From 517d823f770c617f323ceac665a392b43c52f042 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:55:50 -0700
Subject: [PATCH] =?UTF-8?q?feat(minio):=20Expand=20CRDs=20to=20include=20P?=
 =?UTF-8?q?olicies=20and=20Users=20=E2=80=94=20full=20YAML-driven=20resour?=
 =?UTF-8?q?ce=20creation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MinIO Policies and Users via CRD alongside Buckets.

Resources now declarative:
- Bucket: riotpiao-models (versioning enabled)
- Policy: policy-ollama (scoped bucket access)
- User: user-ollama (service account for Ollama/LLM)

Access keys can be overridden via SOPS or kustomize overlays.
All MinIO resource creation now git-tracked and version controlled.
---
 k8s/infrastructure/minio/buckets.yaml | 54 +++++++++++++++++++++++++--
 1 file changed, 51 insertions(+), 3 deletions(-)

diff --git a/k8s/infrastructure/minio/buckets.yaml b/k8s/infrastructure/minio/buckets.yaml
index 9c2f9f8..fb148f5 100644
--- a/k8s/infrastructure/minio/buckets.yaml
+++ b/k8s/infrastructure/minio/buckets.yaml
@@ -1,3 +1,5 @@
+---
+# Buckets
 apiVersion: minio.min.io/v1alpha1
 kind: Bucket
 metadata:
@@ -5,13 +7,59 @@ metadata:
   namespace: minio
 spec:
   name: riotpiao-models
-  # Bucket versioning for LLM model artifacts
   versioning:
     enabled: true
   tags:
     app: ollama
     layer: applications
     purpose: model-storage
+
 ---
-# Future: Add more buckets as needed
-# Example: terraform-state, logs, artifacts, etc.
+# Policies: define access scopes
+apiVersion: minio.min.io/v1alpha1
+kind: Policy
+metadata:
+  name: policy-ollama
+  namespace: minio
+spec:
+  name: policy-ollama
+  statements:
+    - Effect: Allow
+      Action:
+        - s3:GetObject
+        - s3:PutObject
+      Resource:
+        - arn:aws:s3:::riotpiao-models/*
+    - Effect: Allow
+      Action:
+        - s3:ListBucket
+      Resource:
+        - arn:aws:s3:::riotpiao-models
+
+---
+# Users: service accounts with scoped access
+apiVersion: minio.min.io/v1alpha1
+kind: User
+metadata:
+  name: user-ollama
+  namespace: minio
+spec:
+  accessKey: ollama-access-key
+  secretKey: ollama-secret-key-changeme  # Override via Secret
+  policies:
+    - policy-ollama
+  status: enabled
+  memberOf: []
+
+---
+# Future buckets
+# - terraform-state: for Terraform state
+# - logs: for application logs
+# - artifacts: for CI/CD artifacts
+# - backups: for database backups
+
+# Future users
+# - terraform: read/write terraform-state
+# - logging: write logs
+# - ci-cd: write artifacts
+# - backups: write backups