97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: minio-policy-setup
|
|
namespace: storage
|
|
annotations:
|
|
# Run after the Tenant (and its declarative bucket/user) exist.
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
ttlSecondsAfterFinished: 600
|
|
backoffLimit: 10
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: mc
|
|
image: minio/mc:latest
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
# Wait for the tenant S3 endpoint to answer.
|
|
# NOTE: minio's ClusterIP Service port tracks requestAutoCert on
|
|
# the Tenant - port 443 when auto-TLS is on, port 80 when it's
|
|
# off (requestAutoCert: false, our current setting - see
|
|
# minio-tenant.yaml). Use the headless per-pod Service instead,
|
|
# which always listens on 9000 regardless of TLS mode, so this
|
|
# job doesn't silently hang again if that setting ever flips.
|
|
until mc alias set local "http://minio-cluster-hl.storage.svc.cluster.local:9000" \
|
|
"$ROOT_USER" "$ROOT_PASSWORD" 2>/dev/null; do
|
|
echo "waiting for minio..."; sleep 5
|
|
done
|
|
|
|
# Scoped policy for the ollama service user: read/write its bucket only.
|
|
cat >/tmp/policy-ollama.json <<'JSON'
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetObject", "s3:PutObject"],
|
|
"Resource": ["arn:aws:s3:::riotpiao-models/*"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:ListBucket"],
|
|
"Resource": ["arn:aws:s3:::riotpiao-models"]
|
|
}
|
|
]
|
|
}
|
|
JSON
|
|
|
|
mc admin policy create local policy-ollama /tmp/policy-ollama.json || true
|
|
|
|
# Attach the policy to the declaratively-created user.
|
|
mc admin policy attach local policy-ollama --user "$OLLAMA_ACCESS_KEY" || true
|
|
|
|
echo "ollama policy configured"
|
|
env:
|
|
# mc writes its config to $HOME/.mc; runAsUser 1000 has HOME=/ which
|
|
# isn't writable, so `mc alias set` failed on `mkdir /.mc` and the
|
|
# wait-loop spun forever. Point HOME at the always-writable /tmp.
|
|
- name: HOME
|
|
value: /tmp
|
|
- name: ROOT_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-creds
|
|
key: accesskey
|
|
- name: ROOT_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-creds
|
|
key: secretkey
|
|
- name: OLLAMA_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-user-ollama
|
|
key: CONSOLE_ACCESS_KEY
|