95 lines
3.3 KiB
YAML
95 lines
3.3 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: 'tenant-{{ .Values.name }}-minio-setup'
|
|
namespace: {{ .Release.Namespace }}
|
|
annotations:
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
ttlSecondsAfterFinished: 100
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: mc
|
|
image: minio/mc:RELEASE.2024-03-03T00-13-08Z
|
|
env:
|
|
# 1. MinIO Admin Credentials (Replicated from argocd namespace)
|
|
- name: MINIO_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-admin-credentials
|
|
key: MINIO_ROOT_USER
|
|
- name: MINIO_ADMIN_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-admin-credentials
|
|
key: MINIO_ROOT_PASSWORD
|
|
|
|
# 2. Randomly Generated Tenant Credentials
|
|
- name: TENANT_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: AWS_ACCESS_KEY_ID
|
|
- name: TENANT_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
- name: BUCKET_REF
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: BUCKET_REF
|
|
- name: BUCKET_WORK
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: s3-credentials
|
|
key: BUCKET_WORK
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Connect to MinIO using admin secret from env
|
|
mc alias set minioadmin http://minio.minio.svc.cluster.local:9000 $MINIO_ADMIN_USER $MINIO_ADMIN_PASS
|
|
|
|
# Create buckets
|
|
mc mb --ignore-existing minioadmin/$BUCKET_REF
|
|
mc mb --ignore-existing minioadmin/$BUCKET_WORK
|
|
|
|
# Create tenant user using randomly generated password
|
|
mc admin user add minioadmin $TENANT_USER $TENANT_PASS || true
|
|
|
|
# Apply IAM isolation policy
|
|
cat <<EOF > /tmp/policy.json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetBucketLocation", "s3:ListBucket"],
|
|
"Resource": [
|
|
"arn:aws:s3:::$BUCKET_REF",
|
|
"arn:aws:s3:::$BUCKET_WORK"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetObject"],
|
|
"Resource": ["arn:aws:s3:::$BUCKET_REF/*"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:*"],
|
|
"Resource": ["arn:aws:s3:::$BUCKET_WORK/*"]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
|
|
mc admin policy create minioadmin {{ .Values.name }}-policy /tmp/policy.json || mc admin policy update minioadmin {{ .Values.name }}-policy /tmp/policy.json
|
|
mc admin policy attach minioadmin {{ .Values.name }}-policy --user=$TENANT_USER
|
|
echo "MinIO setup completed for {{ .Values.name }}"
|