s3-controller

A Kubernetes controller that manages S3 buckets and their associated credentials as custom resources (S3Bucket) using VersityGW as the S3 backend.

CRDs

The CRD is defined in crds/s3bucket.yaml:

• Group: s3.shivering-isles.com
• Kind: S3Bucket
• Plural: s3buckets
• Short names: s3b

Install it:

kubectl apply -f crds/

Examples

See examples/ for sample S3Bucket resources:

File	Policy	Use case
s3bucket-readwrite.yaml	readWrite	Application with full bucket access
s3bucket-readonly.yaml	readWritePublicRead	Public assets bucket
s3bucket-custom-policy.yaml	Custom JSON	Cross-user access

kubectl apply -f examples/s3bucket-readwrite.yaml

Functionality

• Creates S3 users and buckets on demand
• Manages bucket policies (read-write, read-write + public read, or custom S3 bucket policy JSON)
• Stores credentials in Kubernetes secrets
• Handles graceful deletion with exponential backoff for non-empty buckets
• Supports Delete and Retain deletion policies

Local development

# Run tests
go test -mod=vendor ./...

# Build binary
CGO_ENABLED=0 go build -mod=vendor -o s3-controller .

Required environment variables

Variable	Description
S3_ENDPOINT	S3 endpoint URL
S3_ACCESS_KEY	Admin access key
S3_SECRET_KEY	Admin secret key
S3_REGION	S3 region (default: us-east-1)

Deployment

Production Kubernetes manifests are maintained in the infrastructure-gitops repository under apps/base/s3-controller/. For local development, apply the CRDs and run the controller binary directly.