Added secrets

- A main admin password - A random password for each SA per tenant
2026-08-15 09:24:10 +02:00
parent b4e22f6cee
commit 0951d32975
4 changed files with 120 additions and 2 deletions
@@ -0,0 +1,94 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: 'tenant-{{ .Values.name }}-minio-setup'
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: mc
+          image: minio/mc:RELEASE.2024-03-03T00-13-08Z
+          env:
+            # 1. MinIO Admin Credentials (Replicated from argocd namespace)
+            - name: MINIO_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ADMIN_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_PASSWORD
+
+            # 2. Randomly Generated Tenant Credentials
+            - name: TENANT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: AWS_ACCESS_KEY_ID
+            - name: TENANT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: BUCKET_REF
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_REF
+            - name: BUCKET_WORK
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_WORK
+          command:
+            - /bin/sh
+            - -c
+            - |
+              # Connect to MinIO using admin secret from env
+              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 $MINIO_ADMIN_USER $MINIO_ADMIN_PASS
+
+              # Create buckets
+              mc mb --ignore-existing minioadmin/$BUCKET_REF
+              mc mb --ignore-existing minioadmin/$BUCKET_WORK
+
+              # Create tenant user using randomly generated password
+              mc admin user add minioadmin $TENANT_USER $TENANT_PASS || true
+
+              # Apply IAM isolation policy
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
+                    "Resource": [
+                      "arn:aws:s3:::$BUCKET_REF",
+                      "arn:aws:s3:::$BUCKET_WORK"
+                    ]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetObject"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:*"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
+                  }
+                ]
+              }
+              EOF
+
+              mc admin policy create minioadmin {{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin {{ .Values.name }}-policy /tmp/policy.json
+              mc admin policy attach minioadmin {{ .Values.name }}-policy --user=$TENANT_USER
+              echo "MinIO setup completed for {{ .Values.name }}"