helm: adds support for policy conditions (#15599)

helm/minio/templates/_helper_policy.tpl

@@ -12,6 +12,16 @@
       "Resource": [
 "{{ $statement.resources | join "\",\n\"" }}"
       ]{{ end }}
+{{- if $statement.conditions }}
+{{- $condition_len := len $statement.conditions }}
+{{- $condition_len := sub $condition_len 1 }}
+      ,
+      "Condition": {
+ {{- range $k,$v := $statement.conditions }}
+ {{- range $operator,$object := $v }}
+        "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }}
+ {{- end }}{{- end }}
+      }{{- end }} 
     }{{ if lt $i $statements_length }},{{end }}
 {{- end }}
   ]

helm/minio/values.yaml

@@ -301,6 +301,21 @@ policies: []
 #         - "s3:GetBucketLocation"
 #         - "s3:ListBucket"
 #         - "s3:ListBucketMultipartUploads"
+## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only
+# - name: conditionsexample
+#   statements:
+#     - resources:
+#       - 'arn:aws:s3:::example/*'
+#       actions:
+#       - 's3:*'
+#       conditions:
+#         - StringEquals: '"aws:username": "johndoe"'
+#         - IpAddress: |
+#             "aws:SourceIp": [
+#               "10.0.0.0/8",
+#               "192.168.0.0/24"
+#             ]
+#
 ## Additional Annotations for the Kubernetes Job makePolicyJob
 makePolicyJob:
   podAnnotations: {}