k8s/storage: add minio s3 with 3-way replication and oidc

- MinIO 3-node site replication (az-a/b/c)
- S3 backend for Loki chunks (10-day retention)
- OIDC integration with Authentik
- envFrom for secret injection

k8s/storage/minio-values.yaml

@@ -0,0 +1,64 @@
+mode: standalone
+
+rootUser: ""
+rootPassword: ""
+
+persistence:
+  enabled: true
+  storageClass: longhorn
+  size: 100Gi
+
+deploymentUpdate:
+  type: Recreate
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+service:
+  type: ClusterIP
+  port: 9000
+
+consoleService:
+  type: ClusterIP
+  port: 9001
+
+ingress:
+  enabled: false
+
+consoleIngress:
+  enabled: false
+
+metrics:
+  serviceMonitor:
+    enabled: true
+
+envFrom:
+  - secretRef:
+      name: minio-oidc
+
+environment:
+  MINIO_IDENTITY_OPENID_CONFIG_URL: "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
+  MINIO_IDENTITY_OPENID_CLIENT_ID: "minio"
+  MINIO_IDENTITY_OPENID_CLAIM_NAME: "policy"
+  MINIO_IDENTITY_OPENID_SCOPES: "openid,profile,email,minio"
+  MINIO_IDENTITY_OPENID_REDIRECT_URI: "https://minio.riotpiao.homelab.com/oauth_callback"
+  MINIO_IDENTITY_OPENID_DISPLAY_NAME: "Authentik"
+
+podAnnotations:
+  secret.reloader.stakater.com/reload: "minio-oidc"
+  configmap.reloader.stakater.com/reload: "homelab-ca"
+
+extraVolumes:
+  - name: homelab-ca
+    configMap:
+      name: homelab-ca
+
+extraVolumeMounts:
+  - name: homelab-ca
+    mountPath: /etc/minio/certs/CAs
+    readOnly: true