MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-02-08 20:28:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

helm: add policy to svcacct (#16272)

Browse Source
This commit is contained in:
orblazer 2022-12-18 07:50:37 +01:00 committed by GitHub
parent 89db3fdb5d
commit 0db1930f48
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 34 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
helm/minio/templates/_helper_create_svcacct.txt
View File

@ -49,6 +49,7 @@ checkSvcacctExists() {
# createSvcacct ($user) # createSvcacct ($user)
createSvcacct () { createSvcacct () {
USER=$1 USER=$1
FILENAME=$2
#check accessKey_and_secretKey_tmp file #check accessKey_and_secretKey_tmp file
if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
echo "credentials file does not exist" echo "credentials file does not exist"
@ -63,7 +64,12 @@ createSvcacct () {
# Create the svcacct if it does not exist # Create the svcacct if it does not exist
if ! checkSvcacctExists ; then if ! checkSvcacctExists ; then
echo "Creating svcacct '$SVCACCT'" echo "Creating svcacct '$SVCACCT'"
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER # Check if policy file is define
if [ -z $FILENAME ]; then
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER
else
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER
fi
else else
echo "Svcacct '$SVCACCT' already exists." echo "Svcacct '$SVCACCT' already exists."
fi fi
@ -82,15 +88,18 @@ connectToMinio $scheme
{{ if .Values.svcaccts }} {{ if .Values.svcaccts }}
{{ $global := . }} {{ $global := . }}
# Create the svcaccts # Create the svcaccts
{{- range .Values.svcaccts }} {{- range $idx, $svc := .Values.svcaccts }}
echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP
{{- if .existingSecret }} {{- if .existingSecret }}
cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
# Add a new line if it doesn't exist # Add a new line if it doesn't exist
sed -i '$a\' $MINIO_ACCESSKEY_SECRETKEY_TMP sed -i '$a\' $MINIO_ACCESSKEY_SECRETKEY_TMP
createSvcacct {{ .user }}
{{ else }} {{ else }}
echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
{{- end }}
{{- if $svc.policy}}
createSvcacct {{ .user }} svc_policy_{{ $idx }}
{{ else }}
createSvcacct {{ .user }} createSvcacct {{ .user }}
{{- end }} {{- end }}
{{- end }} {{- end }}

9
helm/minio/templates/configmap.yaml
View File

@ -16,9 +16,16 @@ data:
add-policy: |- add-policy: |-
{{ include (print $.Template.BasePath "/_helper_create_policy.txt") . | indent 4 }} {{ include (print $.Template.BasePath "/_helper_create_policy.txt") . | indent 4 }}
{{- range $idx, $policy := .Values.policies }} {{- range $idx, $policy := .Values.policies }}
# {{ $policy.name }} # Policy: {{ $policy.name }}
policy_{{ $idx }}.json: |- policy_{{ $idx }}.json: |-
{{ include (print $.Template.BasePath "/_helper_policy.tpl") . | indent 4 }} {{ include (print $.Template.BasePath "/_helper_policy.tpl") . | indent 4 }}
{{ end }}
{{- range $idx, $svc := .Values.svcaccts }}
{{- if $svc.policy }}
# SVC: {{ $svc.accessKey }}
svc_policy_{{ $idx }}.json: |-
{{ include (print $.Template.BasePath "/_helper_policy.tpl") .policy | indent 4 }}
{{- end }}
{{ end }} {{ end }}
add-svcacct: |- add-svcacct: |-
{{ include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | indent 4 }} {{ include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | indent 4 }}

14
helm/minio/values.yaml
View File

@ -370,6 +370,20 @@ makeUserJob:
# existingSecret: my-secret # existingSecret: my-secret
# existingSecretKey: password # existingSecretKey: password
# user: console # user: console
## You also can pass custom policy
# - accessKey: console-svcacct
# secretKey: console123
# user: console
# policy:
# statements:
# - resources:
# - 'arn:aws:s3:::example*/*'
# actions:
# - "s3:AbortMultipartUpload"
# - "s3:GetObject"
# - "s3:DeleteObject"
# - "s3:PutObject"
# - "s3:ListMultipartUploadParts"
makeServiceAccountJob: makeServiceAccountJob:
securityContext: securityContext: