k8s/storage: add minio s3 with 3-way replication and oidc

- MinIO 3-node site replication (az-a/b/c) - S3 backend for Loki chunks (10-day retention) - OIDC integration with Authentik - envFrom for secret injection
2026-08-18 15:08:00 -07:00
parent df777fb829
commit 7da222e243
15 changed files with 1014 additions and 0 deletions
@@ -0,0 +1,57 @@
+#!/bin/bash
+# Safe MinIO bucket initialization via Job (credentials in Secret, not env)
+# Usage: ./minio-bucket-init.sh <namespace> <bucket1> [bucket2] ...
+set -euo pipefail
+
+NAMESPACE="${1:?Missing namespace}"
+shift
+BUCKETS=("$@")
+
+if [ ${#BUCKETS[@]} -eq 0 ]; then
+  echo "Usage: $0 <namespace> <bucket1> [bucket2] ..." >&2
+  exit 1
+fi
+
+# Create Secret with Minio credentials (safe: sourced from env, not exposed in pod)
+kubectl create secret generic minio-creds -n "$NAMESPACE" \
+  --from-literal=MINIO_ROOT_USER="${MINIO_ROOT_USER:?Missing MINIO_ROOT_USER}" \
+  --from-literal=MINIO_ROOT_PASSWORD="${MINIO_ROOT_PASSWORD:?Missing MINIO_ROOT_PASSWORD}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Create init Job that mounts Secret as volume, preventing env exposure
+BUCKET_ARGS=$(printf '"%s", ' "${BUCKETS[@]}" | sed 's/, $//')
+kubectl apply -f - <<EOF
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: minio-bucket-init-$RANDOM
+  namespace: $NAMESPACE
+spec:
+  ttlSecondsAfterFinished: 300
+  backoffLimit: 2
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: minio-init
+        image: minio/mc:latest
+        volumeMounts:
+        - name: minio-secret
+          mountPath: /var/run/secrets/minio
+          readOnly: true
+        command:
+        - sh
+        - -c
+        - |
+          MINIO_ROOT_USER=\$(cat /var/run/secrets/minio/MINIO_ROOT_USER)
+          MINIO_ROOT_PASSWORD=\$(cat /var/run/secrets/minio/MINIO_ROOT_PASSWORD)
+          mc alias set local http://minio.storage.svc.cluster.local:9000 "\$MINIO_ROOT_USER" "\$MINIO_ROOT_PASSWORD"
+          mc mb --ignore-existing $BUCKET_ARGS
+      volumes:
+      - name: minio-secret
+        secret:
+          secretName: minio-creds
+EOF
+
+echo "✓ MinIO bucket init job submitted for: ${BUCKETS[*]}"
+