IBM Spectrum Scale supports OpenStack Swift and S3 protocols for object data access.
Both of these object storage protocols use keystone service for identity management whereas access for the object users to the object storage projects are controlled by;
- User roles
- Container ACL's
OpenStack Swift ACL's
ACL's in swift are set up by the acl.py middleware.
Based on the roles defined for the user, object users can be administrative users and non-administrative users.
Non-admin users can only perform operations per container based on the container ACL headers;
- X-Container-Read
- X-Container-Write
These container ACL's are used to limit access to objects in swift containers. Read access can be limited to only allow download, or allow download and listing. Write access allows the user to upload new objects to a container.
To learn about steps / examples to create container and importance of roles, refer to this link.
A Keystone administrator can create container and grant read (ACL) permissions using X-Container-Read headers.
To learn about steps / examples to create container with “X-Container-Read” headers, refer to this link.
Below table lists various ACL options that are available to manipulate object read ACL's.
| Permission | Read ACL options |
| Read for all referrers | .r:* |
| Read and list for all referrers and listing | .r:*,.rlistings |
| Read and list for a user in a specific project |
<project_name|project_id>:<user_name|user_id> |
| Read and list for a user in every project | *:<user_name|user_id> |
| Read and list for every user in a project | <project_name|project_id>:<*> |
| Read and list for every user in every project | <*>:<*> |
(Note: Use comma (,) in the header value to separate multiple ACL's.)
A Keystone administrator can create container and grant write (ACL) permissions using X-Container-Write headers.
To learn about steps / examples to create container with “X-Container-Write” headers, refer to this link.
OpenStack Swift3 ACL's.
IBM Spectrum Scale uses Swift3 Middleware for OpenStack Swift, allowing access to IBM Spectrum Scale using the Amazon Simple Storage Service (S3) API.
To learn about steps to configure Swift3 middleware, refer to this link.
The credentials that are used by Amazon S3 and Elastic Compute Cloud (EC2) APIs are different from the credentials that are used by the OpenStack API. As a result of which, end user must generate these special credentials to use them when accessing the IBM Spectrum Scale OpenStack services.
To learn about steps to configure EC2 credentials, refer to this link.
IBM Spectrum Scale supports S3 access control lists (ACL's) on buckets and objects. These S3 ACL's are stored separately from the ACL's set through the Swift API and the ACL's stored in the file system (NFSv4 or POSIX).
To learn about managing OpenStack access control lists using S3 API emulation, refer to this link.
To learn about using S3 API with s3curl, refer to this link.
#IBMSpectrumScale#Softwaredefinedstorage