fix(minio): rewrite Tenant to operator-v5 schema, single-node pool, declarative buckets/users — removes invalid Bucket/Policy/User CRs and dead multi-site replication

Old Tenant used unknown v2 fields (pools[].size/storageClass, spec.console/metrics/ingress)
and referenced nonexistent minio.min.io/v1alpha1 Bucket/Policy/User kinds, so the app
never synced. Rewrites to valid v2: single erasure-coded pool (4 vols) pinned to
talos-cp-1/az-a (only schedulable+Longhorn node per 3-CP topology), spec.buckets +
spec.users declarative provisioning, prometheusOperator ServiceMonitor, features.domains.
Drops hand-rolled minio-service (operator owns it), dead multi-site replication job,
and legacy alias. Adds mc-based PostSync job for the ollama scoped policy, and
SOPS-encrypted minio-creds/oidc/user secrets for IaC record.

k8s/infrastructure/minio/minio-tenant.yaml

@@ -5,19 +5,27 @@ metadata:
   namespace: storage
   labels:
     app: minio
+  annotations:
+    # Let the operator own bucket/user provisioning declaratively.
+    prometheus.io/path: /minio/v2/metrics/cluster
+    prometheus.io/port: "9000"
+    prometheus.io/scrape: "true"
 spec:
   image: minio/minio:RELEASE.2024-06-13T20-48-48Z
 
+  # Root credentials (rootUser/rootPassword). Created out-of-band — see
+  # BOOTSTRAP.md / SOPS. Operator reads CONSOLE_ACCESS_KEY style from here.
   credsSecret:
     name: minio-creds
 
-  # 3-zone distributed cluster (one server per zone)
+  # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ──────
+  # Per the 3-CP topology only talos-cp-1 is schedulable and holds Longhorn, so
+  # MinIO is a single-server tenant. 4 volumes give erasure-coded durability
+  # (MinIO's minimum for parity) on that one node.
   pools:
     - name: az-a
       servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
+      volumesPerServer: 4
 
       affinity:
         nodeAffinity:
@@ -33,31 +41,13 @@ spec:
           operator: Exists
           effect: NoSchedule
 
-      volumeClaimTemplate:
-        metadata:
-          name: data
-        spec:
-          accessModes:
-            - ReadWriteOnce
-          storageClassName: longhorn
-          resources:
-            requests:
-              storage: 100Gi
-
-    - name: az-b
-      servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
-
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: topology.kubernetes.io/zone
-                    operator: In
-                    values: [az-b]
+      resources:
+        requests:
+          cpu: 250m
+          memory: 512Mi
+        limits:
+          cpu: "1"
+          memory: 1Gi
 
       volumeClaimTemplate:
         metadata:
@@ -68,47 +58,28 @@ spec:
           storageClassName: longhorn
           resources:
             requests:
-              storage: 100Gi
+              storage: 25Gi
 
-    - name: az-c
-      servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
+  # ── Declarative buckets (operator creates on first boot) ────────────────────
+  buckets:
+    - name: riotpiao-models
 
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: topology.kubernetes.io/zone
-                    operator: In
-                    values: [az-c]
+  # ── Declarative users (each references a Secret of the same name holding
+  #    CONSOLE_ACCESS_KEY / CONSOLE_SECRET_KEY) ─────────────────────────────
+  users:
+    - name: minio-user-ollama
 
-      volumeClaimTemplate:
-        metadata:
-          name: data
-        spec:
-          accessModes:
-            - ReadWriteOnce
-          storageClassName: longhorn
-          resources:
-            requests:
-              storage: 100Gi
+  # Expose ServiceMonitor for the kube-prometheus-stack.
+  prometheusOperator: true
 
-  # Console (web UI)
-  console:
-    image: minio/console:v0.30.0
-    replicas: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        cpu: 500m
-        memory: 512Mi
+  # Public hostnames the tenant serves (S3 + console via the cluster ingress).
+  features:
+    domains:
+      minio:
+        - https://minio.riotpiao.com
+      console: https://minio-console.riotpiao.com
 
-  # Environment variables — OIDC config
+  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
@@ -128,14 +99,5 @@ spec:
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
       value: "Authentik"
 
-  # Metrics
-  metrics:
-    enabled: true
-    port: 9000
-
-  # No auto-TLS (using cert-manager)
+  # cert-manager handles TLS; no operator auto-cert.
   requestAutoCert: false
-
-  # No built-in ingress
-  ingress:
-    enabled: false