adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-31 13:57:51 +00:00
parent df08869b8b
commit 4cae7b8093
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -75,12 +75,12 @@ values, and provisions the new namespace.
* **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
to restrict ingress/egress traffic. The Jupyter notebook can only communicate to restrict ingress/egress traffic. The Jupyter notebook can only communicate
with necessary services (like MinIO) and the internet, preventing cross-namespace communication. with necessary services (like MinIO) and the internet, preventing cross-namespace communication.
**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage * **Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning. infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write), This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
tenant-scoped credentials directly in the target tenant namespace. tenant-scoped credentials directly in the target tenant namespace.
**dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes * **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
Secret locally in the tenant's namespace. Secret locally in the tenant's namespace.
* **Security Context:** The Docker images use the `tini` init system and execute * **Security Context:** The Docker images use the `tini` init system and execute
application containers as a non-root user. application containers as a non-root user.