Speaker
Description
Recently, several collaborations working with our data center have developed computing and data management workflows that require access to S3 storage services with POSIX capabilities.
To accomplish this requirement in distributed environments, where computing and storage resources are located at geographically distant physical sites, the possibility to locally mount a file system from a remote site to directly perform operations on files and directories becomes crucial.
In the context of this activity, we evaluated the possibility to manage data access by integrating JSON Web Token (JWT) authentication, provided by INDIGO-IAM as Identity Provider (IdP), with CEPH RADOS Gateway, the object storage interface for CEPH.
Moreover, Open Policy Agent (OPA) has been integrated to define the policy related to the access to the S3 data exposed by CEPH RADOS Gateway.
As a fundamental part of the integration process, s3fs-fuse has been adopted to provide the needed custom libraries to mount an S3 bucket via FUSE by preserving the native object format for files. The solution supports Secure Token Service (STS), providing a client with temporary credentials to perform a given operation on a storage resource by checking the value of a JWT claim associated with the request.
In the presentation, we will show how this solution can be exploited to cope with the need to access S3 storage services and the integration with POSIX capabilities. We will also discuss the measured performance, comparing them with those obtained from other investigated solutions.
