From ea28a0dccdeb0738d128acd952e22811adfcdd2f Mon Sep 17 00:00:00 2001 From: Adrien Bouvais Date: Mon, 17 Aug 2026 12:41:22 +0200 Subject: [PATCH] Updated README to reflect minio admin password changes --- README.md | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 22e66c4..5ea139c 100644 --- a/README.md +++ b/README.md @@ -35,17 +35,18 @@ graph TD F1(Jupyter Pod) F2(ServiceAccount) F3(NetworkPolicy) - F4(MinIO Setup Job) end subgraph MinIO [Namespace: minio] M1[(Shared MinIO S3)] + M2(MinIO Setup Job) end end B -.-> D C -.-> D - F4 -->|Creates Buckets & Credentials| M1 + M2 -->|Creates Buckets & Credentials| M1 + M2 -->|Provisions Scoped Secret| F F1 -->|Reads/Writes| M1 ``` @@ -74,9 +75,11 @@ values, and provisions the new namespace. * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace to restrict ingress/egress traffic. The Jupyter notebook can only communicate with necessary services (like MinIO) and the internet, preventing cross-namespace communication. -* **Automated & Isolated S3 Setup:** Instead of sharing credentials, a one-off Kubernetes `Job` -runs during the Helm deployment for each tenant. This job connects to the MinIO admin API, -creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates +**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage +infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning. +This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write), +and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only +tenant-scoped credentials directly in the target tenant namespace. **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes Secret locally in the tenant's namespace. * **Security Context:** The Docker images use the `tini` init system and execute @@ -105,9 +108,10 @@ All infrastructure and application changes must be proposed via Pull Requests. The CI pipelines act as mandatory status checks, ensuring that no code can be merged into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully. * **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords). -* **Secret Injection:** Admin credentials (Docker registry, MinIO admin) are injected into the Argo CD -namespace and propagated to tenant namespaces dynamically matching `tenant-[a-z0-9-]+` -using the `Reflector` Kubernetes addon. +* **Secret Injection:** Docker registry credentials are injected into the argocd namespace and +propagated to tenant namespaces dynamically matching tenant-[a-z0-9-]+ using +the Reflector Kubernetes addon. MinIO admin credentials remain strictly contained +within the minio namespace and are never reflected to tenant environments. --- @@ -195,13 +199,7 @@ kubectl annotate secret registry-credentials -n argocd --overwrite \ kubectl create secret generic minio-admin-credentials \ --from-literal=MINIO_ROOT_USER=admin \ --from-literal=MINIO_ROOT_PASSWORD=password123 \ - -n argocd - -kubectl annotate secret minio-admin-credentials -n argocd --overwrite \ - reflector.v1.k8s.emberstack.com/reflection-allowed="true" \ - reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \ - reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \ - reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+" + -n minio ```