adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix typo

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-31 20:47:55 +00:00
parent b674a12628
commit db69bba627
1 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -76,12 +76,7 @@ values, and provisions the new namespace.
* **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
to restrict ingress/egress traffic. The Jupyter notebook can only communicate
with necessary services, preventing cross-namespace communication.
* **Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
tenant-scoped credentials directly in the target tenant namespace **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
Secret locally in the tenant's namespace.
* **Automated & Isolated S3 Setup:** To avoid exposing admin credentials outside the storage infrastructure, a Kubernetes Job runs inside the minio namespace during tenant provisioning. It connects to the MinIO admin API locally, creates a read-only reference bucket and a read/write work bucket, and generates dedicated, tenant-scoped S3 credentials. The Job then writes those credentials directly into the target tenant namespace as a Secret, so only the scoped credentials (never the MinIO admin credentials) ever leave the minio namespace.
* **Security Context:** The Docker images use the `tini` init system and execute
application containers as a non-root user.
* **Shared MinIO Instance:** A single MinIO deployment backs all tenants rather than one instance per tenant. This was an intentional choice: it keeps operational overhead low and leaves the door open for shared reference datasets across tenants. Isolation is enforced at the credential and bucket-policy level regardless of the sared backend, as demonstrated in section 4.2.