From 0951d32975b5141d039cfaee6d5e51ab189151f2 Mon Sep 17 00:00:00 2001
From: Adrien Bouvais <adrienbouvais@huiyuns-air.home>
Date: Sat, 15 Aug 2026 09:24:10 +0200
Subject: [PATCH] Added secrets

- A main admin password
- A random password for each SA per tenant
---
 charts/tenant/templates/deployment.yaml  |  3 +
 charts/tenant/templates/minio-setup.yaml | 94 ++++++++++++++++++++++++
 charts/tenant/templates/secret-s3.yaml   | 15 ++++
 minio/manifests.yaml                     | 10 ++-
 4 files changed, 120 insertions(+), 2 deletions(-)
 create mode 100644 charts/tenant/templates/minio-setup.yaml
 create mode 100644 charts/tenant/templates/secret-s3.yaml

diff --git a/charts/tenant/templates/deployment.yaml b/charts/tenant/templates/deployment.yaml
index 7883288..5e1be26 100644
--- a/charts/tenant/templates/deployment.yaml
+++ b/charts/tenant/templates/deployment.yaml
@@ -25,6 +25,9 @@ spec:
         - name: jupyter
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: s3-credentials
           resources:
             requests:
               cpu: {{ .Values.resources.requests.cpu }}
diff --git a/charts/tenant/templates/minio-setup.yaml b/charts/tenant/templates/minio-setup.yaml
new file mode 100644
index 0000000..eb2b669
--- /dev/null
+++ b/charts/tenant/templates/minio-setup.yaml
@@ -0,0 +1,94 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: 'tenant-{{ .Values.name }}-minio-setup'
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: mc
+          image: minio/mc:RELEASE.2024-03-03T00-13-08Z
+          env:
+            # 1. MinIO Admin Credentials (Replicated from argocd namespace)
+            - name: MINIO_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ADMIN_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_PASSWORD
+
+            # 2. Randomly Generated Tenant Credentials
+            - name: TENANT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: AWS_ACCESS_KEY_ID
+            - name: TENANT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: BUCKET_REF
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_REF
+            - name: BUCKET_WORK
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_WORK
+          command:
+            - /bin/sh
+            - -c
+            - |
+              # Connect to MinIO using admin secret from env
+              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 $MINIO_ADMIN_USER $MINIO_ADMIN_PASS
+
+              # Create buckets
+              mc mb --ignore-existing minioadmin/$BUCKET_REF
+              mc mb --ignore-existing minioadmin/$BUCKET_WORK
+
+              # Create tenant user using randomly generated password
+              mc admin user add minioadmin $TENANT_USER $TENANT_PASS || true
+
+              # Apply IAM isolation policy
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
+                    "Resource": [
+                      "arn:aws:s3:::$BUCKET_REF",
+                      "arn:aws:s3:::$BUCKET_WORK"
+                    ]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetObject"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:*"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
+                  }
+                ]
+              }
+              EOF
+
+              mc admin policy create minioadmin {{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin {{ .Values.name }}-policy /tmp/policy.json
+              mc admin policy attach minioadmin {{ .Values.name }}-policy --user=$TENANT_USER
+              echo "MinIO setup completed for {{ .Values.name }}"
diff --git a/charts/tenant/templates/secret-s3.yaml b/charts/tenant/templates/secret-s3.yaml
new file mode 100644
index 0000000..a5ce876
--- /dev/null
+++ b/charts/tenant/templates/secret-s3.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/tenant: 'tenant-{{ .Values.name }}'
+type: Opaque
+stringData:
+  AWS_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
+  # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
+  AWS_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
+  BUCKET_REF: "ref-tenant-{{ .Values.name }}"
+  BUCKET_WORK: "work-tenant-{{ .Values.name }}"
diff --git a/minio/manifests.yaml b/minio/manifests.yaml
index 6435a4d..638976c 100644
--- a/minio/manifests.yaml
+++ b/minio/manifests.yaml
@@ -17,9 +17,15 @@ spec:
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - name: MINIO_ROOT_USER
-              value: "admin"
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_USER
             - name: MINIO_ROOT_PASSWORD
-              value: "changeme123" # TODO: Remove
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_PASSWORD
           ports:
             - containerPort: 9000
             - containerPort: 9001