refactor: 폴더 구조 변경

docs/examples/infra/minio.md

@@ -581,7 +581,7 @@ metadata:
   namespace: minio-prod
 type: Opaque
 stringData:
-  token: "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9..."
+  token: "<minio-prometheus-token>"
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -636,42 +636,31 @@ data:
     #!/bin/sh
     set -eu
 
-    mc alias set minio https://minio.minio-prod.svc.cluster.local "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" --api S3v4
+    mc --config-dir /tmp/mc alias import minio <<EOF
+    {
+      "url": "https://minio.minio-prod.svc.cluster.local",
+      "accessKey": "$MINIO_ROOT_USER",
+      "secretKey": "$MINIO_ROOT_PASSWORD",
+      "api": "s3v4",
+      "path": "auto"
+    }
+    EOF
 
     # Object Lock은 bucket 생성 시점에만 활성화 가능
-    mc mb --with-lock minio/critical-audit || true
-    mc retention set --default COMPLIANCE 2555d minio/critical-audit  # 7년 보관
+    mc --config-dir /tmp/mc mb --with-lock minio/critical-audit || true
+    mc --config-dir /tmp/mc retention set --default COMPLIANCE 2555d minio/critical-audit
 
     # Versioning + lifecycle
-    mc mb minio/app-data || true
-    mc version enable minio/app-data
-    mc ilm add --expire-noncurrent-days 90 minio/app-data
-    mc ilm add --expire-incomplete-upload-days 7 minio/app-data
+    mc --config-dir /tmp/mc mb minio/app-data || true
+    mc --config-dir /tmp/mc version enable minio/app-data
+    mc --config-dir /tmp/mc ilm add --expire-noncurrent-days 90 minio/app-data
+    mc --config-dir /tmp/mc ilm add --expire-incomplete-upload-days 7 minio/app-data
 
     # SSE-KMS 기본 적용
-    mc encrypt set sse-kms minio-app-key minio/app-data
-    mc encrypt set sse-kms minio-critical-key minio/critical-audit
-
-    # Service account 발급 (앱 전용, 최소 권한 policy)
-    mc admin policy create minio auth-server-rw /policies/auth-server-rw.json
-    mc admin user svcacct add minio "$MINIO_ROOT_USER" \
-      --access-key "$AUTH_SERVER_ACCESS_KEY" \
-      --secret-key "$AUTH_SERVER_SECRET_KEY" \
-      --policy /policies/auth-server-rw.json || true
+    mc --config-dir /tmp/mc encrypt set sse-kms minio-app-key minio/app-data
+    mc --config-dir /tmp/mc encrypt set sse-kms minio-critical-key minio/critical-audit
 
     echo "bootstrap complete"
-
-  auth-server-rw.json: |
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket"],
-          "Resource": ["arn:aws:s3:::app-data/*", "arn:aws:s3:::app-data"]
-        }
-      ]
-    }
 ---
 apiVersion: batch/v1
 kind: Job
@@ -703,21 +692,11 @@ spec:
                 secretKeyRef:
                   name: minio-root-creds
                   key: password
-            - name: AUTH_SERVER_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: auth-server-minio-svcacct
-                  key: access_key
-            - name: AUTH_SERVER_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: auth-server-minio-svcacct
-                  key: secret_key
           volumeMounts:
             - name: scripts
               mountPath: /scripts
-            - name: policies
-              mountPath: /policies
+            - name: tmp
+              mountPath: /tmp
           securityContext:
             runAsNonRoot: true
             runAsUser: 1000
@@ -734,12 +713,10 @@ spec:
             items:
               - key: init.sh
                 path: init.sh
-        - name: policies
-          configMap:
-            name: minio-bootstrap
-            items:
-              - key: auth-server-rw.json
-                path: auth-server-rw.json
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi
 ```
 
 **왜 좋은가:**
@@ -747,7 +724,8 @@ spec:
 - `mc mb --with-lock`은 bucket 생성 시점에만 Object Lock 활성화 가능 — Job이 그 타이밍을 보장
 - COMPLIANCE 모드 7년 retention = 감사/규제 요구 충족 (root도 bypass 불가)
 - `app-data` bucket은 versioning + lifecycle (90일 noncurrent expire + 7일 incomplete abort)
-- service account는 특정 bucket prefix만 접근 가능한 policy로 제한
+- 애플리케이션 access key 발급은 별도 bootstrap에서 inline 최소 권한 policy와
+  함께 수행하고, 생성 secret은 Vault로 직접 전달
 - `backoffLimit: 3` + idempotent 명령 (`|| true`) → 재실행 안전
 
 ---