Package: minio-manager
minio-managerDeclare what MinIO buckets, IAM policies, ILM policies you want, and let MinIO Manager do the work.GitHub repository:https://github.com/alveel/minio-manager/Documentationhttps://alveel.github.io/minio-manager/DescriptionThe concept for management is to have so-called "bucket groups".Each bucket group is managed by an account that only has access to buckets in that group.It should be noted that this is explicitly intended for thecreation and updating of resources in MinIO. It doesnotdelete any resources anywhere.RequirementsPython(3.9 or newer)PDMMinIO ClientGetting started with your projectInstall the environment and the pre-commit hooks withmakeinstallYou are now ready to start development on your project! The CI/CD
pipeline will be triggered when you open a pull request, merge to main,
or when you create a new release.To finalize the set-up for publishing to PyPi or Artifactory, seehere.
For activating the automatic documentation with MkDocs, seehere.
To enable the code coverage reports, seehere.Releasing a new versionSet upAn admin user should be used for these steps.Create the bucket for the secret backendminio-manager-secretsmc mb $ALIAS/minio-manager-secretsCreate a user (either in MinIO or your identity provider)You can usemc admin user add $ALIAS minio-managerfor a MinIO userCreate a policy that gives read/write access to the bucket for the secret backendYou can use the example provided in theexamplesdirectory:mc admin policy create $ALIAS minio-manager examples/minio-manager-secrets-policy.jsonAttach the policy to the user:For MinIO:mc admin policy attach $ALIAS minio-manager --user=minio-managerFor LDAP:mc idp ldap policy attach $ALIAS minio-manager --user='uid=minio-manager,cn=users,dc=your,dc=domain'Upload your secret backend (e.g.secrets.kdbx) to the bucket rootCreate a MinIO service account/access key with either option:mc admin user svcacct add $ALIAS minio-managerand note down the access and secret keysCopy.env.exampleto.envand set the following variables to the obtained keysMINIO_MANAGER_SECRET_BACKEND_S3_ACCESS_KEYMINIO_MANAGER_SECRET_BACKEND_S3_SECRET_KEYConfigure the other variables in the.envfile. Descriptions of each variable can be found in theEnvironment variablessectionEach "bucket group" manager user must get its own policy.You can find an example inexamples/bucket-group-user-policy.jsonmc admin policy create $ALIAS infra-test-manager examples/bucket-group-user-policy.jsonmc idp ldap policy attach $ALIAS infra-test-manager --user='uid=infra-test-manager,cn=users,dc=your,dc=domain'You can then log in to the web console with this user to create an access key exactly like how we did it previouslyMinIOAt least two users are required in MinIO. One with access to a single bucket containing the secret backend, all other
users are to be used as "bucket group" managers. For each bucket created under this manager user a service account
(or access key in S3/MinIO terms) will be created.Secret backendKeepassThe Keepass database's root group must be named "Passwords".You must have a group called "s3" and subgroups with the name of each MinIO cluster.Entry names must be unique.Entries are found by way of the title of the entry, the username is not considered when searching.Environment variablesRequiredMINIO_MANAGER_CLUSTER_NAMEThe name of the cluster, used for example in the secret backendMINIO_MANAGER_S3_ENDPOINTWhat host:port to use as MinIO/S3 endpointMINIO_MANAGER_MINIO_CONTROLLER_USERThe entry of the MinIO controller user in the secret backend that contains its access and secret keysMINIO_MANAGER_SECRET_BACKEND_TYPEWhat secret backend to use. Currently only keepass is supportedMINIO_MANAGER_SECRET_BACKEND_S3_ACCESS_KEYThe access key to the S3 bucket where the secret database is storedMINIO_MANAGER_SECRET_BACKEND_S3_SECRET_KEYThe secret key to the S3 bucket where the secret database is storedRequired for KeepassMINIO_MANAGER_KEEPASS_PASSWORDKeepass database passwordOptionalMINIO_MANAGER_CLUSTER_RESOURCES_FILEThe YAML file with the MinIO resource configuration (buckets, policies, etc.), defaults toresources.yamlMINIO_MANAGER_MINIO_ENDPOINT_SECUREWhether to use HTTPS for the endpoint. Defaults toTrueMINIO_MANAGER_SECRET_BACKEND_S3_BUCKETThe name of the bucket where the secret backend is kept. Defaults tominio-manager-secretsMINIO_MANAGER_KEEPASS_FILEThe name of the database file in the S3 bucket. Defaults tosecrets.kdbxMINIO_MANAGER_LOG_LEVELThe log level of the application. Defaults toINFO, may also useDEBUGMINIO_MANAGER_DEFAULT_BUCKET_VERSIONINGWhat bucket versioning level to use for all buckets by default if not specified on the bucket level. Defaults to "Suspended", can also configure "Enabled"MINIO_MANAGER_DEFAULT_LIFECYCLE_POLICYWhat lifecycle policy (inmc ilm exportformat) to attach to all buckets by defaultMINIO_MANAGER_DEFAULT_BUCKET_CREATE_SERVICE_ACCOUNTWhether to automatically create service accounts for each bucket with access to just that bucket. Defaults to FalseMINIO_MANAGER_SERVICE_ACCOUNT_POLICY_BASE_FILEWhat policy to use as a base for a service account when automatically generated, defaults toservice-account-policy-base.json. MUST contain BUCKET_NAME_REPLACE_ME in the resourcesTo do featuresCheck the openenhancementissues.Repository initiated withfpgmaas/cookiecutter-pdm.