Removed tenant in path

Reviewed-on: #5

README.md

@@ -35,17 +35,18 @@ graph TD
             F1(Jupyter Pod)
             F2(ServiceAccount)
             F3(NetworkPolicy)
-            F4(MinIO Setup Job)
         end
         
         subgraph MinIO [Namespace: minio]
             M1[(Shared MinIO S3)]
+            M2(MinIO Setup Job)
         end
     end
 
     B -.-> D
     C -.-> D
-    F4 -->|Creates Buckets & Credentials| M1
+    M2 -->|Creates Buckets & Credentials| M1
+    M2 -->|Provisions Scoped Secret| F
     F1 -->|Reads/Writes| M1
 
 ```
@@ -74,9 +75,11 @@ values, and provisions the new namespace.
 * **Network Security:** A `NetworkPolicy` is deployed within each tenant namespace
 to restrict ingress/egress traffic. The Jupyter notebook can only communicate
 with necessary services (like MinIO) and the internet, preventing cross-namespace communication.
-* **Automated & Isolated S3 Setup:** Instead of sharing credentials, a one-off Kubernetes `Job`
-runs during the Helm deployment for each tenant. This job connects to the MinIO admin API,
-creates a reference bucket (Read-Only), a work bucket (Read/Write), and generates
+**Automated & Isolated S3 Setup:** To prevent exposing admin credentials outside the storage
+infrastructure, a Kubernetes Job runs directly within the minio namespace during tenant provisioning.
+This job connects to the MinIO admin API locally, creates a reference bucket (Read-Only), a work bucket (Read/Write),
+and generates dedicated, scoped S3 credentials. It then creates the resulting secret containing only
+tenant-scoped credentials directly in the target tenant namespace.
 **dedicated, scoped S3 credentials**. These credentials are saved as a Kubernetes
 Secret locally in the tenant's namespace.
 * **Security Context:** The Docker images use the `tini` init system and execute
@@ -105,9 +108,10 @@ All infrastructure and application changes must be proposed via Pull Requests.
 The CI pipelines act as mandatory status checks, ensuring that no code can be merged
 into `main` unless the configurations are validated, no secrets are leaked, and all tests pass successfully.
 * **Secret Scanning:** `TruffleHog` runs as a CI step to scan the repository and prevent any accidental commit of sensitive information (AWS keys, passwords).
-* **Secret Injection:** Admin credentials (Docker registry, MinIO admin) are injected into the Argo CD
-namespace and propagated to tenant namespaces dynamically matching `tenant-[a-z0-9-]+`
-using the `Reflector` Kubernetes addon.
+* **Secret Injection:** Docker registry credentials are injected into the argocd namespace and
+propagated to tenant namespaces dynamically matching tenant-[a-z0-9-]+ using
+the Reflector Kubernetes addon. MinIO admin credentials remain strictly contained
+within the minio namespace and are never reflected to tenant environments.
 
 ---
 
@@ -184,8 +188,8 @@ kubectl create secret docker-registry registry-credentials \
 kubectl annotate secret registry-credentials -n argocd --overwrite \
   reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
   reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
-  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
+  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+,minio" \
+  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+,minio"
 
 ```
 
@@ -195,13 +199,7 @@ kubectl annotate secret registry-credentials -n argocd --overwrite \
 kubectl create secret generic minio-admin-credentials \
   --from-literal=MINIO_ROOT_USER=admin \
   --from-literal=MINIO_ROOT_PASSWORD=password123 \
-  -n argocd
-
-kubectl annotate secret minio-admin-credentials -n argocd --overwrite \
-  reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
-  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-[a-z0-9-]+" \
-  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-[a-z0-9-]+"
+  -n minio
 
 ```
 

charts/tenant/templates/deployment.yaml

@@ -27,7 +27,7 @@ spec:
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
-                name: s3-credentials
+                name: 'tenant-{{.Values.name}}-s3-credentials'
           resources:
             requests:
               cpu: {{ .Values.resources.requests.cpu }}

charts/tenant/templates/minio-setup.yaml

@@ -13,27 +13,79 @@ spec:
     spec:
       serviceAccountName: minio-provisioner
       restartPolicy: OnFailure
+      imagePullSecrets:
+        - name: registry-credentials
       containers:
         - name: setup
-          image: minio/mc:latest
+          image: registry.bouvais.lu/minio-runner:1.0.0
           command: ["/bin/sh", "-c"]
           args:
             - |
+              set -e
+
+              # Generate password
+              SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)
+
+              # Configure MinIO alias
               mc alias set local http://minio.minio.svc:9000 \
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
-              mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
-              mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
-              mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
-              mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
+              # Create buckets
+              mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}
 
-              # write the SCOPED secret in this same namespace
-              kubectl create secret generic {{ .Values.name }}-s3-credentials \
-                --from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
-                --from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
+              # Create user with generated credentials
+              mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"
+
+              # Add demo file
+              echo "hello tenant-{{ .Values.name }}" | mc pipe local/ref-tenant-{{ .Values.name }}/hello.txt
+
+              # Inline policy generation to avoid missing mount issues
+              cat <<EOF > /tmp/policy.json
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Sid": "ReadOnlyRefBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:GetBucketLocation",
+                      "s3:ListBucket",
+                      "s3:GetObject"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}",
+                      "arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
+                    ]
+                  },
+                  {
+                    "Sid": "ReadWriteWorkBucket",
+                    "Effect": "Allow",
+                    "Action": [
+                      "s3:*"
+                    ],
+                    "Resource": [
+                      "arn:aws:s3:::work-tenant-{{ .Values.name }}",
+                      "arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
+                    ]
+                  }
+                ]
+              }
+              EOF
+              # Apply policy and attach to user
+              mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
+              mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user
+
+              # Create target secret with matching credentials
+              kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
+                --from-literal=S3_ENDPOINT="http://minio.minio.svc.cluster.local:9000" \
+                --from-literal=MINIO_ACCESS_KEY_ID=tenant-{{ .Values.name }}-user \
+                --from-literal=MINIO_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
+                --from-literal=BUCKET_REF="ref-tenant-{{ .Values.name }}" \
+                --from-literal=BUCKET_WORK="work-tenant-{{ .Values.name }}" \
                 -n minio --dry-run=client -o yaml | kubectl apply -f -
 
-              kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
+              # Annotate for Emberstack Reflector
+              kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
                 reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
                 reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
                 reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \

charts/tenant/templates/networkpolicy.yaml

@@ -15,15 +15,14 @@ spec:
     - Ingress
     - Egress
 
-  # Entrée : Autorise le trafic vers le Notebook Jupyter sur le port 8888
+  # Entrée
   ingress:
     - ports:
         - protocol: TCP
           port: 8888
 
-  # Sortie : Restreint les communications aux composants strictement nécessaires
+  # Sortie
   egress:
-    # 1. Résolution DNS dans kube-system
     - to:
         - namespaceSelector:
             matchLabels:
@@ -34,7 +33,7 @@ spec:
         - protocol: TCP
           port: 53
 
-    # 2. Flux vers l'API MinIO (Stockage S3)
+    # 2. Vers MinIO
     - to:
         - namespaceSelector:
             matchLabels:

charts/tenant/templates/secret-s3.yaml

@@ -10,7 +10,8 @@ type: Opaque
 stringData:
   MINIO_ACCESS_KEY_ID: 'tenant-{{ .Values.name }}-user'
   # If the secret exist, keep. Otherwise create a new random one. (To prevent a new password at each sync).
-  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "AWS_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "AWS_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
+  MINIO_SECRET_ACCESS_KEY: {{ if and $existingSecret $existingSecret.data (hasKey $existingSecret.data "MINIO_SECRET_ACCESS_KEY") }}{{ index $existingSecret.data "MINIO_SECRET_ACCESS_KEY" | b64dec }}{{ else }}{{ randAlphaNum 24 }}{{ end }}
   S3_ENDPOINT: "http://minio.minio.svc.cluster.local:9000"
   BUCKET_REF: "ref-tenant-{{ .Values.name }}"
   BUCKET_WORK: "work-tenant-{{ .Values.name }}"
+

gitops/bootstrap/root-app.yaml

@@ -8,7 +8,7 @@ spec:
   source:
     repoURL: https://git.bouvais.lu/adrien/ctie-exercice
     targetRevision: main
-    path: gitops/tenants
+    path: gitops
     directory:
       recurse: true
   destination:

gitops/tenants/project.yaml

@@ -4,14 +4,18 @@ metadata:
   name: tenants
   namespace: argocd
 spec:
+  # Ensure only pull from here
   sourceRepos:
     - https://git.bouvais.lu/adrien/ctie-exercice
+
+  # So this namespace can only affect other tenant and minio (not kube-system or argocd)
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
     - server: https://kubernetes.default.svc
       namespace: 'minio'
 
+  # This is necessary to create namespace
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace

images/minio-setup-runner/dockerfile

@@ -0,0 +1,13 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache curl bash openssl \
+    && curl -fsSL -o /usr/local/bin/mc https://dl.min.io/client/mc/release/linux-amd64/mc \
+    && chmod +x /usr/local/bin/mc \
+    && curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+    && chmod +x /usr/local/bin/kubectl \
+    && adduser -D -u 1000 runner
+
+USER runner
+WORKDIR /home/runner
+
+ENTRYPOINT ["/bin/bash"]

minio/manifests.yaml

@@ -43,7 +43,7 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: quay.io/minio/minio:latest
           args: ["server", "/data", "--console-address", ":9001"]
           env:
             - name: MINIO_ROOT_USER