Policies do not support conditions about charts HOT 4 CLOSED

Hi @ammirator-administrator,

The "condition" section was not supported in the bitnami/minio chart.

I have created this PR (#25462) adding support for it, so please take a look and let me know if it works for your.

Some things to consider, I have to modify your values.yaml to match upstream JSON schema:

provisioning:
  enabled: true
  policies:
    - name: my-bucket-policy
      statements:
        - resources:
            - "arn:aws:s3:::my-bucket/*"
          effect: "Allow"
          actions:
            - "s3:GetObject"
          condition:
            StringLike:
                "aws:Referer":
                  - "https://localhost:3000/*"
                  - "http://localhost:3000/*"

Notes:

• I used condition not conditions.
• Format is object, not array.
• Removed : | string modifier.
• Keys containing special characters, such as aws:Referer must be quoted to prevent syntax errors.

from charts.

Is there any workaround to provide our own policy in a raw format at least?
If I create in a extra deployment a second config map but with correct policy will that be applied??

from charts.

I've tried to add a secondary configMap but it doesn't get applied by provisioning job, seems that only one within the chart itself is allowed

So there is no workaround for this

from charts.

Found a workaround, but is not the best and looks ungly, but at least it adds the Condition field to policy

  extraCommands:
    - |
      echo "-- Running extra commands"
    - |
      echo "-- Creating the policy /tmp/policy-$S3_BUCKET.json for $S3_BUCKET bucket"
    - |
      echo '{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "*","Action": "s3:GetObject","Resource": "arn:aws:s3:::$S3_BUCKET/*","Condition": {"StringLike": {"aws:Referer": ["https://localhost:3000/*","http://localhost:3000/*","https://my-syte.test/*","http://my-syte.test/*"]}}}]}' > /tmp/policy-$S3_BUCKET.json
    - |
      echo "-- Creating the policy in minio system for $S3_BUCKET Using same minioAlias as in the bitnami script 'provisioning'"
    - |
      mc anonymous set-json /tmp/policy-$S3_BUCKET.json provisioning/$S3_BUCKET

from charts.