From 3939d3e541caca321e990417e00ecc87f1a26fb3 Mon Sep 17 00:00:00 2001
From: Adrien Bouvais <adrienbouvais@Huiyuns-Air.fritz.box>
Date: Wed, 16 Sep 2026 20:12:36 +0200
Subject: [PATCH] Changed some comments for presentation

---
 charts/tenant/templates/networkpolicy.yaml | 7 +++----
 charts/tenant/templates/secret-s3.yaml     | 3 ++-
 gitops/tenants/project.yaml                | 4 ++++
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/charts/tenant/templates/networkpolicy.yaml b/charts/tenant/templates/networkpolicy.yaml
index 2c762c0..8a1b4e1 100644
--- a/charts/tenant/templates/networkpolicy.yaml
+++ b/charts/tenant/templates/networkpolicy.yaml
@@ -15,15 +15,14 @@ spec:
     - Ingress
     - Egress
 
-  # Entrée : Autorise le trafic vers le Notebook Jupyter sur le port 8888
+  # Entrée
   ingress:
     - ports:
         - protocol: TCP
           port: 8888
 
-  # Sortie : Restreint les communications aux composants strictement nécessaires
+  # Sortie
   egress:
-    # 1. Résolution DNS dans kube-system
     - to:
         - namespaceSelector:
             matchLabels:
@@ -34,7 +33,7 @@ spec:
         - protocol: TCP
           port: 53
 
-    # 2. Flux vers l'API MinIO (Stockage S3)
+    # 2. Vers MinIO
     - to:
         - namespaceSelector:
             matchLabels:
diff --git a/charts/tenant/templates/secret-s3.yaml b/charts/tenant/templates/secret-s3.yaml
index a11007b..7e0fe17 100644
--- a/charts/tenant/templates/secret-s3.yaml
+++ b/charts/tenant/templates/secret-s3.yaml
@@ -10,7 +10,8 @@ type: Opaque
 stringData:
   MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
   # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
-  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "MINIO_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "MINIO_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
   S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
   BUCKET_REF: "ref-tenant-{{ .Values.name }}"
   BUCKET_WORK: "work-tenant-{{ .Values.name }}"
+
diff --git a/gitops/tenants/project.yaml b/gitops/tenants/project.yaml
index 1bc8d1e..b6d5416 100644
--- a/gitops/tenants/project.yaml
+++ b/gitops/tenants/project.yaml
@@ -4,14 +4,18 @@ metadata:
   name: tenants
   namespace: argocd
 spec:
+  # Ensure only pull from here
   sourceRepos:
     - https://git.bouvais.lu/adrien/ctie-exercice
+
+  # So this namespace can only affect other tenant and minio (not kube-system or argocd)
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
     - server: https://kubernetes.default.svc
       namespace: 'minio'
 
+  # This is necessary to create namespace
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace