RD-6129 Initialize fileserver based on MinIO (#3882)

.gitignore

@@ -70,3 +70,5 @@ config.yaml
 
 # Environment files
 .env
+
+fileserver/minio/data

docker-compose.yml

@@ -89,6 +89,18 @@ services:
       - cloudify
     restart: unless-stopped
 
+  fileserver:
+    container_name: fileserver
+    build: fileserver
+    volumes:
+      - ./fileserver/minio/data:/data
+    ports:
+      - "9000:9000"
+      - "9090:9090"
+    networks:
+      - cloudify
+    restart: unless-stopped
+
   config:
     container_name: config
     build:

fileserver/Dockerfile

@@ -0,0 +1,6 @@
+FROM minio/minio
+
+ENV MINIO_ROOT_USER=admin
+ENV MINIO_ROOT_PASSWORD=admin123
+
+CMD ["minio", "server", "/data", "--console-address", ":9090"]

nginx/Dockerfile

@@ -3,6 +3,7 @@ FROM nginx
 ENV WORKER_PROCESS=auto
 ENV WORKER_CONNECTIONS=4096
 ENV REST_SERVICE_PORT=8100
+ENV FILESERVER_PORT=9000
 
 WORKDIR /opt
 

nginx/config/conf.d/fileserver.cloudify

@@ -0,0 +1,27 @@
+# The configuration comes from
+# https://min.io/docs/minio/linux/
+#   integrations/setup-nginx-proxy-with-minio.html
+
+location /resources {
+   auth_request /resources-auth;
+
+   proxy_set_header X-Real-IP $remote_addr;
+   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+   proxy_set_header X-Forwarded-Proto $scheme;
+   proxy_set_header Host $http_host;
+
+   proxy_connect_timeout 300;
+   proxy_http_version 1.1;
+   proxy_set_header Connection "";
+   chunked_transfer_encoding off;
+
+   proxy_pass http://fileserver;
+   proxy_set_header Authorization '';
+}
+
+location /resources-auth {
+    internal;
+    proxy_pass http://cloudify-rest/api/v3.1/file-server-auth;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header X-Original-Method $request_method;
+}

nginx/config/templates/rest_upstream.conf.template

@@ -3,6 +3,10 @@ upstream cloudify-rest {
   server rest_service:${REST_SERVICE_PORT};
 }
 
+upstream fileserver {
+  server fileserver:${FILESERVER_PORT};
+}
+
 # REST and UI external server
 server {
   # server listening for external requests
@@ -19,6 +23,9 @@ server {
 
   # Serves the Rest Service (backed by the cloudify-rest upstream).
   include "/etc/nginx/conf.d/rest-location.cloudify";
+
+  # Serves the Fileserver.
+  include "/etc/nginx/conf.d/fileserver.cloudify";
 }
 
 
@@ -61,4 +68,7 @@ server {
 
   # Serves the Rest Service (backed by the cloudify-rest upstream).
   include "/etc/nginx/conf.d/rest-location.cloudify";
+
+  # Serves the Fileserver.
+  include "/etc/nginx/conf.d/fileserver.cloudify";
 }

rest-service/manager_rest/configure_manager.py

@@ -397,7 +397,9 @@ def _wait_for_rabbitmq(address):
         help='Path to a config file containing info needed by this script',
         action='append',
         required=False,
-        default=[os.environ.get('CONFIG_FILE_PATH')],
+        default=[
+            os.environ.get('CONFIG_FILE_PATH'),
+        ],
     )
     parser.add_argument(
         '--db-wait',

rest-service/manager_rest/utils.py

@@ -187,11 +187,13 @@ def tenant_specific_authorization(tenant, resource_name, action='list'):
 def is_administrator(tenant, user=None):
     if user is None:
         user = current_user
-    administrators_roles = \
-        config.instance.authorization_permissions['administrators']
+
     return (
-        user.id == constants.BOOTSTRAP_ADMIN_ID or
-        user.has_role_in(tenant, administrators_roles)
+        user.is_bootstrap_admin or
+        user.has_role_in(
+            tenant,
+            config.instance.authorization_permissions['administrators'],
+        )
     )