From b674a12628d93b8a6fa7835a76fa7e69c9cef175 Mon Sep 17 00:00:00 2001 From: Adrien Bouvais Date: Mon, 31 Aug 2026 20:43:38 +0000 Subject: [PATCH] Added some precision on in doc on some arch decision --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 527133f..4564d52 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,7 @@ new folder named `tenant-*` with a `config.yaml` file inside `tenants/`. path `tenants/*/config.yaml`. Upon detecting a new folder, it automatically generates an Argo CD `Application`, pulls the Helm chart, injects the specific values, and provisions the new namespace. +* **Version Promotion:** Image builds and pushes happen automatically on every tag push, but promoting a tenant to a new version is a deliberate action: it requires updating the image tag value in that tenant's config.yaml and merging a PR. This keeps each tenant's rollout independent and auditable, rather than pushing every tenant to the newest image the moment it's built. ### 2.2 Kubernetes & S3 Isolation @@ -79,11 +80,11 @@ with necessary services, preventing cross-namespace communication. infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning. This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only -tenant-scoped credentials directly in the target tenant namespace. -* **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes +tenant-scoped credentials directly in the target tenant namespace **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes Secret locally in the tenant's namespace. * **Security Context:** The Docker images use the `tini` init system and execute application containers as a non-root user. +* **Shared MinIO Instance:** A single MinIO deployment backs all tenants rather than one instance per tenant. This was an intentional choice: it keeps operational overhead low and leaves the door open for shared reference datasets across tenants. Isolation is enforced at the credential and bucket-policy level regardless of the sared backend, as demonstrated in section 4.2. ### 2.3 Container Images & Dependencies