Moved back test bucket in image

.gitea/workflows/docker-build.yml

@@ -0,0 +1,78 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    tags:
+      - '*.*.*'
+
+env:
+  REGISTRY: registry.bouvais.lu
+  BASE_IMAGE_NAME: tenant/base
+  JUPYTER_IMAGE_NAME: tenant/jupyter
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        run: |
+          docker login ${{ env.REGISTRY }} \
+            --username adrien \
+            --password "${{ secrets.DOCKER_PASSWORD }}"
+
+      # --- 1. BUILD & TEST BASE IMAGE ---
+      - name: Build Base image
+        run: |
+          docker build \
+            -f ./images/base/dockerfile \
+            -t ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            ./images/base
+
+      - name: Test Base image
+        run: |
+          cid=$(docker create -u root -w /tests ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} sleep 60)
+          docker start "$cid"
+          docker cp ${{ github.workspace }}/tests/. "$cid":/tests
+          docker exec "$cid" python3 /tests/base.py
+          docker rm -f "$cid"
+
+      - name: Tag Base image as latest
+        run: |
+          docker tag ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest
+
+      - name: Push Base image
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }}
+          docker push ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest
+
+      # --- 2. BUILD & TEST JUPYTER IMAGE ---
+      - name: Build Jupyter image
+        run: |
+          docker build \
+            -f ./images/jupyter/dockerfile \
+            --build-arg BASE_IMAGE=${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            -t ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} \
+            ./images/jupyter
+
+      - name: Test Jupyter dependencies
+        run: |
+          cid=$(docker create -w /tests ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} sleep 60)
+          docker start "$cid"
+          docker cp ${{ github.workspace }}/tests/. "$cid":/tests
+          docker exec "$cid" python3 /tests/dependencies.py
+          docker rm -f "$cid"
+
+      - name: Tag Jupyter image as latest
+        run: |
+          docker tag ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} \
+            ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:latest
+
+      - name: Push Jupyter image
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }}
+          docker push ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:latest

charts/tenant/templates/deployment.yaml

@@ -6,6 +6,8 @@ metadata:
   labels:
     app: jupyter
     tenant: 'tenant-{{.Values.name}}'
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
   selector:

charts/tenant/templates/minio-setup.yaml

@@ -32,12 +32,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: s3-credentials
-                  key: AWS_ACCESS_KEY_ID
+                  key: MINIO_ACCESS_KEY_ID
             - name: TENANT_PASS
               valueFrom:
                 secretKeyRef:
                   name: s3-credentials
-                  key: AWS_SECRET_ACCESS_KEY
+                  key: MINIO_SECRET_ACCESS_KEY
             - name: BUCKET_REF
               valueFrom:
                 secretKeyRef:
@@ -52,15 +52,20 @@ spec:
             - /bin/sh
             - -c
             - |
-              # Connect to MinIO using admin secret from env
+              # Fail immediately if any command fails
-              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 $MINIO_ADMIN_USER $MINIO_ADMIN_PASS
+              set -e 
+
+              # Connect to MinIO using quotes to protect special characters in passwords
+              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 "$MINIO_ADMIN_USER" "$MINIO_ADMIN_PASS"
 
               # Create buckets
               mc mb --ignore-existing minioadmin/$BUCKET_REF
               mc mb --ignore-existing minioadmin/$BUCKET_WORK
 
-              # Create tenant user using randomly generated password
+              echo "hello tenant-{{ .Values.name }}" | mc pipe minioadmin/$BUCKET_REF/hello.txt
-              mc admin user add minioadmin $TENANT_USER $TENANT_PASS || true
+
+              # Create tenant user (REMOVED || true)
+              mc admin user add minioadmin "$TENANT_USER" "$TENANT_PASS"
 
               # Apply IAM isolation policy
               cat <<EOF > /tmp/policy.json
@@ -89,6 +94,7 @@ spec:
               }
               EOF
 
-              mc admin policy create minioadmin {{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin {{ .Values.name }}-policy /tmp/policy.json
+              mc admin policy create minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json
-              mc admin policy attach minioadmin {{ .Values.name }}-policy --user=$TENANT_USER
+              # Good enough for now, would need better error handeling
-              echo "MinIO setup completed for {{ .Values.name }}"
+              mc admin policy attach minioadmin tenant-{{ .Values.name }}-policy --user="$TENANT_USER" || echo "Policy already attached, skipping."
+              echo "MinIO setup completed for tenant-{{ .Values.name }}"

charts/tenant/templates/secret-s3.yaml

@@ -1,3 +1,4 @@
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace "s3-credentials" -}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -7,9 +8,9 @@ metadata:
     app.kubernetes.io/tenant: 'tenant-{{ .Values.name }}'
 type: Opaque
 stringData:
-  AWS_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
+  MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
   # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
-  AWS_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
   S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
   BUCKET_REF: "ref-tenant-{{ .Values.name }}"
   BUCKET_WORK: "work-tenant-{{ .Values.name }}"

gitops/tenants/appset.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: argocd
 spec:
   goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
   generators:
     - git:
         repoURL: https://git.bouvais.lu/adrien/ctie-exercice
@@ -13,7 +14,7 @@ spec:
           - path: "tenants/*/config.yaml"
   template:
     metadata:
-      name: 'tenant-{{.name}}'
+      name: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
     spec:
       project: tenants
       sources:
@@ -22,13 +23,16 @@ spec:
           path: charts/tenant
           helm:
             valueFiles:
-              - '$values/tenants/tenant-{{.name}}/config.yaml'
+              - '$values/{{.path.path}}/config.yaml'
+            parameters:
+              - name: name
+                value: '{{ trimPrefix "tenant-" .path.basename }}'
         - repoURL: https://git.bouvais.lu/adrien/ctie-exercice
           targetRevision: main
           ref: values
       destination:
         server: https://kubernetes.default.svc
-        namespace: 'tenant-{{.name}}'
+        namespace: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
       syncPolicy:
         automated:
           prune: true

gitops/tenants/project.yaml

@@ -9,7 +9,11 @@ spec:
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
-  clusterResourceWhitelist: []   # tenants can't touch cluster-scoped resources
+
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

images/base/dockerfile

@@ -1,17 +1,11 @@
 FROM python:3.12-slim-bookworm AS base
 
-LABEL org.opencontainers.image.title="tenant-base" \
-      org.opencontainers.image.description="Hardened base image for tenant workspaces" \
-      org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
-
-# System deps only — keep this layer stable so it's rarely rebuilt
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
         tini \
     && rm -rf /var/lib/apt/lists/*
 
-# Non-root user, fixed UID/GID for predictable K8s securityContext
 RUN groupadd --gid 1000 appuser \
     && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
 
@@ -19,4 +13,3 @@ WORKDIR /home/appuser
 USER appuser
 
 ENTRYPOINT ["tini", "--"]
-

images/jupyter/dockerfile

@@ -1,16 +1,12 @@
-ARG BASE_IMAGE=registry.bouvais.lu/tenant-base:1.0.0
+ARG BASE_IMAGE
 FROM ${BASE_IMAGE}
 
-LABEL org.opencontainers.image.title="tenant-jupyter" \
-      org.opencontainers.image.description="JupyterLab image built on tenant-base" \
-      org.opencontainers.image.base.name="${BASE_IMAGE}"
-
 USER root
+COPY --chown=appuser:appuser test_buckets.py /home/appuser/work/test_buckets.py
 COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
 RUN pip install --no-cache-dir -r /tmp/requirements.txt \
     && rm /tmp/requirements.txt
 
-# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
 USER appuser
 WORKDIR /home/appuser/work
 

images/jupyter/test_buckets.py

@@ -0,0 +1,37 @@
+import os
+import boto3
+
+s3 = boto3.client(
+    's3',
+    endpoint_url=os.environ['S3_ENDPOINT'],
+    aws_access_key_id=os.environ['MINIO_ACCESS_KEY_ID'],
+    aws_secret_access_key=os.environ['MINIO_SECRET_ACCESS_KEY']
+)
+
+ref_bucket = os.environ['BUCKET_REF']
+work_bucket = os.environ['BUCKET_WORK']
+
+# 1. READ FROM REFERENCE BUCKET (Should PASS)
+response = s3.list_objects_v2(Bucket=ref_bucket)
+data = s3.get_object(Bucket=ref_bucket, Key="hello.txt")['Body'].read()
+print("SUCCESS: List items in ref bucket:", response['KeyCount'], data.decode())
+
+# 2. WRITE TO REFERENCE BUCKET (Should FAIL with 403 Forbidden)
+try:
+    s3.put_object(Bucket=ref_bucket, Key="test.txt", Body=b"forbidden write")
+    print("ERROR: Write succeeded when it should be forbidden!")
+except Exception as e:
+    print("SUCCESS: Write to reference bucket blocked:", e)
+
+# 3. WRITE & READ WORK BUCKET (Should PASS)
+s3.put_object(Bucket=work_bucket, Key="data.txt", Body=b"hello tenant")
+data = s3.get_object(Bucket=work_bucket, Key="data.txt")['Body'].read()
+print("SUCCESS: Read back from work bucket:", data.decode())
+
+# 4. ACCESS OTHER TENANT BUCKET (Should FAIL with Access Denied)
+try:
+    s3.list_objects_v2(Bucket="work-tenant-b")
+    print("ERROR: Accessed tenant-b bucket!")
+except Exception as e:
+    print("SUCCESS: Access to tenant-b blocked:", e)
+

tenants/tenant-a/config.yaml

@@ -1,8 +1,6 @@
-name: "a" # TODO: Remove this and use path instead
-
 image:
-  repository: registry.bouvais.lu/tenant-jupyter
+  repository: registry.bouvais.lu/tenant/jupyter
-  tag: "1.0.0"
+  tag: "1.0.1"
 
 resources:
   requests:
@@ -12,8 +10,3 @@ resources:
     cpu: "1"
     memory: 2Gi
 
-gpu:
-  enabled: true
-  type: "t4"          # one of: none | t4 | a100 | l4
-  count: 1
-

tenants/tenant-b/config.yaml

@@ -0,0 +1,11 @@
+image:
+  repository: registry.bouvais.lu/tenant/jupyter
+  tag: "1.0.1"
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 2Gi

tests/base.py

@@ -0,0 +1 @@
+print("SUCCESS: Python works.")

tests/dependencies.py

@@ -0,0 +1,3 @@
+import os
+import boto3
+print("SUCCESS: Import works.")