adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix naming minio setup

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-17 12:18:29 +02:00
parent 9ca95ca252
commit 10e623932a
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
charts/tenant/templates/minio-setup.yaml
View File

@ -29,10 +29,10 @@ spec:
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
# Create buckets
mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}
# Create user with generated credentials
mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET"
mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"
# Inline policy generation to avoid missing mount issues
cat <<EOF > /tmp/policy.json
@ -48,8 +48,8 @@ spec:
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::{{ .Values.name }}-ref",
"arn:aws:s3:::{{ .Values.name }}-ref/*"
"arn:aws:s3:::ref-tenant-{{ .Values.name }}",
"arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
]
},
{
@ -59,25 +59,25 @@ spec:
"s3:*"
],
"Resource": [
"arn:aws:s3:::{{ .Values.name }}-work",
"arn:aws:s3:::{{ .Values.name }}-work/*"
"arn:aws:s3:::work-tenant-{{ .Values.name }}",
"arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
]
}
]
}
EOF
# Apply policy and attach to user
mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json
mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user
# Create target secret with matching credentials
kubectl create secret generic {{ .Values.name }}-s3-credentials \
kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
--from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
--from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
-n minio --dry-run=client -o yaml | kubectl apply -f -
# Annotate for Emberstack Reflector
kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \