From efd8dab852e6d2f96f92fda4a6a8b154a50bcab8 Mon Sep 17 00:00:00 2001 From: Adrien Bouvais Date: Mon, 17 Aug 2026 12:20:29 +0200 Subject: [PATCH] Fix names --- charts/tenant/templates/minio-setup.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/charts/tenant/templates/minio-setup.yaml b/charts/tenant/templates/minio-setup.yaml index 224c10f..165d5c5 100644 --- a/charts/tenant/templates/minio-setup.yaml +++ b/charts/tenant/templates/minio-setup.yaml @@ -31,10 +31,10 @@ spec: "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" # Create buckets - mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work + mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }} # Create user with generated credentials - mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET" + mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET" # Inline policy generation to avoid missing mount issues cat < /tmp/policy.json @@ -50,8 +50,8 @@ spec: "s3:GetObject" ], "Resource": [ - "arn:aws:s3:::{{ .Values.name }}-ref", - "arn:aws:s3:::{{ .Values.name }}-ref/*" + "arn:aws:s3:::ref-tenant-{{ .Values.name }}", + "arn:aws:s3:::ref-tenant-{{ .Values.name }}/*" ] }, { @@ -61,25 +61,25 @@ spec: "s3:*" ], "Resource": [ - "arn:aws:s3:::{{ .Values.name }}-work", - "arn:aws:s3:::{{ .Values.name }}-work/*" + "arn:aws:s3:::work-tenant-{{ .Values.name }}", + "arn:aws:s3:::work-tenant-{{ .Values.name }}/*" ] } ] } EOF # Apply policy and attach to user - mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json - mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user + mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json + mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user # Create target secret with matching credentials - kubectl create secret generic {{ .Values.name }}-s3-credentials \ + kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \ --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \ --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \ -n minio --dry-run=client -o yaml | kubectl apply -f - # Annotate for Emberstack Reflector - kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \ + kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \ reflector.v1.k8s.emberstack.com/reflection-allowed="true" \ reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \ reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \