query on the postgres database. Is that something you have access to?
n
Yes, I have access to the database
And regarding upgrade, is there any downtime and do we need to update to our developer prior to the upgrade ?
y
The upgrade should take a few seconds.
This will be transparent to developers.
Regarding the workaround, let me just describe the bug so that you understand what we're doing: in this version, we forgot to include "retention" as a valid service name. For that reason, you can't use the API (or the UI) to add retention permissions. We will use a database query to add it manually.
You need to run the following query on the lakeFS schema:
Copy code
BEGIN;

UPDATE auth_policies
SET statement = statement || '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb
WHERE display_name = 'RepoManagementReadAll' AND NOT statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;

UPDATE auth_policies
SET statement = statement || '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb
WHERE display_name = 'RepoManagementFullAccess' AND NOT statement @> '[{"Action": ["fs:ReadConfig"], "Effect": "allow", "Resource": "*"}]'::jsonb;

UPDATE auth_policies
SET statement = statement || '[{"Action": ["retention:Get*"], "Effect": "allow", "Resource": "*"}]'::jsonb
WHERE display_name = 'RepoManagementReadAll' AND NOT statement @> '[{"Action": ["retention:Get*"], "Effect": "allow", "Resource": "*"}]'::jsonb;

UPDATE auth_policies
SET statement = statement || '[{"Action": ["retention:*"], "Effect": "allow", "Resource": "*"}]'::jsonb
WHERE display_name = 'RepoManagementFullAccess' AND NOT statement @> '[{"Action": ["retention:*"], "Effect": "allow", "Resource": "*"}]'::jsonb;

COMMIT;
n
Thanks, before executing this, just I wanted to know the process for upgrade
Because if it takes only few seconds, then I can opt upgrade instead of executing this query on the db 🙂
y
Are you running lakeFS on k8s?
If you used Helm to install it on k8s, then the upgrade should be very simple.
n
No, I am running it on ec2 instance
y
Ok, I can guide you through the upgrade, we can do this in private so we don't bother everyone here
n
Now its working fine after upgrading the lakefs version to the latest, thanks @Yoni Augarten
😀 1
y
Thanks for the update, we're here if you need anything else
👍 1
4 Views
Open in Slack
PreviousNext
Powered by