Story Crater Bot
e8e5acfb13
Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).
121 lines
4.7 KiB
YAML
121 lines
4.7 KiB
YAML
# PostSync hook Job: creates a MinIO IAM user + policy scoped to only the
|
|
# `paperless` bucket (least-privilege — reuses root creds nowhere else in the
|
|
# cluster), then writes the generated access/secret key into a Secret in the
|
|
# `paperless` namespace for the nightly backup CronJob to consume.
|
|
#
|
|
# Idempotent: re-running never rotates existing credentials — if
|
|
# paperless-minio-creds already exists in ns paperless, the script reuses the
|
|
# access key it already wrote and just re-asserts the policy/user exist.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: minio-paperless-provisioner
|
|
namespace: storage
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: minio-paperless-provisioner
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "create", "update", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: minio-paperless-provisioner
|
|
namespace: paperless
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: minio-paperless-provisioner
|
|
namespace: storage
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: minio-paperless-provisioner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: minio-provision-paperless
|
|
namespace: storage
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
ttlSecondsAfterFinished: 600
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: minio-paperless-provisioner
|
|
restartPolicy: Never
|
|
initContainers:
|
|
- name: kubectl-copy
|
|
image: bitnami/kubectl:latest
|
|
command: ["sh", "-c", "cp $(which kubectl) /shared/kubectl"]
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /shared
|
|
containers:
|
|
- name: provision
|
|
image: minio/mc:latest
|
|
volumeMounts:
|
|
- name: shared
|
|
mountPath: /shared
|
|
- name: minio-creds
|
|
mountPath: /minio-creds
|
|
readOnly: true
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
export PATH="/shared:$PATH"
|
|
|
|
# minio-creds ships as a shell-sourceable config.env blob
|
|
# (`export MINIO_ROOT_USER=... / MINIO_ROOT_PASSWORD=...`), not
|
|
# discrete keys — source it directly rather than re-parsing.
|
|
. /minio-creds/config.env
|
|
|
|
mc alias set m http://minio-cluster-hl.storage.svc.cluster.local:9000 \
|
|
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
|
|
|
echo "Checking for existing paperless-minio-creds secret..."
|
|
if kubectl -n paperless get secret paperless-minio-creds >/dev/null 2>&1; then
|
|
ACCESS_KEY=$(kubectl -n paperless get secret paperless-minio-creds -o jsonpath='{.data.ACCESS_KEY}' | base64 -d)
|
|
SECRET_KEY=$(kubectl -n paperless get secret paperless-minio-creds -o jsonpath='{.data.SECRET_KEY}' | base64 -d)
|
|
echo " reusing existing credentials"
|
|
else
|
|
ACCESS_KEY="paperless"
|
|
SECRET_KEY=$(head -c 32 /dev/urandom | base64 | tr -d '/+=' | head -c 40)
|
|
echo " generated new credentials"
|
|
fi
|
|
|
|
echo "Ensuring MinIO user 'paperless' exists..."
|
|
if ! mc admin user info m "$ACCESS_KEY" >/dev/null 2>&1; then
|
|
mc admin user add m "$ACCESS_KEY" "$SECRET_KEY"
|
|
fi
|
|
|
|
echo "Writing scoped policy (paperless bucket only)..."
|
|
printf '%s' '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":["arn:aws:s3:::paperless"]},{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject","s3:DeleteObject"],"Resource":["arn:aws:s3:::paperless/*"]}]}' > /tmp/paperless-rw-policy.json
|
|
mc admin policy create m paperless-rw /tmp/paperless-rw-policy.json || \
|
|
mc admin policy update m paperless-rw /tmp/paperless-rw-policy.json
|
|
mc admin policy attach m paperless-rw --user "$ACCESS_KEY"
|
|
|
|
echo "Writing paperless-minio-creds secret (ns paperless)..."
|
|
kubectl -n paperless create secret generic paperless-minio-creds \
|
|
--from-literal=ACCESS_KEY="$ACCESS_KEY" \
|
|
--from-literal=SECRET_KEY="$SECRET_KEY" \
|
|
--from-literal=BUCKET=paperless \
|
|
--from-literal=ENDPOINT=http://minio-cluster-hl.storage.svc.cluster.local:9000 \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo "Done."
|
|
volumes:
|
|
- name: shared
|
|
emptyDir: {}
|
|
- name: minio-creds
|
|
secret:
|
|
secretName: minio-creds
|