From 925310b439785bab8fe422d90f66a6978e34927f Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Wed, 8 Jul 2026 14:41:54 +0500
Subject: [PATCH] ++

---
 apps/django/base/kustomization.yaml    |  2 +
 apps/django/base/s3-proxy-service.yaml | 15 ++++++
 apps/django/base/s3-proxy.yaml         | 69 ++++++++++++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 apps/django/base/s3-proxy-service.yaml
 create mode 100644 apps/django/base/s3-proxy.yaml

diff --git a/apps/django/base/kustomization.yaml b/apps/django/base/kustomization.yaml
index d377b98..5507f04 100644
--- a/apps/django/base/kustomization.yaml
+++ b/apps/django/base/kustomization.yaml
@@ -16,3 +16,5 @@ resources:
   - nginx-configmap.yaml
   - uwsgi-configmap.yaml
   - zitadel-configmap.yaml
+  - s3-proxy-service.yaml
+  - s3-proxy.yaml
diff --git a/apps/django/base/s3-proxy-service.yaml b/apps/django/base/s3-proxy-service.yaml
new file mode 100644
index 0000000..cc2290c
--- /dev/null
+++ b/apps/django/base/s3-proxy-service.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3-proxy-svc
+  namespace: django
+spec:
+  type: ClusterIP
+  selector:
+    app: s3-proxy
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
diff --git a/apps/django/base/s3-proxy.yaml b/apps/django/base/s3-proxy.yaml
new file mode 100644
index 0000000..3ffa1ad
--- /dev/null
+++ b/apps/django/base/s3-proxy.yaml
@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: s3-proxy
+  namespace: django
+  labels:
+    app: s3-proxy
+
+spec:
+  replicas: 1
+
+  selector:
+    matchLabels:
+      app: s3-proxy
+
+  template:
+    metadata:
+      labels:
+        app: s3-proxy
+      annotations:
+        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/auth-path: auth/kubernetes
+        vault.hashicorp.com/role: sarex-prod
+
+        vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django
+
+        vault.hashicorp.com/agent-inject-template-s3: |
+          {{- with secret "secrets/data/minio/apps/django" }}
+          AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
+          {{- $buckets := index .Data.data "buckets" }}
+          AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          {{- end }}
+
+    spec:
+      serviceAccountName: sarex-prod-vault
+
+      containers:
+        - name: s3-proxy
+          image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          imagePullPolicy: Always
+
+          command:
+            - /bin/sh
+            - -ec
+
+          args:
+            - |
+              set -a
+              [ -f /vault/secrets/s3 ] && . /vault/secrets/s3
+              set +a
+
+              exec /docker-entrypoint.sh
+
+          ports:
+            - name: http
+              containerPort: 80
+
+          env:
+            - name: ACCESS_LOG
+              value: "true"
+
+            - name: CORS_ALLOW_HEADERS
+              value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
\ No newline at end of file