fix(loki,vault,iam): loki minio endpoint :80 not :9000, emit vault-minio-creds via CMP, drop redundant broken authentik-migrations job

k8s/platform/logging/loki-values.yaml

@@ -33,7 +33,7 @@ loki:
   storage:
     type: s3
     s3:
-      endpoint: minio.storage.svc.cluster.local:9000
+      endpoint: minio.storage.svc.cluster.local:80   # operator svc maps :80 -> pod :9000
       region: us-east-1          # MinIO ignores region but Loki's S3 client requires it
       s3ForcePathStyle: true
       insecure: true

k8s/security/ci-cd/sops-cmp-plugin.yaml

@@ -66,3 +66,15 @@ data:
       "$(echo "$DEC" | yq -r '.adminPassword' | base64 -w0)"
     emit_secret logging grafana-oidc \
       GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+
+    # ── vault S3 backend creds (iam) ───────────────────────────────────
+    # Vault's s3 storage stanza reads AWS_ACCESS_KEY_ID/SECRET from vault-minio-creds
+    # (keys access_key/secret_key). MinIO root creds live in minio-creds' config.env
+    # shell exports — parse them out.
+    MINIO_ENV="$(sops -d "$REPO_ROOT/k8s/infrastructure/minio/minio-secrets.enc.yaml" \
+      | yq -r 'select(.metadata.name=="minio-creds") | .stringData."config.env"')"
+    MINIO_AK="$(printf '%s' "$MINIO_ENV" | sed -n 's/.*MINIO_ROOT_USER="\([^"]*\)".*/\1/p')"
+    MINIO_SK="$(printf '%s' "$MINIO_ENV" | sed -n 's/.*MINIO_ROOT_PASSWORD="\([^"]*\)".*/\1/p')"
+    printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: vault-minio-creds\n  namespace: iam\ntype: Opaque\ndata:\n  access_key: %s\n  secret_key: %s\n---\n' \
+      "$(printf '%s' "$MINIO_AK" | base64 -w0)" \
+      "$(printf '%s' "$MINIO_SK" | base64 -w0)"

k8s/security/iam/kustomization.yaml

@@ -3,6 +3,8 @@ kind: Kustomization
 namespace: iam
 resources:
   - key-rotation-cronjob.yaml
-  - authentik-migrations-job.yaml
+# authentik-migrations-job.yaml removed — redundant + broken. The authentik
+# `server` entrypoint runs migrations itself; this standalone job lacked the
+# authentik-secrets envFrom (Secret key missing) and always failed.
 # SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time
 # authentik/vault deployed via ArgoCD Helm source