Add platform infrastructure configuration

services/minio-aistor/profiles/admin-oidc/README.md

@@ -0,0 +1,16 @@
+# AIStor Console OIDC 프로필
+
+기존 ObjectStore baseline은 그대로 두고 다음 항목만 추가합니다.
+
+- storage-admin.learn.hyeonworks.com Console Ingress
+- Keycloak 표준 OIDC 환경 변수와 policy claim
+- Traefik의 Console 접근과 Keycloak HTTPS egress
+
+S3 API Service에는 Ingress를 만들지 않습니다. aistor-keycloak-oidc
+Secret의 client-id, client-secret 값은 적용 스크립트가 만들며 Git에
+저장하지 않습니다. 기존 root 계정은 비상용으로 유지합니다.
+
+`MINIO_IDENTITY_OPENID_VENDOR=keycloak`은 사용하지 않습니다. 이 옵션은
+AIStor가 Keycloak Admin API로 사용자를 추가 검증할 때 admin URL, realm과
+service-account 권한을 요구합니다. 이 프로필은 Keycloak이 발급한 `policy`
+claim을 표준 OIDC로 소비하므로 불필요한 Admin API 권한을 부여하지 않습니다.

services/minio-aistor/profiles/admin-oidc/console-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-aistor-console
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/name: minio-aistor
+    app.kubernetes.io/component: admin-console
+    app.kubernetes.io/part-of: platform
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: storage-admin.learn.hyeonworks.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: minio-aistor-console
+                port:
+                  number: 9090

services/minio-aistor/profiles/admin-oidc/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base/deployment
+  - console-ingress.yaml
+  - network-policies.yaml
+
+patches:
+  - path: objectstore-oidc-patch.yaml
+    target:
+      group: aistor.min.io
+      version: v1
+      kind: ObjectStore
+      name: minio-aistor

services/minio-aistor/profiles/admin-oidc/network-policies.yaml

@@ -0,0 +1,101 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: object-storage-allow-traefik-console
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/component: admin-console
+spec:
+  podSelector:
+    matchLabels:
+      aistor.min.io/objectStore: minio-aistor
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 9090
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: object-storage-allow-host-nginx-keycloak
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/component: oidc-client
+spec:
+  podSelector:
+    matchLabels:
+      aistor.min.io/objectStore: minio-aistor
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 192.168.0.107/32
+      ports:
+        - protocol: TCP
+          port: 443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: object-storage-allow-blackbox-console-health
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/component: admin-console
+spec:
+  podSelector:
+    matchLabels:
+      aistor.min.io/objectStore: minio-aistor
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: observability
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus-blackbox-exporter
+              app.kubernetes.io/instance: blackbox-exporter
+      ports:
+        - protocol: TCP
+          port: 9090
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: object-storage-allow-prometheus-metrics
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/component: object-storage-metrics
+spec:
+  podSelector:
+    matchLabels:
+      aistor.min.io/objectStore: minio-aistor
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: observability
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+              app.kubernetes.io/instance: observability-core-kube-pr-prometheus
+      ports:
+        - protocol: TCP
+          port: 9000

services/minio-aistor/profiles/admin-oidc/objectstore-oidc-patch.yaml

@@ -0,0 +1,32 @@
+apiVersion: aistor.min.io/v1
+kind: ObjectStore
+metadata:
+  name: minio-aistor
+spec:
+  env:
+    - name: MINIO_PROMETHEUS_AUTH_TYPE
+      value: public
+    - name: MINIO_BROWSER_REDIRECT_URL
+      value: https://storage-admin.learn.hyeonworks.com
+    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+      value: https://id.learn.hyeonworks.com/realms/hyeonworks/.well-known/openid-configuration
+    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+      valueFrom:
+        secretKeyRef:
+          name: aistor-keycloak-oidc
+          key: client-id
+    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: aistor-keycloak-oidc
+          key: client-secret
+    - name: MINIO_IDENTITY_OPENID_SCOPES
+      value: openid,profile,email
+    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+      value: Hyeonworks ID
+    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+      value: policy
+    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC
+      value: "on"
+    - name: MINIO_BROWSER_SESSION_DURATION
+      value: 8h