refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-08-18 15:08:03 -07:00
parent 54fa540b33
commit 41f5b05395
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,110 @@
+apiVersion: minio.min.io/v2
+kind: Tenant
+metadata:
+  name: minio-cluster
+  namespace: storage
+  labels:
+    app: minio
+  annotations:
+    # Let the operator own bucket/user provisioning declaratively.
+    prometheus.io/path: /minio/v2/metrics/cluster
+    prometheus.io/port: "9000"
+    prometheus.io/scrape: "true"
+spec:
+  image: minio/minio:RELEASE.2025-07-23T15-54-02Z
+
+  # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000.
+  # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert).
+  # Without this, MinIO auto-generates self-signed certs and serves HTTPS-only
+  # on 9000, which breaks plain-HTTP internal clients like Vault's S3 backend
+  # (they hang waiting for a TLS handshake that never completes on an HTTP request).
+  requestAutoCert: false
+
+  # Root credentials. v5 pods read `configuration` — a Secret whose `config.env`
+  # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band
+  # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a
+  # cosmetic "empty tenant credentials" warning (it greps for legacy
+  # access_key/secret_key keys) — MinIO itself authenticates fine; ignore it.
+  configuration:
+    name: minio-creds
+
+  # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ──────
+  # Per the 3-CP topology only talos-cp-1 is schedulable and holds Longhorn, so
+  # MinIO is a single-server tenant. 4 volumes give erasure-coded durability
+  # (MinIO's minimum for parity) on that one node.
+  pools:
+    - name: az-a
+      servers: 1
+      volumesPerServer: 4
+
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/zone
+                    operator: In
+                    values: [az-a]
+
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+
+      resources:
+        requests:
+          cpu: 250m
+          memory: 512Mi
+        limits:
+          cpu: "1"
+          memory: 1Gi
+
+      volumeClaimTemplate:
+        metadata:
+          name: data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: longhorn
+          resources:
+            requests:
+              storage: 25Gi
+
+  # ── Declarative buckets (operator creates on first boot) ────────────────────
+  buckets:
+    - name: loki-chunks
+    - name: loki-ruler
+    - name: loki-admin
+    - name: vault
+
+  # Metrics are exposed at /minio/v2/metrics; scrape via a hand-rolled
+  # ServiceMonitor in the monitoring stack rather than operator auto-wiring
+  # (prometheusOperator:true makes the operator hunt for Prometheus in ns
+  # 'default' and fail the reconcile).
+
+  # Public hostnames the tenant serves (S3 + console via the cluster ingress).
+  features:
+    domains:
+      minio:
+        - https://minio.riotpiao.com
+      console: https://minio-console.riotpiao.com
+
+  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
+  env:
+    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+      value: "minio"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: minio-oidc
+          key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+      value: "policy"
+    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+      value: "https://minio.riotpiao.com/oauth_callback"
+    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+      value: "Authentik"
+    - name: MINIO_IDENTITY_OPENID_SCOPES
+      value: "openid,profile,email,minio"