Minio helm chart improvements for user and policy creation (#14216)

helm/minio/templates/_helper_create_policy.txt

@@ -0,0 +1,73 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+  SCHEME=$1
+  ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+  set -e ; # fail if we can't read the keys.
+  ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+  set +e ; # The connections to minio are allowed to fail.
+  echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+  MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+  $MC_COMMAND ;
+  STATUS=$? ;
+  until [ $STATUS = 0 ]
+  do
+    ATTEMPTS=`expr $ATTEMPTS + 1` ;
+    echo \"Failed attempts: $ATTEMPTS\" ;
+    if [ $ATTEMPTS -gt $LIMIT ]; then
+      exit 1 ;
+    fi ;
+    sleep 2 ; # 1 second intervals between attempts
+    $MC_COMMAND ;
+    STATUS=$? ;
+  done ;
+  set -e ; # reset `e` as active
+  return 0
+}
+
+# checkPolicyExists ($policy)
+# Check if the policy exists, by using the exit code of `mc admin policy info`
+checkPolicyExists() {
+  POLICY=$1
+  CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1)
+  return $?
+}
+
+# createPolicy($name)
+createPolicy () {
+  NAME=$1
+
+  # Create the name if it does not exist
+  if ! checkPolicyExists $NAME ; then
+    echo "Creating policy '$NAME'"
+  else
+    echo "Policy '$NAME' already exists."
+  fi
+  ${MC} admin policy add myminio $NAME /config/$NAME.json
+
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.policies }}
+# Create the policies
+{{- range .Values.policies }}
+createPolicy {{ .name }}
+{{- end }}
+{{- end }}

helm/minio/templates/_helper_create_user.txt

@@ -78,6 +78,10 @@ connectToMinio $scheme
 {{ if .Values.users }}
 # Create the users
 {{- range .Values.users }}
+{{- if .existingSecret }}
+createUser {{ .accessKey }} $(cat /config/secrets/{{ .accessKey }}) {{ .policy }}
+{{ else }}
 createUser {{ .accessKey }} {{ .secretKey }} {{ .policy }}
 {{- end }}
 {{- end }}
+{{- end }}

helm/minio/templates/_helper_policy.tpl

@@ -0,0 +1,18 @@
+{{- $statements_length := len .statements -}}
+{{- $statements_length := sub $statements_length 1 -}}
+{
+  "Version": "2012-10-17",
+  "Statement": [
+{{- range $i, $statement := .statements }}
+    {
+      "Effect": "Allow",
+      "Action": [
+"{{ $statement.actions | join "\",\n\"" }}"
+      ],
+      "Resource": [
+"{{ $statement.resources | join "\",\n\"" }}"
+      ]
+    }{{ if lt $i $statements_length }},{{end }}
+{{- end }}
+  ]
+}

helm/minio/templates/configmap.yaml

@@ -13,3 +13,9 @@ data:
 {{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }}
   add-user: |-
 {{ include (print $.Template.BasePath "/_helper_create_user.txt") . | indent 4 }}
+  add-policy: |-
+{{ include (print $.Template.BasePath "/_helper_create_policy.txt") . | indent 4 }}
+{{- range .Values.policies }}
+  {{ .name }}.json: |-
+{{ include (print $.Template.BasePath "/_helper_policy.tpl") . | indent 4 }}
+{{ end }}

helm/minio/templates/post-install-create-policy-job.yaml

@@ -0,0 +1,87 @@
+{{- if .Values.policies }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "minio.fullname" . }}-make-policies-job
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ template "minio.name" . }}-make-policies-job
+    chart: {{ template "minio.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+{{- with .Values.makePolicyJob.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+  template:
+    metadata:
+      labels:
+        app: {{ template "minio.name" . }}-job
+        release: {{ .Release.Name }}
+{{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+{{- end }}
+{{- if .Values.makePolicyJob.podAnnotations }}
+      annotations:
+{{ toYaml .Values.makePolicyJob.podAnnotations | indent 8 }}
+{{- end }}
+    spec:
+      restartPolicy: OnFailure
+{{- include "minio.imagePullSecrets" . | indent 6 }}
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.makePolicyJob.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.makePolicyJob.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.makePolicyJob.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- if .Values.makePolicyJob.securityContext.enabled }}
+      securityContext:
+        runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.makePolicyJob.securityContext.runAsGroup }}
+        fsGroup: {{ .Values.makePolicyJob.securityContext.fsGroup }}
+{{- end }}
+      volumes:
+        - name: minio-configuration
+          projected:
+            sources:
+            - configMap:
+                name: {{ template "minio.fullname" . }}
+            - secret:
+                name: {{ template "minio.secretName" . }}
+        {{- if .Values.tls.enabled }}
+        - name: cert-secret-volume-mc
+          secret:
+            secretName: {{ .Values.tls.certSecret }}
+            items:
+            - key: {{ .Values.tls.publicCrt }}
+              path: CAs/public.crt
+        {{ end }}
+      containers:
+      - name: minio-mc
+        image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+        imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+        command: ["/bin/sh", "/config/add-policy"]
+        env:
+          - name: MINIO_ENDPOINT
+            value: {{ template "minio.fullname" . }}
+          - name: MINIO_PORT
+            value: {{ .Values.service.port | quote }}
+        volumeMounts:
+          - name: minio-configuration
+            mountPath: /config
+          {{- if .Values.tls.enabled }}
+          - name: cert-secret-volume-mc
+            mountPath: {{ .Values.configPathmc }}certs
+          {{ end }}
+        resources:
+{{ toYaml .Values.makePolicyJob.resources | indent 10 }}
+{{- end }}

helm/minio/templates/post-install-create-user-job.yaml

@@ -57,6 +57,15 @@ spec:
                 name: {{ template "minio.fullname" . }}
             - secret:
                 name: {{ template "minio.secretName" . }}
+            {{- range .Values.users }}
+            {{- if .existingSecret }}
+            - secret:
+                name: {{ .existingSecret }}
+                items:
+                  - key: {{ .existingSecretKey }}
+                    path: secrets/{{ .accessKey }}
+            {{- end }}
+            {{- end }}
         {{- if .Values.tls.enabled }}
         - name: cert-secret-volume-mc
           secret: