refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-08-18 15:08:01 -07:00
parent 563f720d09
commit 0f30d77288
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,141 @@
+apiVersion: minio.min.io/v2
+kind: Tenant
+metadata:
+  name: minio-cluster
+  namespace: storage
+  labels:
+    app: minio
+spec:
+  image: minio/minio:RELEASE.2024-06-13T20-48-48Z
+
+  credsSecret:
+    name: minio-creds
+
+  # 3-zone distributed cluster (one server per zone)
+  pools:
+    - name: az-a
+      servers: 1
+      volumesPerServer: 1
+      size: 100Gi
+      storageClass: longhorn
+
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values: [az-a]
+
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+
+      volumeClaimTemplate:
+        metadata:
+          name: data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: longhorn
+          resources:
+            requests:
+              storage: 100Gi
+
+    - name: az-b
+      servers: 1
+      volumesPerServer: 1
+      size: 100Gi
+      storageClass: longhorn
+
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values: [az-b]
+
+      volumeClaimTemplate:
+        metadata:
+          name: data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: longhorn
+          resources:
+            requests:
+              storage: 100Gi
+
+    - name: az-c
+      servers: 1
+      volumesPerServer: 1
+      size: 100Gi
+      storageClass: longhorn
+
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values: [az-c]
+
+      volumeClaimTemplate:
+        metadata:
+          name: data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: longhorn
+          resources:
+            requests:
+              storage: 100Gi
+
+  # Console (web UI)
+  console:
+    image: minio/console:v0.30.0
+    replicas: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+
+  # Environment variables — OIDC config
+  env:
+    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+      value: "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+      value: "minio"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: minio-oidc
+          key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+      value: "policy"
+    - name: MINIO_IDENTITY_OPENID_SCOPES
+      value: "openid,profile,email,minio"
+    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+      value: "https://minio.riotpiao.homelab.com/oauth_callback"
+    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+      value: "Authentik"
+
+  # Metrics
+  metrics:
+    enabled: true
+    port: 9000
+
+  # No auto-TLS (using cert-manager)
+  requestAutoCert: false
+
+  # No built-in ingress
+  ingress:
+    enabled: false