From 973a9dc6a5d1cdf75e78c04f1256bfca8aadb37c Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Fri, 17 Jul 2026 16:05:40 +0300 Subject: [PATCH] ++ minio host configurable in yaml, incluster runner --- .gitea/workflows/terraform.yml | 6 +++--- infrastructure.yaml | 5 +++++ live/s3/terragrunt.hcl | 5 +++++ live/secrets/terragrunt.hcl | 2 +- live/terragrunt.hcl | 10 +++------- modules/minio-buckets/main.tf | 17 ++++++++++++++++- modules/minio-buckets/variables.tf | 18 ++++++++++++++++++ scripts/load_admin_creds.sh | 2 +- 8 files changed, 52 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml index fccc289..356bfa1 100644 --- a/.gitea/workflows/terraform.yml +++ b/.gitea/workflows/terraform.yml @@ -38,7 +38,7 @@ env: jobs: validate: - runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }} + runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }} container: image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }} env: @@ -88,7 +88,7 @@ jobs: plan: needs: [validate] - runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }} + runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }} container: image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }} env: @@ -137,7 +137,7 @@ jobs: apply: needs: [plan] if: github.event_name == 'push' - runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }} + runs-on: ${{ vars.RUNNER_LABEL || 'incluster' }} container: image: ${{ vars.RUNNER_IMAGE || 'cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.11' }} env: diff --git a/infrastructure.yaml b/infrastructure.yaml index ac0b796..64b7f32 100644 --- a/infrastructure.yaml +++ b/infrastructure.yaml @@ -15,6 +15,11 @@ environments: annotations: managed-by: terraform + # MinIO endpoint (declarative). Exposed externally on this contour; scheme + # decides TLS. Admin creds are injected from Vault (secrets/minio/admin). + minio: + endpoint: https://minio.contour.infra.sarex.tech + # In-cluster MinIO. Bucket + dedicated access user (access_key/secret_key). buckets: - name: test-bucket diff --git a/live/s3/terragrunt.hcl b/live/s3/terragrunt.hcl index e67ea8a..03803ef 100644 --- a/live/s3/terragrunt.hcl +++ b/live/s3/terragrunt.hcl @@ -45,4 +45,9 @@ terraform { inputs = { buckets = try(local.env_config.buckets, []) + + # MinIO endpoint is declarative (infrastructure.yaml); admin creds come from Vault. + minio_endpoint = try(local.env_config.minio.endpoint, "http://minio.minio.svc.cluster.local:9000") + minio_user = get_env("MINIO_ADMIN_USER", "") + minio_password = get_env("MINIO_ADMIN_PASSWORD", "") } diff --git a/live/secrets/terragrunt.hcl b/live/secrets/terragrunt.hcl index efd1b84..baa16cb 100644 --- a/live/secrets/terragrunt.hcl +++ b/live/secrets/terragrunt.hcl @@ -122,7 +122,7 @@ inputs = { # In-cluster constants (contour). No managed-YC CA; in-cluster pgbouncer/pg on 5432. constants = { - s3_endpoint = get_env("MINIO_PUBLIC_ENDPOINT", "http://minio.minio.svc.cluster.local:9000") + s3_endpoint = try(local.infra_config.environments[local.env_name].minio.endpoint, "http://minio.minio.svc.cluster.local:9000") postgres_port = "5432" postgres_ca = "" valkey_port = "6379" diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl index bb4cd4d..500a03e 100644 --- a/live/terragrunt.hcl +++ b/live/terragrunt.hcl @@ -94,12 +94,8 @@ provider "kafka" { # RabbitMQ provider is configured INSIDE modules/rabbitmq (from its management_* # inputs), so it is intentionally NOT generated here to avoid a duplicate config. -# In-cluster MinIO S3 API. Admin from Vault secrets/minio/admin. -provider "minio" { - minio_server = "${get_env("MINIO_ENDPOINT", "minio.minio.svc.cluster.local:9000")}" - minio_user = "${get_env("MINIO_ADMIN_USER", "")}" - minio_password = "${get_env("MINIO_ADMIN_PASSWORD", "")}" - minio_ssl = false -} +# MinIO provider is configured INSIDE modules/minio-buckets (endpoint from +# infrastructure.yaml, admin creds from Vault via the s3 unit), so it is not +# generated here. EOF_PROVIDER } diff --git a/modules/minio-buckets/main.tf b/modules/minio-buckets/main.tf index c0133e7..43ca05a 100644 --- a/modules/minio-buckets/main.tf +++ b/modules/minio-buckets/main.tf @@ -1,3 +1,18 @@ +# Self-configured MinIO provider (like modules/rabbitmq): the endpoint comes from +# infrastructure.yaml, so the host is declarative; admin creds are injected from +# Vault via the s3 unit. Scheme in minio_endpoint decides TLS. +locals { + minio_ssl = can(regex("^https://", var.minio_endpoint)) + minio_server = replace(replace(trimsuffix(var.minio_endpoint, "/"), "https://", ""), "http://", "") +} + +provider "minio" { + minio_server = local.minio_server + minio_user = var.minio_user + minio_password = var.minio_password + minio_ssl = local.minio_ssl +} + # In-cluster MinIO implementation of the `buckets` entity contract. Per bucket: # create the bucket, a dedicated access user (access_key/secret_key) and a policy # granting that user full access to only its bucket — mirroring yc-s3, which @@ -63,6 +78,6 @@ resource "minio_iam_policy" "this" { resource "minio_iam_user_policy_attachment" "this" { for_each = local.buckets_map - user_name = minio_iam_user.this[each.key].name + user_name = minio_iam_user.this[each.key].name policy_name = minio_iam_policy.this[each.key].name } diff --git a/modules/minio-buckets/variables.tf b/modules/minio-buckets/variables.tf index 8bf6594..93591ac 100644 --- a/modules/minio-buckets/variables.tf +++ b/modules/minio-buckets/variables.tf @@ -28,3 +28,21 @@ variable "user_suffix" { type = string default = "-sa" } + +variable "minio_endpoint" { + description = "MinIO S3 endpoint URL (scheme decides ssl). E.g. https://minio.contour.infra.sarex.tech" + type = string +} + +variable "minio_user" { + description = "MinIO admin access key." + type = string + default = "" +} + +variable "minio_password" { + description = "MinIO admin secret key." + type = string + default = "" + sensitive = true +} diff --git a/scripts/load_admin_creds.sh b/scripts/load_admin_creds.sh index 1521b28..4dcf1f3 100755 --- a/scripts/load_admin_creds.sh +++ b/scripts/load_admin_creds.sh @@ -12,7 +12,7 @@ set -eu _kv() { # $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error - _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" || echo 000) + _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1") || true if [ "$_code" != "200" ]; then echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2 printf ''