charts/tenant/templates/minio-setup.yaml

@@ -21,64 +21,20 @@ spec:
           command: ["/bin/sh", "-c"]
           args:
             - |
-              set -e
-
-              # Generate password
-              SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)
-
-              # Configure MinIO alias
               mc alias set local http://minio.minio.svc:9000 \
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
-              # Create buckets
               mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
-
-              # Create user with generated credentials
-              mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET"
-
-              # Inline policy generation to avoid missing mount issues
-              cat <<EOF > /tmp/policy.json
-              {
-                "Version": "2012-10-17",
-                "Statement": [
-                  {
-                    "Sid": "ReadOnlyRefBucket",
-                    "Effect": "Allow",
-                    "Action": [
-                      "s3:GetBucketLocation",
-                      "s3:ListBucket",
-                      "s3:GetObject"
-                    ],
-                    "Resource": [
-                      "arn:aws:s3:::{{ .Values.name }}-ref",
-                      "arn:aws:s3:::{{ .Values.name }}-ref/*"
-                    ]
-                  },
-                  {
-                    "Sid": "ReadWriteWorkBucket",
-                    "Effect": "Allow",
-                    "Action": [
-                      "s3:*"
-                    ],
-                    "Resource": [
-                      "arn:aws:s3:::{{ .Values.name }}-work",
-                      "arn:aws:s3:::{{ .Values.name }}-work/*"
-                    ]
-                  }
-                ]
-              }
-              EOF
-              # Apply policy and attach to user
-              mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json
+              mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
+              mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
               mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
 
-              # Create target secret with matching credentials
+              # write the SCOPED secret in this same namespace
               kubectl create secret generic {{ .Values.name }}-s3-credentials \
                 --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
                 --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
                 -n minio --dry-run=client -o yaml | kubectl apply -f -
 
-              # Annotate for Emberstack Reflector
               kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
                 reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                 reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \

images/minio-setup-runner/dockerfile

@@ -1,6 +1,6 @@
 FROM alpine:3.20
 
-RUN apk add --no-cache curl bash openssl \
+RUN apk add --no-cache curl bash \
     && curl -fsSL -o /usr/local/bin/mc https://dl.min.io/client/mc/release/linux-amd64/mc \
     && chmod +x /usr/local/bin/mc \
     && curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \