adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated README to reflect minio admin password changes

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-17 12:41:22 +02:00
parent f3b3af1feb
commit ea28a0dccd
1 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
README.md
View File

@ -35,17 +35,18 @@ graph TD
F1(Jupyter Pod) F1(Jupyter Pod)
F2(ServiceAccount) F2(ServiceAccount)
F3(NetworkPolicy) F3(NetworkPolicy)
F4(MinIO Setup Job)
end end
subgraph MinIO [Namespace: minio] subgraph MinIO [Namespace: minio]
M1[(Shared MinIO S3)] M1[(Shared MinIO S3)]
M2(MinIO Setup Job)
end end
end end
B -.-> D B -.-> D
C -.-> D C -.-> D
F4 -->|Creates Buckets & Credentials| M1 M2 -->|Creates Buckets & Credentials| M1
M2 -->|Provisions Scoped Secret| F
F1 -->|Reads/Writes| M1 F1 -->|Reads/Writes| M1
``` ```
@ -74,9 +75,11 @@ values, and provisions the new namespace.
* **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
to restrict ingress/egress traffic. The Jupyter notebook can only communicate to restrict ingress/egress traffic. The Jupyter notebook can only communicate
with necessary services (like MinIO) and the internet, preventing cross-namespace communication. with necessary services (like MinIO) and the internet, preventing cross-namespace communication.
* **Automated & Isolated S3 Setup:** Instead of sharing credentials, a one-off Kubernetes `Job` **Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
runs during the Helm deployment for each tenant. This job connects to the MinIO admin API, infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
tenant-scoped credentials directly in the target tenant namespace.
**dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
Secret locally in the tenant's namespace. Secret locally in the tenant's namespace.
* **Security Context:** The Docker images use the `tini` init system and execute * **Security Context:** The Docker images use the `tini` init system and execute
@ -105,9 +108,10 @@ All infrastructure and application changes must be proposed via Pull Requests.
The CI pipelines act as mandatory status checks, ensuring that no code can be merged The CI pipelines act as mandatory status checks, ensuring that no code can be merged
into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully. into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully.
* **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords). * **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords).
* **Secret Injection:** Admin credentials (Docker registry, MinIO admin) are injected into the Argo CD * **Secret Injection:** Docker registry credentials are injected into the argocd namespace and
namespace and propagated to tenant namespaces dynamically matching `tenant-[a-z0-9-]+` propagated to tenant namespaces dynamically matching tenant-[a-z0-9-]+ using
using the `Reflector` Kubernetes addon. the Reflector Kubernetes addon. MinIO admin credentials remain strictly contained
within the minio namespace and are never reflected to tenant environments.
--- ---
@ -195,13 +199,7 @@ kubectl annotate secret registry-credentials -n argocd --overwrite \
kubectl create secret generic minio-admin-credentials \ kubectl create secret generic minio-admin-credentials \
--from-literal=MINIO_ROOT_USER=admin \ --from-literal=MINIO_ROOT_USER=admin \
--from-literal=MINIO_ROOT_PASSWORD=password123 \ --from-literal=MINIO_ROOT_PASSWORD=password123 \
-n argocd -n minio
kubectl annotate secret minio-admin-credentials -n argocd --overwrite \
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
``` ```