101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: 'tenant-{{ .Values.name }}-minio-setup'
|
|
namespace: {{ .Release.Namespace }}
|
|
annotations:
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
ttlSecondsAfterFinished: 100
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: mc
|
|
image: minio/mc:RELEASE.2024-03-03T00-13-08Z
|
|
env:
|
|
# 1. MinIO Admin Credentials (Replicated from argocd namespace)
|
|
- name: MINIO_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-admin-credentials
|
|
key: MINIO_ROOT_USER
|
|
- name: MINIO_ADMIN_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-admin-credentials
|
|
key: MINIO_ROOT_PASSWORD
|
|
|
|
# 2. Randomly Generated Tenant Credentials
|
|
- name: TENANT_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: MINIO_ACCESS_KEY_ID
|
|
- name: TENANT_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: MINIO_SECRET_ACCESS_KEY
|
|
- name: BUCKET_REF
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: BUCKET_REF
|
|
- name: BUCKET_WORK
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: BUCKET_WORK
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Fail immediately if any command fails
|
|
set -e
|
|
|
|
# Connect to MinIO using quotes to protect special characters in passwords
|
|
mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 "$MINIO_ADMIN_USER" "$MINIO_ADMIN_PASS"
|
|
|
|
# Create buckets
|
|
mc mb --ignore-existing minioadmin/$BUCKET_REF
|
|
mc mb --ignore-existing minioadmin/$BUCKET_WORK
|
|
|
|
echo "hello tenant-{{ .Values.name }}" | mc pipe minioadmin/$BUCKET_REF/hello.txt
|
|
|
|
# Create tenant user (REMOVED || true)
|
|
mc admin user add minioadmin "$TENANT_USER" "$TENANT_PASS"
|
|
|
|
# Apply IAM isolation policy
|
|
cat <<EOF > /tmp/policy.json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetBucketLocation", "s3:ListBucket"],
|
|
"Resource": [
|
|
"arn:aws:s3:::$BUCKET_REF",
|
|
"arn:aws:s3:::$BUCKET_WORK"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetObject"],
|
|
"Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:*"],
|
|
"Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
|
|
mc admin policy create minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin tenant-{{ .Values.name }}-policy /tmp/policy.json
|
|
# Good enough for now, would need better error handeling
|
|
mc admin policy attach minioadmin tenant-{{ .Values.name }}-policy --user="$TENANT_USER" || echo "Policy already attached, skipping."
|
|
echo "MinIO setup completed for tenant-{{ .Values.name }}"
|