93 lines
3.7 KiB
YAML
93 lines
3.7 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: 'tenant-{{ .Values.name }}-minio-setup'
|
|
namespace: minio
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
ttlSecondsAfterFinished: 100
|
|
template:
|
|
spec:
|
|
serviceAccountName: minio-provisioner
|
|
restartPolicy: OnFailure
|
|
imagePullSecrets:
|
|
- name: registry-credentials
|
|
containers:
|
|
- name: setup
|
|
image: registry.bouvais.lu/minio-runner:1.0.0
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
|
|
# Generate password
|
|
SCOPED_SECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 32)
|
|
|
|
# Configure MinIO alias
|
|
mc alias set local http://minio.minio.svc:9000 \
|
|
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
|
|
|
# Create buckets
|
|
mc mb -p local/ref-tenant-{{ .Values.name }} local/work-tenant-{{ .Values.name }}
|
|
|
|
# Create user with generated credentials
|
|
mc admin user add local tenant-{{ .Values.name }}-user "$SCOPED_SECRET"
|
|
|
|
# Inline policy generation to avoid missing mount issues
|
|
cat <<EOF > /tmp/policy.json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ReadOnlyRefBucket",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:GetBucketLocation",
|
|
"s3:ListBucket",
|
|
"s3:GetObject"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::ref-tenant-{{ .Values.name }}",
|
|
"arn:aws:s3:::ref-tenant-{{ .Values.name }}/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "ReadWriteWorkBucket",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::work-tenant-{{ .Values.name }}",
|
|
"arn:aws:s3:::work-tenant-{{ .Values.name }}/*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
# Apply policy and attach to user
|
|
mc admin policy create local tenant-{{ .Values.name }}-policy /tmp/policy.json
|
|
mc admin policy attach local tenant-{{ .Values.name }}-policy --user tenant-{{ .Values.name }}-user
|
|
|
|
# Create target secret with matching credentials
|
|
kubectl create secret generic tenant-{{ .Values.name }}-s3-credentials \
|
|
--from-literal=S3_ENDPOINT="http://minio.minio.svc.cluster.local:9000" \
|
|
--from-literal=MINIO_ACCESS_KEY_ID=tenant-{{ .Values.name }}-user \
|
|
--from-literal=MINIO_SECRET_ACCESS_KEY="$SCOPED_SECRET" \
|
|
--from-literal=BUCKET_REF="ref-tenant-{{ .Values.name }}" \
|
|
--from-literal=BUCKET_WORK="work-tenant-{{ .Values.name }}" \
|
|
-n minio --dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
# Annotate for Emberstack Reflector
|
|
kubectl annotate secret tenant-{{ .Values.name }}-s3-credentials -n minio --overwrite \
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed="true" \
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-enabled="true" \
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="tenant-{{ .Values.name }}" \
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces="tenant-{{ .Values.name }}"
|
|
envFrom:
|
|
- secretRef:
|
|
name: minio-admin-credentials
|