adrien/ctie-exercice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated README to reflect minio admin password changes

Browse Source
This commit is contained in:
Adrien Bouvais 2026-08-17 12:41:22 +02:00
parent f3b3af1feb
commit ea28a0dccd
1 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
README.md
View File

@ -35,17 +35,18 @@ graph TD
F1(Jupyter Pod)
F2(ServiceAccount)
F3(NetworkPolicy)
F4(MinIO Setup Job)
end
subgraph MinIO [Namespace: minio]
M1[(Shared MinIO S3)]
M2(MinIO Setup Job)
end
end
B -.-> D
C -.-> D
F4 -->|Creates Buckets & Credentials| M1
M2 -->|Creates Buckets & Credentials| M1
M2 -->|Provisions Scoped Secret| F
F1 -->|Reads/Writes| M1
```
@ -74,9 +75,11 @@ values, and provisions the new namespace.
* **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
to restrict ingress/egress traffic. The Jupyter notebook can only communicate
with necessary services (like MinIO) and the internet, preventing cross-namespace communication.
* **Automated & Isolated S3 Setup:** Instead of sharing credentials, a one-off Kubernetes `Job`
runs during the Helm deployment for each tenant. This job connects to the MinIO admin API,
creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates
**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
tenant-scoped credentials directly in the target tenant namespace.
**dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
Secret locally in the tenant's namespace.
* **Security Context:** The Docker images use the `tini` init system and execute
@ -105,9 +108,10 @@ All infrastructure and application changes must be proposed via Pull Requests.
The CI pipelines act as mandatory status checks, ensuring that no code can be merged
into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully.
* **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords).
* **Secret Injection:** Admin credentials (Docker registry, MinIO admin) are injected into the Argo CD
namespace and propagated to tenant namespaces dynamically matching `tenant-[a-z0-9-]+`
using the `Reflector` Kubernetes addon.
* **Secret Injection:** Docker registry credentials are injected into the argocd namespace and
propagated to tenant namespaces dynamically matching tenant-[a-z0-9-]+ using
the Reflector Kubernetes addon. MinIO admin credentials remain strictly contained
within the minio namespace and are never reflected to tenant environments.
---
@ -195,13 +199,7 @@ kubectl annotate secret registry-credentials -n argocd --overwrite \
kubectl create secret generic minio-admin-credentials \
--from-literal=MINIO_ROOT_USER=admin \
--from-literal=MINIO_ROOT_PASSWORD=password123 \
-n argocd
kubectl annotate secret minio-admin-credentials -n argocd --overwrite \
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
-n minio
```