k8s/roles/logging/tasks/minio-user.yml

---
- name: MinIO | Get MinIO pod name
  ansible.builtin.command: >
    kubectl get pod -n minio -l app=minio
    -o jsonpath='{.items[0].metadata.name}'    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _minio_pod
  changed_when: false

- name: MinIO | Get root user from secret
  ansible.builtin.command: >
    kubectl get secret minio-root-credentials -n minio
    -o jsonpath='{.data.rootUser}'    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _minio_root_user_b64
  changed_when: false
  no_log: true

- name: MinIO | Get root password from secret
  ansible.builtin.command: >
    kubectl get secret minio-root-credentials -n minio
    -o jsonpath='{.data.rootPassword}'    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _minio_root_pass_b64
  changed_when: false
  no_log: true

- name: MinIO | Set mc alias with root credentials
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc alias set local http://localhost:9000
    {{ _minio_root_user_b64.stdout | b64decode }}
    {{ _minio_root_pass_b64.stdout | b64decode }}    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  changed_when: false
  no_log: true

- name: MinIO | Create loki-chunks bucket
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc mb --ignore-existing local/{{ loki_minio_bucket }}    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _mb_result
  changed_when: "'Bucket created' in _mb_result.stdout"

- name: MinIO | Check if loki user exists
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc admin user info local {{ loki_minio_user }}    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _loki_user_check
  failed_when: false
  changed_when: false

- name: MinIO | Create loki user
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc admin user add local {{ loki_minio_user }} {{ loki_minio_password }}    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  when: _loki_user_check.rc != 0
  no_log: true

- name: MinIO | Check if loki policy exists
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc admin policy info local loki-policy    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _loki_policy_check
  failed_when: false
  changed_when: false

- name: MinIO | Create loki policy
  ansible.builtin.command: >
    kubectl exec -i -n minio {{ _minio_pod.stdout }} --
    mc admin policy create local loki-policy /dev/stdin    
  args:
    stdin: |
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "s3:GetObject", "s3:PutObject", "s3:DeleteObject",
              "s3:ListBucket", "s3:GetBucketLocation"
            ],
            "Resource": [
              "arn:aws:s3:::{{ loki_minio_bucket }}",
              "arn:aws:s3:::{{ loki_minio_bucket }}/*"
            ]
          }
        ]
      }      
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  when: _loki_policy_check.rc != 0

- name: MinIO | Attach loki policy to loki user
  ansible.builtin.command: >
    kubectl exec -n minio {{ _minio_pod.stdout }} --
    mc admin policy attach local loki-policy --user {{ loki_minio_user }}    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _attach_result
  failed_when: >
    _attach_result.rc != 0 and
    'already attached' not in (_attach_result.stderr | lower) and
    'already attached' not in (_attach_result.stdout | lower)    
  changed_when: _attach_result.rc == 0

- name: MinIO | Build loki-minio-secret manifest
  ansible.builtin.command: >
    kubectl create secret generic {{ loki_minio_secret_name }}
    --from-literal=AWS_ACCESS_KEY_ID={{ loki_minio_user }}
    --from-literal=AWS_SECRET_ACCESS_KEY={{ loki_minio_password }}
    --namespace {{ logging_namespace }}
    --dry-run=client -o yaml    
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _loki_secret_manifest
  changed_when: false
  no_log: true

- name: MinIO | Apply loki-minio-secret
  ansible.builtin.command: kubectl apply -f -
  args:
    stdin: "{{ _loki_secret_manifest.stdout }}"
  environment:
    KUBECONFIG: "{{ logging_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _secret_apply
  changed_when: "'created' in _secret_apply.stdout or 'configured' in _secret_apply.stdout"
  no_log: true