142 lines
3.4 KiB
YAML
142 lines
3.4 KiB
YAML
|
apiVersion: minio.min.io/v2
|
||
|
|
kind: Tenant
|
||
|
|
metadata:
|
||
|
|
name: minio-cluster
|
||
|
|
namespace: storage
|
||
|
|
labels:
|
||
|
|
app: minio
|
||
|
|
spec:
|
||
|
|
image: minio/minio:RELEASE.2024-06-13T20-48-48Z
|
||
|
|
|
||
|
|
credsSecret:
|
||
|
|
name: minio-creds
|
||
|
|
|
||
|
|
# 3-zone distributed cluster (one server per zone)
|
||
|
|
pools:
|
||
|
|
- name: az-a
|
||
|
|
servers: 1
|
||
|
|
volumesPerServer: 1
|
||
|
|
size: 100Gi
|
||
|
|
storageClass: longhorn
|
||
|
|
|
||
|
|
affinity:
|
||
|
|
nodeAffinity:
|
||
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
nodeSelectorTerms:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: topology.kubernetes.io/zone
|
||
|
|
operator: In
|
||
|
|
values: [az-a]
|
||
|
|
|
||
|
|
tolerations:
|
||
|
|
- key: node-role.kubernetes.io/control-plane
|
||
|
|
operator: Exists
|
||
|
|
effect: NoSchedule
|
||
|
|
|
||
|
|
volumeClaimTemplate:
|
||
|
|
metadata:
|
||
|
|
name: data
|
||
|
|
spec:
|
||
|
|
accessModes:
|
||
|
|
- ReadWriteOnce
|
||
|
|
storageClassName: longhorn
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
storage: 100Gi
|
||
|
|
|
||
|
|
- name: az-b
|
||
|
|
servers: 1
|
||
|
|
volumesPerServer: 1
|
||
|
|
size: 100Gi
|
||
|
|
storageClass: longhorn
|
||
|
|
|
||
|
|
affinity:
|
||
|
|
nodeAffinity:
|
||
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
nodeSelectorTerms:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: topology.kubernetes.io/zone
|
||
|
|
operator: In
|
||
|
|
values: [az-b]
|
||
|
|
|
||
|
|
volumeClaimTemplate:
|
||
|
|
metadata:
|
||
|
|
name: data
|
||
|
|
spec:
|
||
|
|
accessModes:
|
||
|
|
- ReadWriteOnce
|
||
|
|
storageClassName: longhorn
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
storage: 100Gi
|
||
|
|
|
||
|
|
- name: az-c
|
||
|
|
servers: 1
|
||
|
|
volumesPerServer: 1
|
||
|
|
size: 100Gi
|
||
|
|
storageClass: longhorn
|
||
|
|
|
||
|
|
affinity:
|
||
|
|
nodeAffinity:
|
||
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
nodeSelectorTerms:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: topology.kubernetes.io/zone
|
||
|
|
operator: In
|
||
|
|
values: [az-c]
|
||
|
|
|
||
|
|
volumeClaimTemplate:
|
||
|
|
metadata:
|
||
|
|
name: data
|
||
|
|
spec:
|
||
|
|
accessModes:
|
||
|
|
- ReadWriteOnce
|
||
|
|
storageClassName: longhorn
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
storage: 100Gi
|
||
|
|
|
||
|
|
# Console (web UI)
|
||
|
|
console:
|
||
|
|
image: minio/console:v0.30.0
|
||
|
|
replicas: 1
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 256Mi
|
||
|
|
limits:
|
||
|
|
cpu: 500m
|
||
|
|
memory: 512Mi
|
||
|
|
|
||
|
|
# Environment variables — OIDC config
|
||
|
|
env:
|
||
|
|
- name: MINIO_IDENTITY_OPENID_CONFIG_URL
|
||
|
|
value: "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
|
||
|
|
- name: MINIO_IDENTITY_OPENID_CLIENT_ID
|
||
|
|
value: "minio"
|
||
|
|
- name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: minio-oidc
|
||
|
|
key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
|
||
|
|
- name: MINIO_IDENTITY_OPENID_CLAIM_NAME
|
||
|
|
value: "policy"
|
||
|
|
- name: MINIO_IDENTITY_OPENID_SCOPES
|
||
|
|
value: "openid,profile,email,minio"
|
||
|
|
- name: MINIO_IDENTITY_OPENID_REDIRECT_URI
|
||
|
|
value: "https://minio.riotpiao.homelab.com/oauth_callback"
|
||
|
|
- name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
|
||
|
|
value: "Authentik"
|
||
|
|
|
||
|
|
# Metrics
|
||
|
|
metrics:
|
||
|
|
enabled: true
|
||
|
|
port: 9000
|
||
|
|
|
||
|
|
# No auto-TLS (using cert-manager)
|
||
|
|
requestAutoCert: false
|
||
|
|
|
||
|
|
# No built-in ingress
|
||
|
|
ingress:
|
||
|
|
enabled: false
|