Skip to content

Commit 7ee9f7d

Browse files
colek42colek42
authored
Merge pull request #22 from testifysec/feat/customer-bucket-names
feat(helm): add customer-configurable S3 bucket names
2 parents 3db1efc + 6244be7 commit 7ee9f7d

File tree

4 files changed

+135
-1
lines changed

4 files changed

+135
-1
lines changed

‎charts/judge/README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,41 @@ judge-api:
234234
235235
**IMPORTANT**: You must create these IAM roles with appropriate S3, SNS, and SQS permissions. See [examples/terraform/aws/complete/](../../examples/terraform/aws/complete/) for complete infrastructure setup with Terraform.
236236
237+
#### Custom S3 Bucket Names
238+
239+
If you need to use existing S3 buckets or prefer custom bucket names instead of the default `{prefix}-{service}` pattern, you can override them using `global.buckets`:
240+
241+
```yaml
242+
global:
243+
aws:
244+
prefix: "demo-judge" # Still used for IAM roles, SNS/SQS
245+
246+
# Override S3 bucket names (optional)
247+
buckets:
248+
judgeApi: "my-company-artifacts" # Instead of demo-judge-judge
249+
archivista: "my-company-attestations" # Instead of demo-judge-archivista
250+
```
251+
252+
**When to use custom bucket names:**
253+
- Using existing S3 buckets from prior deployments
254+
- Corporate naming standards require specific bucket names
255+
- Sharing buckets across multiple Judge deployments
256+
- Bucket names must meet specific compliance requirements
257+
258+
**Backward Compatibility:**
259+
- If `global.buckets.judgeApi` is empty or not defined, defaults to `{prefix}-judge`
260+
- If `global.buckets.archivista` is empty or not defined, defaults to `{prefix}-archivista`
261+
262+
**Example with mixed naming:**
263+
```yaml
264+
global:
265+
aws:
266+
prefix: "prod-judge"
267+
buckets:
268+
judgeApi: "corporate-compliance-artifacts-2024" # Custom name
269+
archivista: "" # Empty = use default: prod-judge-archivista
270+
```
271+
237272
### Database Architecture
238273

239274
**CRITICAL REQUIREMENT: Separate Databases Per Service**

‎charts/judge/templates/_helpers.tpl‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -414,15 +414,24 @@ arn:aws:iam::{{ include "judge.aws.accountId" . }}:role/{{ include "judge.aws.pr
414414

415415
{{/*
416416
AWS S3 Bucket Helpers
417-
Constructs: {prefix}-{service}
417+
Constructs: {prefix}-{service} or uses custom bucket name if provided
418+
Priority: global.buckets.{service} → {prefix}-{service}
418419
*/}}
419420
{{- define "judge.aws.s3.judgeApiBucket" -}}
421+
{{- if and .Values.global.buckets .Values.global.buckets.judgeApi -}}
422+
{{ .Values.global.buckets.judgeApi }}
423+
{{- else -}}
420424
{{ include "judge.aws.prefix" . }}-judge
421425
{{- end -}}
426+
{{- end -}}
422427

423428
{{- define "judge.aws.s3.archivistaBucket" -}}
429+
{{- if and .Values.global.buckets .Values.global.buckets.archivista -}}
430+
{{ .Values.global.buckets.archivista }}
431+
{{- else -}}
424432
{{ include "judge.aws.prefix" . }}-archivista
425433
{{- end -}}
434+
{{- end -}}
426435

427436
{{/*
428437
AWS SNS/SQS Helpers

‎charts/judge/tests/custom-bucket-names_test.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
suite: Custom S3 Bucket Names
2+
templates:
3+
- ../charts/judge-api/templates/deployment.yaml
4+
- ../charts/archivista/templates/deployment.yaml
5+
6+
tests:
7+
# ============================================================================
8+
# JUDGE-API BUCKET OVERRIDE TESTS
9+
# ============================================================================
10+
11+
- it: should use default judge-api bucket name when no override provided
12+
template: ../charts/judge-api/templates/deployment.yaml
13+
set:
14+
global.aws.enabled: true
15+
global.aws.prefix: demo-judge
16+
global.mode: aws
17+
asserts:
18+
- equal:
19+
path: spec.template.spec.containers[0].env[?(@.name=="BLOB_STORE_BUCKET_NAME")].value
20+
value: demo-judge-judge
21+
22+
- it: should use custom judge-api bucket name when override provided
23+
template: ../charts/judge-api/templates/deployment.yaml
24+
set:
25+
global.aws.enabled: true
26+
global.aws.prefix: demo-judge
27+
global.mode: aws
28+
global.buckets.judgeApi: my-company-artifacts
29+
asserts:
30+
- equal:
31+
path: spec.template.spec.containers[0].env[?(@.name=="BLOB_STORE_BUCKET_NAME")].value
32+
value: my-company-artifacts
33+
34+
# ============================================================================
35+
# ARCHIVISTA BUCKET OVERRIDE TESTS
36+
# ============================================================================
37+
38+
- it: should use default archivista bucket name when no override provided
39+
template: ../charts/archivista/templates/deployment.yaml
40+
set:
41+
global.aws.enabled: true
42+
global.aws.prefix: demo-judge
43+
global.mode: aws
44+
asserts:
45+
- equal:
46+
path: spec.template.spec.containers[0].env[?(@.name=="ARCHIVISTA_BLOB_STORE_BUCKET_NAME")].value
47+
value: demo-judge-archivista
48+
49+
- it: should use custom archivista bucket name when override provided
50+
template: ../charts/archivista/templates/deployment.yaml
51+
set:
52+
global.aws.enabled: true
53+
global.aws.prefix: demo-judge
54+
global.mode: aws
55+
global.buckets.archivista: my-company-attestations
56+
asserts:
57+
- equal:
58+
path: spec.template.spec.containers[0].env[?(@.name=="ARCHIVISTA_BLOB_STORE_BUCKET_NAME")].value
59+
value: my-company-attestations
60+
61+
# ============================================================================
62+
# BACKWARD COMPATIBILITY TEST
63+
# ============================================================================
64+
65+
- it: should work when global.buckets is not defined at all
66+
template: ../charts/judge-api/templates/deployment.yaml
67+
set:
68+
global.aws.enabled: true
69+
global.aws.prefix: demo-judge
70+
global.mode: aws
71+
asserts:
72+
- equal:
73+
path: spec.template.spec.containers[0].env[?(@.name=="BLOB_STORE_BUCKET_NAME")].value
74+
value: demo-judge-judge

‎charts/judge/values.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,22 @@ global:
209209
archivista: "" # Leave empty to use computed name from release
210210
kratos: "" # Leave empty to use computed name from release
211211

212+
# S3 Bucket Name Overrides
213+
# Allows customers to specify custom bucket names instead of the default {prefix}-{service} pattern
214+
#
215+
# Precedence order (highest to lowest):
216+
# 1. Custom bucket name (e.g., global.buckets.judgeApi)
217+
# 2. Default pattern (e.g., {aws.prefix}-judge)
218+
#
219+
# Example with custom buckets:
220+
# buckets:
221+
# judgeApi: "my-company-artifacts"
222+
# archivista: "my-company-attestations"
223+
#
224+
# If empty, uses default pattern: {aws.prefix}-judge and {aws.prefix}-archivista
225+
buckets:
226+
judgeApi: "" # Override default: {aws.prefix}-judge
227+
archivista: "" # Override default: {aws.prefix}-archivista
212228
# Manual secret configuration (when provider is not "vault")
213229
manual:
214230
judgeApi:

0 commit comments

Comments
 (0)