payu / k8s-s3-operator Goto Github PK

In order to support security requirements, we need to make sure that when we create new service account we add this new service account that match to app and gives permission to bucket ,to the auth service (admission control)
Supported flows:

Create a new service account , authentication against the auth server, send post request with modify body define by configMap that will add the new service account to the auth serve

• Create IAM role for new bucker during creation time

In order to ensure a quick development life cycle, we need to build a proper local setup that must include the following:

• Local k8s cluster base on dockers that can be deployed on 1 click.
• Operator code change monitoring to automatically up & running new code changes (https://github.com/tilt-dev/tilt)
• Local aws mock environment that will respond the same as real aws api account
• Use kubebuilder (https://github.com/kubernetes-sigs/kubebuilder) for operator templating

The second part should be defined the right api for the s3 bucker CRD. The api should be as payU domain:
apiVersion: payu.com/v1

In order to support security requirements, we need to make sure that only the specific pod application can reach he's bucket and no other application. in order to do that we need to create/update the pod service account and attache it to the IAM role.

Supported flows:

1. Create a new service account for the application pod and attache it to the desired IAM role
2. Expand an existing service account and attache it to the desired IAM role.

• Add encryption option for bucket (optional, default is false)
• Create bucket if crd if not exists
• Update bucket props if changed
• Delete bucket (from aws) when s3-bucker crd is deleted

add ci workflow using github action,
the workflow will upload local env on the runner and run system and integration tests

Bug : deletion and update flow not validate the bucket manage by operator.

Add validation function that validate the bucket manage by the operator

When running

sh ./hack/scripts/runLocalEnv.sh

sh can't Interrupt the IMG & NAMESPACE variables because of spaces. need to use the sh script without spaces

Add system tests for happy flows:

1. Create bucket
2. put bucket data
3. fetch bucket data
4. delete bucket
5. update bucket

Update the README on how to run system tests locally

today status k8s bucket resource create even if the bucket didnt created at amazon.
future status - k8s bucket resource will reflect the status of the bucket in amazon