Repository: minio/minio (language: go)

Issue:
Unable to bootstrap policies that contain special characters (: or /) from helm chart
<!--- Provide a general summary of the issue in the Title above -->

## Expected Behavior
<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->

Using the helm provided policy provisioning is possible with policies that include characters allowed by MinIO, but not Kubernetes ConfigMap keys.

Here's a sample yaml snippet (that would go in a `values.yaml` file for the helm chart):

```yaml
policies:
  - name: foo:admins # GitHub OIDC login
    statements:
      - actions:
          - "admin:*"
      - actions:
          - "s3:*"
        resources: 
          - 'arn:aws:s3:::*'
  - name: foo/admins # Gitlab OIDC login
    statements:
      - actions:
          - "admin:*"
      - actions:
          - "s3:*"
        resources: 
          - 'arn:aws:s3:::*'
```

## Current Behavior
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->

Policy names must abide by the Kubernetes ConfigMap naming requirements. This is because `<policy>.json` gets created as a temporary file to pass to the "create policy job".

## Possible Solution
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->
Since we don't need these files and they're really only being used as temporary storage we can use the policy index to manage them uniquely. I was able to get going (in a backward compatible way, no changes to the values files) with this patch:

```patch
diff --git a/helm/minio/templates/_helper_create_policy.txt b/helm/minio/templates/_helper_create_policy.txt
--- a/helm/minio/templates/_helper_create_policy.txt
+++ b/helm/minio/templates/_helper_create_policy.txt
@@ -43,17 +43,19 @@ checkPolicyExists() {
   return $?
 }

-# createPolicy($name)
+# createPolicy($name, $filename)
 createPolicy () {
   NAME=$1
+  FILENAME=$2

   # Create the name if it does not exist
+  echo "Checking policy: $NAME (in /config/$FILENAME.json)"
   if ! checkPolicyExists $NAME ; then
     echo "Creating policy '$NAME'"
   else
     echo "Policy '$NAME' already exists."
   fi
-  ${MC} admin policy add myminio $NAME /config/$NAME.json
+  ${MC} admin policy add myminio $NAME /config/$FILENAME.json

 }

@@ -67,7 +69,7 @@ connectToMinio $scheme

 {{ if .Values.policies }}
 # Create the policies
-{{- range .Values.policies }}
-createPolicy {{ .name }}
+{{- range $idx, $policy := .Values.policies }}
+createPolicy {{ $policy.name }} policy_{{ $idx }}
 {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/helm/minio/templates/configmap.yaml b/helm/minio/templates/configmap.yaml
--- a/helm/minio/templates/configmap.yaml
+++ b/helm/minio/templates/configmap.yaml
@@ -15,8 +15,9 @@ data:
 {{ include (print $.Template.BasePath "/_helper_create_user.txt") . | indent 4 }}
   add-policy: |-
 {{ include (print $.Template.BasePath "/_helper_create_policy.txt") . | indent 4 }}
-{{- range .Values.policies }}
-  {{ .name }}.json: |-
+{{- range $idx, $policy := .Values.policies }}
+  # {{ $policy.name }}
+  policy_{{ $idx }}.json: |-
 {{ include (print $.Template.BasePath "/_helper_policy.tpl") . | indent 4 }}
 {{ end }}
   custom-command: |-
```

I'm willing to open a PR, unless there's something I missed and this patch isn't required (aka "user error").

NOTE: There are a few more bits I'm actually working on with the template (to make it prettier for helm diff and allow resourceless perms (which are allowed in policies but error if the resource is nil)

## Steps to Reproduce (for bugs)
<!--- Provide a link to a live example, or an unambiguous set of steps to -->
<!--- reproduce this bug. Include code to reproduce, if relevant -->
<!--- and make sure you have followed https://github.com/minio/minio/tree/release/docs/debugging to capture relevant logs -->

1. Create a values file like so:
   ```yaml
   policies:
     - name: foo:admins # GitHub OIDC login
       statements:
         - actions:
             - "admin:*"
         - actions:
             - "s3:*"
           resources: 
             - 'arn:aws:s3:::*'
     - name: foo/admins # Gitlab OIDC login
       statements:
         - actions:
             - "admin:*"
         - actions:
             - "s3:*"
           resources: 
             - 'arn:aws:s3:::*'
   ```
2. Run `help install -f my-values.yaml minio minio/minio`
3. Receive this error:
   ```
   Error: UPGRADE FAILED: cannot patch "minio" with kind ConfigMap: ConfigMap "minio" is invalid:
   [data[foo/admins.json]: Invalid value: "foo/admins.json": a valid config key must consist of alphanumeric
   characters, '-', '_' or '.' (e.g. 'key.name',  or 'KEY_NAME',  or 'key-name', regex used for validation is
   '[-._a-zA-Z0-9]+'), data[foo:admins.json]: Invalid value: "foo:admins.json": a valid config key must consist
   of alphanumeric characters, '-', '_' or '.' (e.g. 'key.name',  or 'KEY_NAME',  or 'key-name', regex used for
   validation is '[-._a-zA-Z0-9]+')]
   ```

## Context
<!--- How has this issue affected you? What are you trying to accomplish? -->
<!--- Providing context helps us come up with a solution that is most useful in the real world -->
I'm trying to use the provided [helm chart](https://github.com/minio/minio/tree/master/helm/minio) to perform automated policy provisioning with policies that contain both `:` characters and `/` characters. This is because my upstream providers (github and gitlab) inclue these in the groups claim.

## Regression
<!-- Is this issue a regression? (Yes / No) -->
<!-- If Yes, optionally please include minio version or commit id or PR# that caused this regression, if you have these details. -->
No

## Your Environment
<!--- Include as many relevant details about the environment you experienced the bug in -->
* Version used (`minio --version`):
* Server setup and configuration: 4x pods provisioned via Helm chart
* Operating System and version (`uname -a`): Kubernetes



Discussion / hints:
Yes don't do it. Policies with / are not supported and also with : 

Just use underscore or hyphen.
Also please send a PR you don't have to open an issue - if you have a fix.  We accept PRs at warp speed.
Hi @harshavardhana! It appears the policy works totally fine in MinIO with a `/`. The only issue was that the helm chart bootstrap didn't.

Should it not?

```
mc admin policy list minio --json
{
 "status": "success",
 "policy": "consoleAdmin",
 "isGroup": false
}
{
 "status": "success",
 "policy": "diagnostics",
 "isGroup": false
}
{
 "status": "success",
 "policy": "readonly",
 "isGroup": false
}
{
 "status": "success",
 "policy": "readwrite",
 "isGroup": false
}
{
 "status": "success",
 "policy": "foo/admins",
 "isGroup": false
}
{
 "status": "success",
 "policy": "foo:admins",
 "isGroup": false
}
{
 "status": "success",
 "policy": "writeonly",
 "isGroup": false
}
```

![image](https://user-images.githubusercontent.com/72811/154827046-81b85091-7601-47fc-81ae-57dc9fb5da43.png)

I'll send a PR and link to this issue, but I'm curious about policies with a `/` in the name. I'll investigate using dex (or some other way) to transform the claims that have a `/` in them!

EDIT: I should note I can login with my Gitlab IdP (via Dex) and the claims with a `/` work there too and I am correctly granted my privs.

Fix patch:
diff --git a/helm/minio/templates/_helper_create_policy.txt b/helm/minio/templates/_helper_create_policy.txt
index e5f2edb6a7b06..d565b161e35d6 100644
--- a/helm/minio/templates/_helper_create_policy.txt
+++ b/helm/minio/templates/_helper_create_policy.txt
@@ -43,17 +43,19 @@ checkPolicyExists() {
   return $?
 }
 
-# createPolicy($name)
+# createPolicy($name, $filename)
 createPolicy () {
   NAME=$1
+  FILENAME=$2
 
   # Create the name if it does not exist
+  echo "Checking policy: $NAME (in /config/$FILENAME.json)"
   if ! checkPolicyExists $NAME ; then
     echo "Creating policy '$NAME'"
   else
     echo "Policy '$NAME' already exists."
   fi
-  ${MC} admin policy add myminio $NAME /config/$NAME.json
+  ${MC} admin policy add myminio $NAME /config/$FILENAME.json
 
 }
 
@@ -67,7 +69,7 @@ connectToMinio $scheme
 
 {{ if .Values.policies }}
 # Create the policies
-{{- range .Values.policies }}
-createPolicy {{ .name }}
+{{- range $idx, $policy := .Values.policies }}
+createPolicy {{ $policy.name }} policy_{{ $idx }}
 {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/helm/minio/templates/configmap.yaml b/helm/minio/templates/configmap.yaml
index 29fc70540f9ba..95a7c6038a3ec 100644
--- a/helm/minio/templates/configmap.yaml
+++ b/helm/minio/templates/configmap.yaml
@@ -15,8 +15,9 @@ data:
 {{ include (print $.Template.BasePath "/_helper_create_user.txt") . | indent 4 }}
   add-policy: |-
 {{ include (print $.Template.BasePath "/_helper_create_policy.txt") . | indent 4 }}
-{{- range .Values.policies }}
-  {{ .name }}.json: |-
+{{- range $idx, $policy := .Values.policies }}
+  # {{ $policy.name }}
+  policy_{{ $idx }}.json: |-
 {{ include (print $.Template.BasePath "/_helper_policy.tpl") . | indent 4 }}
 {{ end }}
   custom-command: |-


Test patch: