From 4cae7b809381d535adc7f3eeb98aa5690cd6e306 Mon Sep 17 00:00:00 2001 From: Adrien Bouvais Date: Mon, 31 Aug 2026 13:57:51 +0000 Subject: [PATCH] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5ea139c..721e822 100644 --- a/README.md +++ b/README.md @@ -75,12 +75,12 @@ values, and provisions the new namespace. * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace to restrict ingress/egress traffic. The Jupyter notebook can only communicate with necessary services (like MinIO) and the internet, preventing cross-namespace communication. -**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage +* **Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning. This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only tenant-scoped credentials directly in the target tenant namespace. -**dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes +* **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes Secret locally in the tenant's namespace. * **Security Context:** The Docker images use the `tini` init system and execute application containers as a non-root user.