Moved back test bucket in image

- A main admin password
- A random password for each SA per tenant

.gitea/workflows/docker-build.yml

@@ -0,0 +1,78 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    tags:
+      - '*.*.*'
+
+env:
+  REGISTRY: registry.bouvais.lu
+  BASE_IMAGE_NAME: tenant/base
+  JUPYTER_IMAGE_NAME: tenant/jupyter
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        run: |
+          docker login ${{ env.REGISTRY }} \
+            --username adrien \
+            --password "${{ secrets.DOCKER_PASSWORD }}"
+
+      # --- 1. BUILD & TEST BASE IMAGE ---
+      - name: Build Base image
+        run: |
+          docker build \
+            -f ./images/base/dockerfile \
+            -t ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            ./images/base
+
+      - name: Test Base image
+        run: |
+          cid=$(docker create -u root -w /tests ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} sleep 60)
+          docker start "$cid"
+          docker cp ${{ github.workspace }}/tests/. "$cid":/tests
+          docker exec "$cid" python3 /tests/base.py
+          docker rm -f "$cid"
+
+      - name: Tag Base image as latest
+        run: |
+          docker tag ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest
+
+      - name: Push Base image
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }}
+          docker push ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest
+
+      # --- 2. BUILD & TEST JUPYTER IMAGE ---
+      - name: Build Jupyter image
+        run: |
+          docker build \
+            -f ./images/jupyter/dockerfile \
+            --build-arg BASE_IMAGE=${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:${{ github.ref_name }} \
+            -t ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} \
+            ./images/jupyter
+
+      - name: Test Jupyter dependencies
+        run: |
+          cid=$(docker create -w /tests ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} sleep 60)
+          docker start "$cid"
+          docker cp ${{ github.workspace }}/tests/. "$cid":/tests
+          docker exec "$cid" python3 /tests/dependencies.py
+          docker rm -f "$cid"
+
+      - name: Tag Jupyter image as latest
+        run: |
+          docker tag ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }} \
+            ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:latest
+
+      - name: Push Jupyter image
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:${{ github.ref_name }}
+          docker push ${{ env.REGISTRY }}/${{ env.JUPYTER_IMAGE_NAME }}:latest

charts/tenant/templates/deployment.yaml

@@ -6,6 +6,8 @@ metadata:
   labels:
     app: jupyter
     tenant: 'tenant-{{.Values.name}}'
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
   selector:
@@ -25,6 +27,9 @@ spec:
         - name: jupyter
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: s3-credentials
           resources:
             requests:
               cpu: {{ .Values.resources.requests.cpu }}

charts/tenant/templates/minio-setup.yaml

@@ -0,0 +1,100 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: 'tenant-{{ .Values.name }}-minio-setup'
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: mc
+          image: minio/mc:RELEASE.2024-03-03T00-13-08Z
+          env:
+            # 1. MinIO Admin Credentials (Replicated from argocd namespace)
+            - name: MINIO_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ADMIN_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_PASSWORD
+
+            # 2. Randomly Generated Tenant Credentials
+            - name: TENANT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: MINIO_ACCESS_KEY_ID
+            - name: TENANT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: MINIO_SECRET_ACCESS_KEY
+            - name: BUCKET_REF
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_REF
+            - name: BUCKET_WORK
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: BUCKET_WORK
+          command:
+            - /bin/sh
+            - -c
+            - |
+              # Fail immediately if any command fails
+              set -e 
+
+              # Connect to MinIO using quotes to protect special characters in passwords
+              mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 "$MINIO_ADMIN_USER" "$MINIO_ADMIN_PASS"
+
+              # Create buckets
+              mc mb --ignore-existing minioadmin/$BUCKET_REF
+              mc mb --ignore-existing minioadmin/$BUCKET_WORK
+
+              echo "hello tenant-{{ .Values.name }}" | mc pipe minioadmin/$BUCKET_REF/hello.txt
+
+              # Create tenant user (REMOVED || true)
+              mc admin user add minioadmin "$TENANT_USER" "$TENANT_PASS"
+
+              # Apply IAM isolation policy
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
+                    "Resource": [
+                      "arn:aws:s3:::$BUCKET_REF",
+                      "arn:aws:s3:::$BUCKET_WORK"
+                    ]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:GetObject"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
+                  },
+                  {
+                    "Effect": "Allow",
+                    "Action": ["s3:*"],
+                    "Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
+                  }
+                ]
+              }
+              EOF
+
+              mc admin policy create minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json
+              # Good enough for now, would need better error handeling
+              mc admin policy attach minioadmin tenant-{{ .Values.name }}-policy --user="$TENANT_USER" || echo "Policy already attached, skipping."
+              echo "MinIO setup completed for tenant-{{ .Values.name }}"

charts/tenant/templates/secret-s3.yaml

@@ -0,0 +1,16 @@
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace "s3-credentials" -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/tenant: 'tenant-{{ .Values.name }}'
+type: Opaque
+stringData:
+  MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
+  # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
+  BUCKET_REF: "ref-tenant-{{ .Values.name }}"
+  BUCKET_WORK: "work-tenant-{{ .Values.name }}"

gitops/tenants/appset.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: argocd
 spec:
   goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
   generators:
     - git:
         repoURL: https://git.bouvais.lu/adrien/ctie-exercice
@@ -13,7 +14,7 @@ spec:
           - path: "tenants/*/config.yaml"
   template:
     metadata:
-      name: 'tenant-{{.name}}'
+      name: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
     spec:
       project: tenants
       sources:
@@ -22,13 +23,16 @@ spec:
           path: charts/tenant
           helm:
             valueFiles:
-              - '$values/tenants/tenant-{{.name}}/config.yaml'
+              - '$values/{{.path.path}}/config.yaml'
+            parameters:
+              - name: name
+                value: '{{ trimPrefix "tenant-" .path.basename }}'
         - repoURL: https://git.bouvais.lu/adrien/ctie-exercice
           targetRevision: main
           ref: values
       destination:
         server: https://kubernetes.default.svc
-        namespace: 'tenant-{{.name}}'
+        namespace: 'tenant-{{ trimPrefix "tenant-" .path.basename }}'
       syncPolicy:
         automated:
           prune: true

gitops/tenants/project.yaml

@@ -9,7 +9,11 @@ spec:
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
-  clusterResourceWhitelist: []   # tenants can't touch cluster-scoped resources
+
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

images/base/dockerfile

@@ -1,17 +1,11 @@
 FROM python:3.12-slim-bookworm AS base
 
-LABEL org.opencontainers.image.title="tenant-base" \
-      org.opencontainers.image.description="Hardened base image for tenant workspaces" \
-      org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
-
-# System deps only — keep this layer stable so it's rarely rebuilt
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
         tini \
     && rm -rf /var/lib/apt/lists/*
 
-# Non-root user, fixed UID/GID for predictable K8s securityContext
 RUN groupadd --gid 1000 appuser \
     && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
 
@@ -19,4 +13,3 @@ WORKDIR /home/appuser
 USER appuser
 
 ENTRYPOINT ["tini", "--"]
-

images/jupyter/dockerfile

@@ -1,16 +1,12 @@
-ARG BASE_IMAGE=registry.bouvais.lu/tenant-base:1.0.0
+ARG BASE_IMAGE
 FROM ${BASE_IMAGE}
 
-LABEL org.opencontainers.image.title="tenant-jupyter" \
-      org.opencontainers.image.description="JupyterLab image built on tenant-base" \
-      org.opencontainers.image.base.name="${BASE_IMAGE}"
-
 USER root
+COPY --chown=appuser:appuser test_buckets.py /home/appuser/work/test_buckets.py
 COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
 RUN pip install --no-cache-dir -r /tmp/requirements.txt \
     && rm /tmp/requirements.txt
 
-# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
 USER appuser
 WORKDIR /home/appuser/work
 

images/jupyter/test_buckets.py

@@ -0,0 +1,37 @@
+import os
+import boto3
+
+s3 = boto3.client(
+    's3',
+    endpoint_url=os.environ['S3_ENDPOINT'],
+    aws_access_key_id=os.environ['MINIO_ACCESS_KEY_ID'],
+    aws_secret_access_key=os.environ['MINIO_SECRET_ACCESS_KEY']
+)
+
+ref_bucket = os.environ['BUCKET_REF']
+work_bucket = os.environ['BUCKET_WORK']
+
+# 1. READ FROM REFERENCE BUCKET (Should PASS)
+response = s3.list_objects_v2(Bucket=ref_bucket)
+data = s3.get_object(Bucket=ref_bucket, Key="hello.txt")['Body'].read()
+print("SUCCESS: List items in ref bucket:", response['KeyCount'], data.decode())
+
+# 2. WRITE TO REFERENCE BUCKET (Should FAIL with 403 Forbidden)
+try:
+    s3.put_object(Bucket=ref_bucket, Key="test.txt", Body=b"forbidden write")
+    print("ERROR: Write succeeded when it should be forbidden!")
+except Exception as e:
+    print("SUCCESS: Write to reference bucket blocked:", e)
+
+# 3. WRITE & READ WORK BUCKET (Should PASS)
+s3.put_object(Bucket=work_bucket, Key="data.txt", Body=b"hello tenant")
+data = s3.get_object(Bucket=work_bucket, Key="data.txt")['Body'].read()
+print("SUCCESS: Read back from work bucket:", data.decode())
+
+# 4. ACCESS OTHER TENANT BUCKET (Should FAIL with Access Denied)
+try:
+    s3.list_objects_v2(Bucket="work-tenant-b")
+    print("ERROR: Accessed tenant-b bucket!")
+except Exception as e:
+    print("SUCCESS: Access to tenant-b blocked:", e)
+

minio/manifests.yaml

@@ -17,9 +17,15 @@ spec:
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - name: MINIO_ROOT_USER
-              value: "admin"
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_USER
             - name: MINIO_ROOT_PASSWORD
-              value: "changeme123" # TODO: Remove
+              valueFrom:
+                secretKeyRef:
+                  name: minio-admin-credentials
+                  key: MINIO_ROOT_PASSWORD
           ports:
             - containerPort: 9000
             - containerPort: 9001

tenants/tenant-a/config.yaml

@@ -1,8 +1,6 @@
-name: "a"
-
 image:
-  repository: registry.bouvais.lu/tenant-jupyter
-  tag: "1.0.0"
+  repository: registry.bouvais.lu/tenant/jupyter
+  tag: "1.0.1"
 
 resources:
   requests:
@@ -12,8 +10,3 @@ resources:
     cpu: "1"
     memory: 2Gi
 
-gpu:
-  enabled: true
-  type: "t4"          # one of: none | t4 | a100 | l4
-  count: 1
-

tenants/tenant-b/config.yaml

@@ -0,0 +1,11 @@
+image:
+  repository: registry.bouvais.lu/tenant/jupyter
+  tag: "1.0.1"
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 2Gi

tests/base.py

@@ -0,0 +1 @@
+print("SUCCESS: Python works.")

tests/dependencies.py

@@ -0,0 +1,3 @@
+import os
+import boto3
+print("SUCCESS: Import works.")