[pbs-devel] [RFC proxmox-backup 13/39] api: datastore: check S3 backend bucket access on datastore create

[Christian Ebner]

Check if the configured S3 object store backend can be reached and
the provided secrets have the permissions to access the bucket.

Perform the check before creating the chunk store, so it is not left
behind if the bucket cannot be reached.

Signed-off-by: Christian Ebner <c.ebner at proxmox.com>
---
 src/api2/config/datastore.rs | 41 ++++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs
index b133be707..19b08b7e4 100644
--- a/src/api2/config/datastore.rs
+++ b/src/api2/config/datastore.rs
@@ -3,6 +3,7 @@ use std::path::{Path, PathBuf};
 use ::serde::{Deserialize, Serialize};
 use anyhow::{bail, Context, Error};
 use hex::FromHex;
+use pbs_s3_client::{S3Client, S3ClientOptions};
 use serde_json::Value;
 use tracing::{info, warn};
 
@@ -12,10 +13,10 @@ use proxmox_section_config::SectionConfigData;
 use proxmox_uuid::Uuid;
 
 use pbs_api_types::{
-    Authid, DataStoreConfig, DataStoreConfigUpdater, DatastoreNotify, DatastoreTuning, KeepOptions,
-    MaintenanceMode, PruneJobConfig, PruneJobOptions, DATASTORE_SCHEMA, PRIV_DATASTORE_ALLOCATE,
-    PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_MODIFY, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA,
-    UPID_SCHEMA,
+    Authid, DataStoreConfig, DataStoreConfigUpdater, DatastoreBackendConfig, DatastoreNotify,
+    DatastoreTuning, KeepOptions, MaintenanceMode, PruneJobConfig, PruneJobOptions, S3ClientConfig,
+    S3ClientSecretsConfig, DATASTORE_SCHEMA, PRIV_DATASTORE_ALLOCATE, PRIV_DATASTORE_AUDIT,
+    PRIV_DATASTORE_MODIFY, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA, UPID_SCHEMA,
 };
 use pbs_config::BackupLockGuard;
 use pbs_datastore::chunk_store::ChunkStore;
@@ -116,6 +117,38 @@ pub(crate) fn do_create_datastore(
             .parse_property_string(datastore.tuning.as_deref().unwrap_or(""))?,
     )?;
 
+    if let Some(ref backend_config) = datastore.backend {
+        let backend_config: DatastoreBackendConfig = backend_config.parse()?;
+        match backend_config {
+            DatastoreBackendConfig::Filesystem => (),
+            DatastoreBackendConfig::S3(ref s3_client_id) => {
+                let (config, _config_digest) =
+                    pbs_config::s3::config().context("failed to get s3 config")?;
+                let (secrets, _secrets_digest) =
+                    pbs_config::s3::secrets_config().context("failed to get s3 secrets")?;
+                let config: S3ClientConfig = config
+                    .lookup("s3client", s3_client_id)
+                    .with_context(|| format!("no '{s3_client_id}' in config"))?;
+                let secrets: S3ClientSecretsConfig = secrets
+                    .lookup("s3secrets", s3_client_id)
+                    .with_context(|| format!("no '{s3_client_id}' in secrets"))?;
+                let options = S3ClientOptions {
+                    host: config.host,
+                    port: config.port,
+                    bucket: config.bucket,
+                    region: config.region.unwrap_or("us-west-1".to_string()),
+                    fingerprint: config.fingerprint,
+                    access_key: config.access_key,
+                    secret_key: secrets.secret_key,
+                };
+                let s3_client = S3Client::new(options).context("failed to create s3 client")?;
+                // Fine to block since this runs in worker task
+                proxmox_async::runtime::block_on(s3_client.head_bucket())
+                    .context("failed to access bucket")?;
+            }
+        }
+    }
+
     let unmount_guard = if datastore.backing_device.is_some() {
         do_mount_device(datastore.clone())?;
         UnmountGuard::new(Some(path.clone()))
-- 
2.39.5