58 lines
1.8 KiB
Bash
Executable File
58 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Safe MinIO bucket initialization via Job (credentials in Secret, not env)
|
|
# Usage: ./minio-bucket-init.sh <namespace> <bucket1> [bucket2] ...
|
|
set -euo pipefail
|
|
|
|
NAMESPACE="${1:?Missing namespace}"
|
|
shift
|
|
BUCKETS=("$@")
|
|
|
|
if [ ${#BUCKETS[@]} -eq 0 ]; then
|
|
echo "Usage: $0 <namespace> <bucket1> [bucket2] ..." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Create Secret with Minio credentials (safe: sourced from env, not exposed in pod)
|
|
kubectl create secret generic minio-creds -n "$NAMESPACE" \
|
|
--from-literal=MINIO_ROOT_USER="${MINIO_ROOT_USER:?Missing MINIO_ROOT_USER}" \
|
|
--from-literal=MINIO_ROOT_PASSWORD="${MINIO_ROOT_PASSWORD:?Missing MINIO_ROOT_PASSWORD}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
# Create init Job that mounts Secret as volume, preventing env exposure
|
|
BUCKET_ARGS=$(printf '"%s", ' "${BUCKETS[@]}" | sed 's/, $//')
|
|
kubectl apply -f - <<EOF
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: minio-bucket-init-$RANDOM
|
|
namespace: $NAMESPACE
|
|
spec:
|
|
ttlSecondsAfterFinished: 300
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: minio-init
|
|
image: minio/mc:latest
|
|
volumeMounts:
|
|
- name: minio-secret
|
|
mountPath: /var/run/secrets/minio
|
|
readOnly: true
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
MINIO_ROOT_USER=\$(cat /var/run/secrets/minio/MINIO_ROOT_USER)
|
|
MINIO_ROOT_PASSWORD=\$(cat /var/run/secrets/minio/MINIO_ROOT_PASSWORD)
|
|
mc alias set local http://minio.storage.svc.cluster.local:9000 "\$MINIO_ROOT_USER" "\$MINIO_ROOT_PASSWORD"
|
|
mc mb --ignore-existing $BUCKET_ARGS
|
|
volumes:
|
|
- name: minio-secret
|
|
secret:
|
|
secretName: minio-creds
|
|
EOF
|
|
|
|
echo "✓ MinIO bucket init job submitted for: ${BUCKETS[*]}"
|
|
|