adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added some precision on in doc on some arch decision

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-31 20:43:38 +00:00
parent f67d5f1985
commit b674a12628
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@ -67,6 +67,7 @@ new folder named `tenant-*` with a `config.yaml` file inside `tenants/`.
path `tenants/*/config.yaml`. Upon detecting a new folder, it automatically path `tenants/*/config.yaml`. Upon detecting a new folder, it automatically
generates an Argo CD `Application`, pulls the Helm chart, injects the specific generates an Argo CD `Application`, pulls the Helm chart, injects the specific
values, and provisions the new namespace. values, and provisions the new namespace.
* **Version Promotion:** Image builds and pushes happen automatically on every tag push, but promoting a tenant to a new version is a deliberate action: it requires updating the image tag value in that tenant's config.yaml and merging a PR. This keeps each tenant's rollout independent and auditable, rather than pushing every tenant to the newest image the moment it's built.
### 2.2 Kubernetes & S3 Isolation ### 2.2 Kubernetes & S3 Isolation
@ -79,11 +80,11 @@ with necessary services, preventing cross-namespace communication.
infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning. infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write), This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
tenant-scoped credentials directly in the target tenant namespace. tenant-scoped credentials directly in the target tenant namespace **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
* **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
Secret locally in the tenant's namespace. Secret locally in the tenant's namespace.
* **Security Context:** The Docker images use the `tini` init system and execute * **Security Context:** The Docker images use the `tini` init system and execute
application containers as a non-root user. application containers as a non-root user.
* **Shared MinIO Instance:** A single MinIO deployment backs all tenants rather than one instance per tenant. This was an intentional choice: it keeps operational overhead low and leaves the door open for shared reference datasets across tenants. Isolation is enforced at the credential and bucket-policy level regardless of the sared backend, as demonstrated in section 4.2.
### 2.3 Container Images & Dependencies ### 2.3 Container Images & Dependencies