adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix naming minio setup

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-17 12:18:29 +02:00
parent 9ca95ca252
commit 10e623932a
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
charts/tenant/templates/minio-setup.yaml
View File

@ -29,10 +29,10 @@ spec:
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
# Create buckets # Create buckets
mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}
# Create user with generated credentials # Create user with generated credentials
mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET" mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"
# Inline policy generation to avoid missing mount issues # Inline policy generation to avoid missing mount issues
cat <<EOF > /tmp/policy.json cat <<EOF > /tmp/policy.json
@ -48,8 +48,8 @@ spec:
"s3:GetObject" "s3:GetObject"
], ],
"Resource": [ "Resource": [
"arn:aws:s3:::{{ .Values.name }}-ref", "arn:aws:s3:::ref-tenant-{{ .Values.name }}",
"arn:aws:s3:::{{ .Values.name }}-ref/*" "arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
] ]
}, },
{ {
@ -59,25 +59,25 @@ spec:
"s3:*" "s3:*"
], ],
"Resource": [ "Resource": [
"arn:aws:s3:::{{ .Values.name }}-work", "arn:aws:s3:::work-tenant-{{ .Values.name }}",
"arn:aws:s3:::{{ .Values.name }}-work/*" "arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
] ]
} }
] ]
} }
EOF EOF
# Apply policy and attach to user # Apply policy and attach to user
mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user
# Create target secret with matching credentials # Create target secret with matching credentials
kubectl create secret generic {{ .Values.name }}-s3-credentials \ kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
--from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \ --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
--from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \ --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
-n minio --dry-run=client -o yaml | kubectl apply -f - -n minio --dry-run=client -o yaml | kubectl apply -f -
# Annotate for Emberstack Reflector # Annotate for Emberstack Reflector
kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \ kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \ reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \ reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \ reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \