44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: 'tenant-{{ .Values.name }}-minio-setup'
|
|
namespace: minio
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
ttlSecondsAfterFinished: 100
|
|
template:
|
|
spec:
|
|
serviceAccountName: minio-provisioner
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: setup
|
|
image: minio/mc:latest
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
mc alias set local http://minio.minio.svc:9000 \
|
|
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
|
|
|
mc mb -p local/{{ .Values.name }}-ref local/{{ .Values.name }}-work
|
|
mc admin user add local {{ .Values.name }}-user "$(openssl rand -hex 16)" || true
|
|
mc admin policy create local {{ .Values.name }}-policy /policies/{{ .Values.name }}.json
|
|
mc admin policy attach local {{ .Values.name }}-policy --user {{ .Values.name }}-user
|
|
|
|
# write the SCOPED secret in this same namespace
|
|
kubectl create secret generic {{ .Values.name }}-s3-credentials \
|
|
--from-literal=AWS_ACCESS_KEY_ID={{ .Values.name }}-user \
|
|
--from-literal=AWS_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
|
|
-n minio --dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
kubectl annotate secret {{ .Values.name }}-s3-credentials -n minio --overwrite \
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-{{ .Values.name }}"
|
|
envFrom:
|
|
- secretRef:
|
|
name: minio-admin-credentials
|