Removed tenant in path

README.md

@@ -35,17 +35,18 @@ graph TD
             F1(Jupyter Pod)
             F2(ServiceAccount)
             F3(NetworkPolicy)
-            F4(MinIO Setup Job)
         end
         
         subgraph MinIO [Namespace: minio]
             M1[(Shared MinIO S3)]
+            M2(MinIO Setup Job)
         end
     end
 
     B -.-> D
     C -.-> D
-    F4 -->|Creates Buckets & Credentials| M1
+    M2 -->|Creates Buckets & Credentials| M1
+    M2 -->|Provisions Scoped Secret| F
     F1 -->|Reads/Writes| M1
 
 ```
@@ -74,9 +75,11 @@ values, and provisions the new namespace.
 * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
 to restrict ingress/egress traffic. The Jupyter notebook can only communicate
 with necessary services (like MinIO) and the internet, preventing cross-namespace communication.
-* **Automated & Isolated S3 Setup:** Instead of sharing credentials, a one-off Kubernetes `Job`
+**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
-runs during the Helm deployment for each tenant. This job connects to the MinIO admin API,
+infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
-creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates
+This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
+and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
+tenant-scoped credentials directly in the target tenant namespace.
 **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
 Secret locally in the tenant's namespace.
 * **Security Context:** The Docker images use the `tini` init system and execute
@@ -105,9 +108,10 @@ All infrastructure and application changes must be proposed via Pull Requests.
 The CI pipelines act as mandatory status checks, ensuring that no code can be merged
 into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully.
 * **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords).
-* **Secret Injection:** Admin credentials (Docker registry, MinIO admin) are injected into the Argo CD
+* **Secret Injection:** Docker registry credentials are injected into the argocd namespace and
-namespace and propagated to tenant namespaces dynamically matching `tenant-[a-z0-9-]+`
+propagated to tenant namespaces dynamically matching tenant-[a-z0-9-]+ using
-using the `Reflector` Kubernetes addon.
+the Reflector Kubernetes addon. MinIO admin credentials remain strictly contained
+within the minio namespace and are never reflected to tenant environments.
 
 ---
 
@@ -184,8 +188,8 @@ kubectl create secret docker-registry registry-credentials \
 kubectl annotate secret registry-credentials -n argocd --overwrite \
   reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
   reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
+  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+,minio" \
-  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
+  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+,minio"
 
 ```
 
@@ -195,13 +199,7 @@ kubectl annotate secret registry-credentials -n argocd --overwrite \
 kubectl create secret generic minio-admin-credentials \
   --from-literal=MINIO_ROOT_USER=admin \
   --from-literal=MINIO_ROOT_PASSWORD=password123 \
-  -n argocd
+  -n minio
-
-kubectl annotate secret minio-admin-credentials -n argocd --overwrite \
-  reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
-  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
 
 ```
 

charts/tenant/templates/deployment.yaml

@@ -27,7 +27,7 @@ spec:
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
-                name: s3-credentials
+                name: 'tenant-{{.Values.name}}-s3-credentials'
           resources:
             requests:
               cpu: {{ .Values.resources.requests.cpu }}

charts/tenant/templates/minio-setup.yaml

@@ -31,10 +31,13 @@ spec:
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
               # Create buckets
-              mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
+              mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}
 
               # Create user with generated credentials
-              mc admin user add local {{ .Values.name }}-user "$SCOPED_SECRET"
+              mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"
+
+              # Add demo file
+              echo "hello tenant-{{ .Values.name }}" | mc pipe local/ref-tenant-{{ .Values.name }}/hello.txt
 
               # Inline policy generation to avoid missing mount issues
               cat <<EOF > /tmp/policy.json
@@ -50,8 +53,8 @@ spec:
                       "s3:GetObject"
                     ],
                     "Resource": [
-                      "arn:aws:s3:::{{ .Values.name }}-ref",
+                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}",
-                      "arn:aws:s3:::{{ .Values.name }}-ref/*"
+                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
                     ]
                   },
                   {
@@ -61,25 +64,28 @@ spec:
                       "s3:*"
                     ],
                     "Resource": [
-                      "arn:aws:s3:::{{ .Values.name }}-work",
+                      "arn:aws:s3:::work-tenant-{{ .Values.name }}",
-                      "arn:aws:s3:::{{ .Values.name }}-work/*"
+                      "arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
                     ]
                   }
                 ]
               }
               EOF
               # Apply policy and attach to user
-              mc admin policy create local {{ .Values.name }}-policy /tmp/policy.json
+              mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
-              mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
+              mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user
 
               # Create target secret with matching credentials
-              kubectl create secret generic {{ .Values.name }}-s3-credentials \
+              kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
-                --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
+                --from-literal=S3_ENDPOINT="http://minio.minio.svc.cluster.local:9000" \
-                --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
+                --from-literal=MINIO_ACCESS_KEY_ID=tenant-{{ .Values.name }}-user \
+                --from-literal=MINIO_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
+                --from-literal=BUCKET_REF="ref-tenant-{{ .Values.name }}" \
+                --from-literal=BUCKET_WORK="work-tenant-{{ .Values.name }}" \
                 -n minio --dry-run=client -o yaml | kubectl apply -f -
 
               # Annotate for Emberstack Reflector
-              kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
+              kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
                 reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                 reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
                 reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \

charts/tenant/templates/networkpolicy.yaml

@@ -15,15 +15,14 @@ spec:
     - Ingress
     - Egress
 
-  # Entrée : Autorise le trafic vers le Notebook Jupyter sur le port 8888
+  # Entrée
   ingress:
     - ports:
         - protocol: TCP
           port: 8888
 
-  # Sortie : Restreint les communications aux composants strictement nécessaires
+  # Sortie
   egress:
-    # 1. Résolution DNS dans kube-system
     - to:
         - namespaceSelector:
             matchLabels:
@@ -34,7 +33,7 @@ spec:
         - protocol: TCP
           port: 53
 
-    # 2. Flux vers l'API MinIO (Stockage S3)
+    # 2. Vers MinIO
     - to:
         - namespaceSelector:
             matchLabels:

charts/tenant/templates/secret-s3.yaml

@@ -10,7 +10,8 @@ type: Opaque
 stringData:
   MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
   # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
-  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "MINIO_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "MINIO_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
   S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
   BUCKET_REF: "ref-tenant-{{ .Values.name }}"
   BUCKET_WORK: "work-tenant-{{ .Values.name }}"
+

gitops/bootstrap/root-app.yaml

@@ -8,7 +8,7 @@ spec:
   source:
     repoURL: https://git.bouvais.lu/adrien/ctie-exercice
     targetRevision: main
-    path: gitops/tenants
+    path: gitops
     directory:
       recurse: true
   destination:

gitops/tenants/project.yaml

@@ -4,14 +4,18 @@ metadata:
   name: tenants
   namespace: argocd
 spec:
+  # Ensure only pull from here
   sourceRepos:
     - https://git.bouvais.lu/adrien/ctie-exercice
+
+  # So this namespace can only affect other tenant and minio (not kube-system or argocd)
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
     - server: https://kubernetes.default.svc
       namespace: 'minio'
 
+  # This is necessary to create namespace
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace

minio/manifests.yaml

@@ -43,7 +43,7 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: quay.io/minio/minio:latest
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - name: MINIO_ROOT_USER

tenants/tenant-c/config.yaml

@@ -1,9 +0,0 @@
-version: "1.0.0"
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 512Mi
-  limits:
-    cpu: "1"
-    memory: 2Gi