adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Better script test + renamed AWS env var to MINIO

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-15 16:23:02 +02:00
parent e7b8102733
commit a5b006f728
3 changed files with 41 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
charts/tenant/templates/minio-setup.yaml
View File

@ -32,12 +32,12 @@ spec:
valueFrom:
secretKeyRef:
name: s3-credentials
key: AWS_ACCESS_KEY_ID
key: MINIO_ACCESS_KEY_ID
- name: TENANT_PASS
valueFrom:
secretKeyRef:
name: s3-credentials
key: AWS_SECRET_ACCESS_KEY
key: MINIO_SECRET_ACCESS_KEY
- name: BUCKET_REF
valueFrom:
secretKeyRef:

4
charts/tenant/templates/secret-s3.yaml
View File

@ -8,9 +8,9 @@ metadata:
app.kubernetes.io/tenant: 'tenant-{{ .Values.name }}'
type: Opaque
stringData:
AWS_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
# If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
AWS_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
BUCKET_REF: "ref-tenant-{{ .Values.name }}"
BUCKET_WORK: "work-tenant-{{ .Values.name }}"

37
images/jupyter/test_script.py
View File

@ -0,0 +1,37 @@
import os
import boto3
s3 = boto3.client(
's3',
endpoint_url=os.environ['S3_ENDPOINT'],
aws_access_key_id=os.environ['MINIO_ACCESS_KEY_ID'],
aws_secret_access_key=os.environ['MINIO_SECRET_ACCESS_KEY']
)
ref_bucket = os.environ['BUCKET_REF']
work_bucket = os.environ['BUCKET_WORK']
# 1. READ FROM REFERENCE BUCKET (Should PASS)
response = s3.list_objects_v2(Bucket=ref_bucket)
data = s3.get_object(Bucket=ref_bucket, Key="hello.txt")['Body'].read()
print("SUCCESS: List items in ref bucket:", response['KeyCount'], data.decode())
# 2. WRITE TO REFERENCE BUCKET (Should FAIL with 403 Forbidden)
try:
s3.put_object(Bucket=ref_bucket, Key="test.txt", Body=b"forbidden write")
print("ERROR: Write succeeded when it should be forbidden!")
except Exception as e:
print("SUCCESS: Write to reference bucket blocked:", e)
# 3. WRITE & READ WORK BUCKET (Should PASS)
s3.put_object(Bucket=work_bucket, Key="data.txt", Body=b"hello tenant")
data = s3.get_object(Bucket=work_bucket, Key="data.txt")['Body'].read()
print("SUCCESS: Read back from work bucket:", data.decode())
# 4. ACCESS OTHER TENANT BUCKET (Should FAIL with Access Denied)
try:
s3.list_objects_v2(Bucket="work-tenant-b")
print("ERROR: Accessed tenant-b bucket!")
except Exception as e:
print("SUCCESS: Access to tenant-b blocked:", e)