From a5b006f728ef27e1f62a5dae5d2c50c26d2d8e51 Mon Sep 17 00:00:00 2001
From: Adrien Bouvais <adrienbouvais@huiyuns-air.home>
Date: Sat, 15 Aug 2026 16:23:02 +0200
Subject: [PATCH] Better script test + renamed AWS env var to MINIO

---
 charts/tenant/templates/minio-setup.yaml |  4 +--
 charts/tenant/templates/secret-s3.yaml   |  4 +--
 images/jupyter/test_script.py            | 37 ++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/charts/tenant/templates/minio-setup.yaml b/charts/tenant/templates/minio-setup.yaml
index 3a8356b..c025efe 100644
--- a/charts/tenant/templates/minio-setup.yaml
+++ b/charts/tenant/templates/minio-setup.yaml
@@ -32,12 +32,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: s3-credentials
-                  key: AWS_ACCESS_KEY_ID
+                  key: MINIO_ACCESS_KEY_ID
             - name: TENANT_PASS
               valueFrom:
                 secretKeyRef:
                   name: s3-credentials
-                  key: AWS_SECRET_ACCESS_KEY
+                  key: MINIO_SECRET_ACCESS_KEY
             - name: BUCKET_REF
               valueFrom:
                 secretKeyRef:
diff --git a/charts/tenant/templates/secret-s3.yaml b/charts/tenant/templates/secret-s3.yaml
index 530d7fa..a11007b 100644
--- a/charts/tenant/templates/secret-s3.yaml
+++ b/charts/tenant/templates/secret-s3.yaml
@@ -8,9 +8,9 @@ metadata:
     app.kubernetes.io/tenant: 'tenant-{{ .Values.name }}'
 type: Opaque
 stringData:
-  AWS_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
+  MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
   # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
-  AWS_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
   S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
   BUCKET_REF: "ref-tenant-{{ .Values.name }}"
   BUCKET_WORK: "work-tenant-{{ .Values.name }}"
diff --git a/images/jupyter/test_script.py b/images/jupyter/test_script.py
index e69de29..ee436d1 100644
--- a/images/jupyter/test_script.py
+++ b/images/jupyter/test_script.py
@@ -0,0 +1,37 @@
+import os
+import boto3
+
+s3 = boto3.client(
+    's3',
+    endpoint_url=os.environ['S3_ENDPOINT'],
+    aws_access_key_id=os.environ['MINIO_ACCESS_KEY_ID'],
+    aws_secret_access_key=os.environ['MINIO_SECRET_ACCESS_KEY']
+)
+
+ref_bucket = os.environ['BUCKET_REF']
+work_bucket = os.environ['BUCKET_WORK']
+
+# 1. READ FROM REFERENCE BUCKET (Should PASS)
+response = s3.list_objects_v2(Bucket=ref_bucket)
+data = s3.get_object(Bucket=ref_bucket, Key="hello.txt")['Body'].read()
+print("SUCCESS: List items in ref bucket:", response['KeyCount'], data.decode())
+
+# 2. WRITE TO REFERENCE BUCKET (Should FAIL with 403 Forbidden)
+try:
+    s3.put_object(Bucket=ref_bucket, Key="test.txt", Body=b"forbidden write")
+    print("ERROR: Write succeeded when it should be forbidden!")
+except Exception as e:
+    print("SUCCESS: Write to reference bucket blocked:", e)
+
+# 3. WRITE & READ WORK BUCKET (Should PASS)
+s3.put_object(Bucket=work_bucket, Key="data.txt", Body=b"hello tenant")
+data = s3.get_object(Bucket=work_bucket, Key="data.txt")['Body'].read()
+print("SUCCESS: Read back from work bucket:", data.decode())
+
+# 4. ACCESS OTHER TENANT BUCKET (Should FAIL with Access Denied)
+try:
+    s3.list_objects_v2(Bucket="work-tenant-b")
+    print("ERROR: Accessed tenant-b bucket!")
+except Exception as e:
+    print("SUCCESS: Access to tenant-b blocked:", e)
+