Provision access keys via CRD and helm chart

[abelfodil]

Is your feature request related to a problem? Please describe.

I want to be able to provision access keys from the helm chart and CRD spec such that all options are made available:

1. Access key
2. Secret key
3. Policy
4. Expiry
5. Name
6. Description
7. Comments

This allows me to leverage GitOps practices to their full extent and avoid manual steps to provide applications access to buckets.

Describe the solution you'd like
I should be able to pass a secret for the access and secret keys such that other applications can also access the secret.

Secret generation can be done later, if at all, because existing solutions such as https://external-secrets.io can help generate secrets anyway.

Describe alternatives you've considered
The only alternative I have right now is to manually create the access keys via the UI, which again requires a manual step for these service accounts.

Additional context
N/A

[centaurea-riba]

Im not a maintainer of that operator, but in our team we use k8s Job with MinIO CLI, which can do all that stuff. Maintainers mentions in previous tickets that they not want add CRDs for that operations

[abelfodil]

@centaurea-riba is your team's code open source, or would they be willing to open source it?

[centaurea-riba]

@centaurea-riba is your team's code open source, or would they be willing to open source it?

No, but it just simple k8s Job like that:

apiVersion: batch/v1
kind: Job
metadata:
  name: minio-configurations-{{ now | date "150405" }} # 150405 is a HourMinuteSecond
spec:
  template:
    spec:
      restartPolicy: Never

      
      volumes:
      - name: test-policy
        configMap:
          name: test-policy
          items:
          - key: policy.json
            path: policy.json
      - name: loki-policy
        configMap:
          name: loki-policy
          items:
          - key: policy.json
            path: policy.json
      - name: mimir-policy
        configMap:
          name: mimir-policy
          items:
          - key: policy.json
            path: policy.json

            
      containers:
      - name: minio-configurations
        image: {{ .Values.image }}
        envFrom:
        - secretRef:
            name: minio-all-credentials
        - secretRef:
            name: minio-test-credentials
        volumeMounts:
        - name: test-policy
          mountPath: /policy/test
          readOnly: true
        - name: loki-policy
          mountPath: /policy/loki
          readOnly: true
        - name: mimir-policy
          mountPath: /policy/mimir
          readOnly: true

          
        command: ["/bin/sh", "-c"]
        args:
        - |
          apk add minio-client
          mcli alias set minio-configurations $MINIO_ENDPOINT $ROOT_ACCESS_KEY $ROOT_SECRET_KEY
          mcli admin config set minio-configurations compression enable={{ .Values.compression.enable }} extensions={{ .Values.compression.extensions }} mime_types={{ .Values.compression.mimeTypes }}

          mcli mb minio-configurations/loki-chunks
          mcli mb minio-configurations/loki-ruler
          mcli mb minio-configurations/loki-admin
          
          mcli mb minio-configurations/mimir-data
          mcli mb minio-configurations/mimir-ruler
          mcli mb minio-configurations/mimir-test

          mcli mb minio-configurations/test-dynamic-bucket-provisioning

          set -e
          
          mcli admin policy create minio-configurations test-policy /policy/test/policy.json
          mcli admin user add minio-configurations $TEST_ACCESS_KEY $TEST_SECRET_KEY
          mcli admin policy attach minio-configurations test-policy --user $TEST_ACCESS_KEY

          mcli admin policy create minio-configurations loki-policy /policy/loki/policy.json
          mcli admin user add minio-configurations $LOKI_ACCESS_KEY $LOKI_SECRET_KEY
          mcli admin policy attach minio-configurations loki-policy --user $LOKI_ACCESS_KEY

          mcli admin policy create minio-configurations mimir-policy /policy/mimir/policy.json
          mcli admin user add minio-configurations $MIMIR_ACCESS_KEY $MIMIR_SECRET_KEY
          mcli admin policy attach minio-configurations mimir-policy --user $MIMIR_ACCESS_KEY

          mcli admin service restart minio-configurations --json --quiet