++

apps/django/base/kustomization.yaml

@@ -16,3 +16,5 @@ resources:
   - nginx-configmap.yaml
   - uwsgi-configmap.yaml
   - zitadel-configmap.yaml
+  - s3-proxy-service.yaml
+  - s3-proxy.yaml

apps/django/base/s3-proxy-service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3-proxy-svc
+  namespace: django
+spec:
+  type: ClusterIP
+  selector:
+    app: s3-proxy
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP

apps/django/base/s3-proxy.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: s3-proxy
+  namespace: django
+  labels:
+    app: s3-proxy
+
+spec:
+  replicas: 1
+
+  selector:
+    matchLabels:
+      app: s3-proxy
+
+  template:
+    metadata:
+      labels:
+        app: s3-proxy
+      annotations:
+        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/auth-path: auth/kubernetes
+        vault.hashicorp.com/role: sarex-prod
+
+        vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django
+
+        vault.hashicorp.com/agent-inject-template-s3: |
+          {{- with secret "secrets/data/minio/apps/django" }}
+          AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
+          {{- $buckets := index .Data.data "buckets" }}
+          AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          {{- end }}
+
+    spec:
+      serviceAccountName: sarex-prod-vault
+
+      containers:
+        - name: s3-proxy
+          image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          imagePullPolicy: Always
+
+          command:
+            - /bin/sh
+            - -ec
+
+          args:
+            - |
+              set -a
+              [ -f /vault/secrets/s3 ] && . /vault/secrets/s3
+              set +a
+
+              exec /docker-entrypoint.sh
+
+          ports:
+            - name: http
+              containerPort: 80
+
+          env:
+            - name: ACCESS_LOG
+              value: "true"
+
+            - name: CORS_ALLOW_HEADERS
+              value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"