deploy/minio/templates/provisioning-job.yaml

{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- if .Values.provisioning.enabled }}
{{- $fullname := printf "%s-provisioning" (include "common.names.fullname" .) }}
{{- $minioAlias := "provisioning" }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ $fullname }}
  namespace: {{ include "common.names.namespace" . | quote }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
    app.kubernetes.io/component: minio-provisioning
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-delete-policy: before-hook-creation
    {{- if .Values.commonAnnotations }}
    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
    {{- end }}
spec:
  {{- if .Values.provisioning.cleanupAfterFinished.enabled }} 
  ttlSecondsAfterFinished: {{ .Values.provisioning.cleanupAfterFinished.seconds }} 
  {{- end }} 
  parallelism: 1
  template:
    metadata:
      labels: {{- include "minio.labels.provisioning" . | nindent 8 }}
        app.kubernetes.io/component: minio-provisioning
      {{- if .Values.provisioning.podAnnotations }}
      annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.podAnnotations "context" $) | nindent 8 }}
      {{- end }}
    spec:
      {{- include "minio.imagePullSecrets" . | nindent 6 }}
      {{- if .Values.provisioning.schedulerName }}
      schedulerName: {{ .Values.provisioning.schedulerName }}
      {{- end }}
      restartPolicy: OnFailure
      terminationGracePeriodSeconds: 0
      {{- if .Values.provisioning.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.provisioning.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ template "minio.serviceAccountName" . }}
      initContainers:
        - name: wait-for-available-minio
          image: {{ include "minio.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          {{- if .Values.provisioning.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          command:
            - /bin/bash
            - -c
            - |-
              set -e;
              echo "Waiting for Minio";
              wait-for-port \
                --host={{ include "common.names.fullname" . }} \
                --state=inuse \
                --timeout=120 \
                {{ .Values.service.ports.api | int64 }};
              echo "Minio is available";
          {{- if .Values.provisioning.resources }}
          resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
          {{- end }}
      containers:
        - name: minio
          image: {{ include "minio.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          {{- if .Values.provisioning.containerSecurityContext.enabled }}
          securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          {{- if .Values.provisioning.command }}
          command: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.command "context" $) | nindent 12 }}
          {{- else }}
          command:
            - /bin/bash
            - -c
            - >-
              set -e;
              echo "Start Minio provisioning";

              function attachPolicy() {
                local tmp=$(mc admin $1 info {{ $minioAlias }} $2 | sed -n -e 's/^Policy.*: \(.*\)$/\1/p');
                IFS=',' read -r -a CURRENT_POLICIES <<< "$tmp";
                if [[ ! "${CURRENT_POLICIES[*]}" =~ "$3" ]]; then
                  mc admin policy attach {{ $minioAlias }} $3 --$1=$2;
                fi;
              };

              function detachDanglingPolicies() {
                local tmp=$(mc admin $1 info {{ $minioAlias }} $2 | sed -n -e 's/^Policy.*: \(.*\)$/\1/p');
                IFS=',' read -r -a CURRENT_POLICIES <<< "$tmp";
                IFS=',' read -r -a DESIRED_POLICIES <<< "$3";
                for current in "${CURRENT_POLICIES[@]}"; do
                  if [[ ! "${DESIRED_POLICIES[*]}" =~ "${current}" ]]; then
                    mc admin policy detach {{ $minioAlias }} $current --$1=$2;
                  fi;
                done;
              }

              function addUsersFromFile() {
                local username=$(grep -oP '^username=\K.+' $1);
                local password=$(grep -oP '^password=\K.+' $1);
                local disabled=$(grep -oP '^disabled=\K.+' $1);
                local policies_list=$(grep -oP '^policies=\K.+' $1);
                local set_policies=$(grep -oP '^setPolicies=\K.+' $1);

                mc admin user add {{ $minioAlias }} "${username}" "${password}";

                IFS=',' read -r -a POLICIES <<< "${policies_list}";
                for policy in "${POLICIES[@]}"; do
                  attachPolicy user "${username}" "${policy}";
                done;
                if [ "${set_policies}" == "true" ]; then
                  detachDanglingPolicies user "${username}" "${policies_list}";
                fi;

                local user_status="enable";
                if [[ "${disabled}" != "" && "${disabled,,}" == "true" ]]; then
                  user_status="disable";
                fi;

                mc admin user "${user_status}" {{ $minioAlias }} "${username}";
              };

              {{- $minioUrl := printf "$MINIO_SCHEME://%s:%d" (include "common.names.fullname" .) (.Values.service.ports.api | int) }}
              {{- $minioRootUser := ternary ("$(<$MINIO_ROOT_USER_FILE)") ("$MINIO_ROOT_USER") (.Values.auth.useCredentialsFiles) }}
              {{- $minioRootPassword := ternary ("$(<$MINIO_ROOT_PASSWORD_FILE)") ("$MINIO_ROOT_PASSWORD") (.Values.auth.useCredentialsFiles) }}
              mc alias set {{ $minioAlias }} {{ $minioUrl }} {{ $minioRootUser }} {{ $minioRootPassword }};

              {{- range $config := .Values.provisioning.config }}
              {{- $options := list }}
              {{- range $name, $value := $config.options }}
              {{- $options = (printf "%s=%s" $name $value) | append $options }}
              {{- end }}
              {{- $options := join " " $options }}
              mc admin config set {{ $minioAlias }} {{ $config.name }} {{ $options }};
              {{- end }}

              mc admin service restart {{ $minioAlias }};

              {{- range $policy := .Values.provisioning.policies }}
              mc admin policy create {{ $minioAlias }} {{ $policy.name }} /etc/ilm/policy-{{ $policy.name }}.json;
              {{- end }}

              {{- range $user := .Values.provisioning.users }}
              mc admin user add {{ $minioAlias }} {{ $user.username }} {{ $user.password }};
              {{- range $policy := $user.policies }}
              attachPolicy user {{ $user.username }} {{ $policy }};
              {{- end }}
              {{- if $user.setPolicies }}
              detachDanglingPolicies user {{ $user.username }} "{{ join "," $user.policies }}";
              {{- end }}
              {{- $userStatus := ternary ("disable") ("enable") (and (not (empty $user.disabled)) $user.disabled) }}
              mc admin user {{ $userStatus }} {{ $minioAlias }} {{ $user.username }};
              {{- end }}
              {{- if gt (len .Values.provisioning.usersExistingSecrets) 0 }}
              while read -d '' configFile; do
                addUsersFromFile "${configFile}";
              done < <(find "/opt/bitnami/minio/users/" -type l -not -name '..data' -print0);
              {{- end }}

              {{- range $group := .Values.provisioning.groups }}
              mc admin group add {{ $minioAlias }} {{ $group.name }} {{ join " " $group.members }};
              {{- range $policy := $group.policies }}
              attachPolicy group {{ $group.name }} {{ $policy }};
              {{- end }}
              {{- if $group.setPolicies }}
              detachDanglingPolicies group {{ $group.name }} "{{ join "," $group.policies }}";
              {{- end }}
              {{- $groupStatus := ternary ("disable") ("enable") (and (not (empty $group.disabled)) $group.disabled) }}
              mc admin group {{ $groupStatus }} {{ $minioAlias }} {{ $group.name }};
              {{- end }}

              {{- $isDistributedMode := (eq .Values.mode "distributed") }}
              {{- range $bucket := .Values.provisioning.buckets }}
              {{- $target := printf "%s/%s" $minioAlias $bucket.name }}
              {{- $region := ternary (printf "--region=%s" $bucket.region) ("") (not (empty $bucket.region)) }}
              {{- $withLock := ternary ("--with-lock") ("") (and (not (empty $bucket.withLock)) $bucket.withLock) }}
              mc mb {{ $target }} --ignore-existing {{ $region }} {{ $withLock }};

              {{- if $bucket.lifecycle }}
              mc ilm import {{ $minioAlias }}/{{ $bucket.name }} < /etc/ilm/bucket-{{ $bucket.name }}.json;
              {{- end }}

              {{- with $bucket.quota }}
              {{- if eq .type "hard" }}
              mc quota set {{ $minioAlias }}/{{ $bucket.name }} {{ if .size }}--size {{ .size }}{{ end }};
              {{- else }}
              mc quota {{ .type }} {{ $minioAlias }}/{{ $bucket.name }} {{ if .size }}--size {{ .size }}{{ end }};
              {{- end }}
              {{- end }}

              {{- if $isDistributedMode }}
              {{- if (or ((empty $bucket.withLock)) (not $bucket.withLock)) }}
              {{- $versioning := default "Suspended" $bucket.versioning }}
              {{- if kindIs "bool" $bucket.versioning }}
              {{- $versioning = ternary "Versioned" "Suspended" $bucket.versioning }}
              {{- end }}
              {{- if eq $versioning "Versioned" }}
              mc version enable {{ $minioAlias }}/{{ $bucket.name }};
              {{- else if eq $versioning "Suspended" }}
              mc version suspend {{ $minioAlias }}/{{ $bucket.name }};
              {{- else if ne $versioning "Unchanged" }}
              {{- fail (printf "Invalid value '%s' for versioning of bucket '%s'" $versioning $bucket.name) }}
              {{- end }}
              {{- end }}
              {{- end }}

              {{- if $bucket.tags }}
              {{- $target := printf "%s/%s" $minioAlias $bucket.name }}
              {{- $tags := list }}
              {{- range $name, $value := $bucket.tags }}
              {{- $tags = (printf "%s=%s" $name $value) | append $tags }}
              {{- end }}
              {{- $tags := join "&" $tags | quote }}
              mc tag set {{ $target }} {{ $tags }};
              {{- end }}
              {{- end }}

              {{- if .Values.provisioning.extraCommands }}
              {{ join ";" .Values.provisioning.extraCommands | nindent 14 }};
              {{- end }}

              echo "End Minio provisioning";
          {{- end }}
          {{- if .Values.provisioning.args }}
          args: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.args "context" $) | nindent 12 }}
          {{- end }}
          env:
            - name: MINIO_SCHEME
              value: {{ ternary "https" "http" .Values.tls.enabled | quote }}
            {{- if .Values.auth.useCredentialsFiles }}
            - name: MINIO_ROOT_USER_FILE
              value: "/opt/bitnami/minio/secrets/root-user"
            {{- else }}
            - name: MINIO_ROOT_USER
              valueFrom:
                secretKeyRef:
                  name: {{ include "minio.secretName" . }}
                  key: root-user
            {{- end }}
            {{- if .Values.auth.useCredentialsFiles }}
            - name: MINIO_ROOT_PASSWORD_FILE
              value: "/opt/bitnami/minio/secrets/root-password"
            {{- else }}
            - name: MINIO_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "minio.secretName" . }}
                  key: root-password
            {{- end }}
            {{- if .Values.tls.mountPath }}
            - name: MINIO_CERTS_DIR
              value: {{ .Values.tls.mountPath | quote }}
            {{- end }}
          envFrom:
            {{- if .Values.extraEnvVarsCM }}
            - configMapRef:
                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
            {{- end }}
            {{- if .Values.extraEnvVarsSecret }}
            - secretRef:
                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
            {{- end }}
          {{- if .Values.provisioning.resources }}
          resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
          {{- end }}
          volumeMounts:
            {{- if .Values.provisioning.enabled }}
            - name: minio-provisioning
              mountPath: /etc/ilm
            {{- end }}
            {{- if .Values.auth.useCredentialsFiles }}
            - name: minio-credentials
              mountPath: /opt/bitnami/minio/secrets/
            {{- end }}
            {{- if .Values.tls.enabled }}
            - name: minio-certs
              mountPath: {{ default "/certs" .Values.tls.mountPath }}
            - name: minio-client-certs
              mountPath: /.mc/certs
            {{- end }}
            {{- range $idx, $_ := .Values.provisioning.usersExistingSecrets }}
            - name: {{ printf "users-secret-%d" $idx }}
              mountPath: /opt/bitnami/minio/users/{{ $idx }}/
            {{- end }}
            {{- if .Values.provisioning.extraVolumeMounts }}
            {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumeMounts "context" $) | nindent 12 }}
            {{- end }}
      {{- if .Values.tolerations }}
      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.provisioning.nodeSelector }}
      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.nodeSelector "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        {{- if .Values.provisioning.enabled }}
        - name: minio-provisioning
          configMap:
            name: {{ $fullname }}
        {{- end }}
        {{- if .Values.auth.useCredentialsFiles }}
        - name: minio-credentials
          secret:
            secretName: {{ include "minio.secretName" . }}
        {{- end }}
        {{- range $idx, $userSecret := .Values.provisioning.usersExistingSecrets }}
        - name: {{ printf "users-secret-%d" $idx }}
          secret:
            secretName: {{ $userSecret }}
        {{- end }}
        {{- if .Values.tls.enabled }}
        - name: minio-certs
          secret:
            secretName: {{ include "minio.tlsSecretName" . }}
            items:
            - key: tls.crt
              path: public.crt
            - key: tls.key
              path: private.key
            - key: ca.crt
              path: CAs/public.crt
        - name: minio-client-certs
          secret:
            secretName: {{ include "minio.tlsSecretName" . }}
            items:
              - key: ca.crt
                path: CAs/public.crt
        {{- end }}
        {{- if .Values.provisioning.extraVolumes }}
        {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumes "context" $) | nindent 8 }}
        {{- end }}
{{- end }}