arcodangeandClaude Opus 5
7074a94d7e
Helm Charts / Detect changed charts (push) Successful in 22s
Helm Charts / Detect changed charts (pull_request) Successful in 16s
MinIO / Auth with gitea for vault (push) Failing after 8m33s
MinIO / Tofu - minio IAC (push) Has been skipped
MinIO / Auth with gitea for vault (pull_request) Failing after 8m32s
MinIO / Tofu - minio IAC (pull_request) Has been skipped
Hashicorp Vault / Auth with gitea for vault (pull_request) Failing after 8m32s
Hashicorp Vault / Tofu - Vault IAC (pull_request) Has been skipped
Helm Charts / Library charts tool (push) Has been skipped
Helm Charts / Library charts tool (pull_request) Has been skipped
Hashicorp Vault / Auth with gitea for vault (push) Failing after 8m31s
Hashicorp Vault / Tofu - Vault IAC (push) Has been skipped
Helm Charts / Application charts pgcat (push) Has been skipped
Helm Charts / Application charts pgcat (pull_request) Has been skipped
Les décisions de conception (qui déclare, qui détient, pourquoi les octets ne passent pas par l'API) vivent désormais dans `factory/doc/adr/20260726-stockage-objet-minio.md`. Le code ne garde que ce qu'un relecteur ne peut pas deviner et qui l'empêcherait de casser quelque chose : l'absence VOLONTAIRE de s3:GetObject/PutObject dans la politique du provisionneur, l'absence VOLONTAIRE de basic-auth sur l'ingress S3, le caractère inconditionnel de la règle Vault, et l'avertissement sur les noms d'actions MinIO non éprouvés. Chaque fichier pointe l'ADR. 283 → 230 lignes sur minio/iac. tofu fmt propre, tofu validate réussi sur les deux racines. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01CoafGWmRVESaWX819USUUA
63 lines
1.9 KiB
Terraform
63 lines
1.9 KiB
Terraform
# Compte de PROVISIONNEMENT : crée buckets, politiques et comptes de service —
|
|
# aucun droit sur les objets. C'est lui que lisent les rôles CI des apps, pour
|
|
# qu'elles déclarent leurs buckets sans qu'on leur confie le root.
|
|
# Décisions : factory/doc/adr/20260726-stockage-objet-minio.md
|
|
#
|
|
# ⚠ Noms d'actions issus de la documentation MinIO, NON éprouvés contre le
|
|
# serveur : le premier apply les confirmera ou les corrigera.
|
|
resource "minio_iam_policy" "provisioner" {
|
|
name = "provisioner"
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = [
|
|
"admin:CreateUser",
|
|
"admin:DeleteUser",
|
|
"admin:ListUsers",
|
|
"admin:GetUser",
|
|
"admin:CreatePolicy",
|
|
"admin:DeletePolicy",
|
|
"admin:GetPolicy",
|
|
"admin:ListUserPolicies",
|
|
"admin:AttachUserOrGroupPolicy",
|
|
]
|
|
Resource = ["arn:aws:s3:::*"]
|
|
},
|
|
{
|
|
# s3:GetObject / s3:PutObject volontairement ABSENTS.
|
|
Effect = "Allow"
|
|
Action = ["s3:CreateBucket", "s3:DeleteBucket", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:PutBucketPolicy"]
|
|
Resource = ["arn:aws:s3:::*"]
|
|
},
|
|
]
|
|
})
|
|
}
|
|
|
|
resource "random_password" "provisioner" {
|
|
length = 40
|
|
special = false
|
|
}
|
|
|
|
resource "minio_iam_user" "provisioner" {
|
|
name = "provisioner"
|
|
secret = random_password.provisioner.result
|
|
force_destroy = false
|
|
}
|
|
|
|
resource "minio_iam_user_policy_attachment" "provisioner" {
|
|
user_name = minio_iam_user.provisioner.id
|
|
policy_name = minio_iam_policy.provisioner.id
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "provisioner" {
|
|
mount = "kvv2"
|
|
name = "minio/provisioner"
|
|
data_json = jsonencode({
|
|
MINIO_ENDPOINT = var.minio_endpoint
|
|
MINIO_ACCESS_KEY = minio_iam_user.provisioner.id
|
|
MINIO_SECRET_KEY = random_password.provisioner.result
|
|
})
|
|
}
|