fix(minio): migrate to official chart, TF-owned

Bitnami wiped Docker Hub catalog (bitnami/minio: 0 tags), chart 14.1.0 dead on ImagePullBackOff. Move to minio/minio 5.4.0 (quay.io) as one TF helm_release. Add longhorn-xfs SC: default SC ext4 mkfs on 100Gi exceeds kubelet mount timeout, xfs near-instant. Drop minio ArgoCD Apps (TF owns now, kills dual-controller conflict). Fix double base64 on OIDC secret.
2026-07-14 16:07:03 -07:00
parent ebeb4948d4
commit 9e3781a069
4 changed files with 119 additions and 170 deletions
@@ -0,0 +1,90 @@
+# MinIO - Official minio/minio chart, direct Helm deployment (no operator)
+# All-in-one: single helm_release + dedicated xfs StorageClass.
+# Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
+# exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
+# no persistence.fsType, so fsType must be set on the StorageClass.
+
+resource "kubernetes_storage_class" "longhorn_xfs" {
+  metadata {
+    name = "longhorn-xfs"
+  }
+  storage_provisioner    = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+  volume_binding_mode    = "Immediate"
+
+  parameters = {
+    numberOfReplicas   = "2"
+    staleReplicaTimeout = "60"
+    fsType             = "xfs"
+    dataLocality       = "disabled"
+  }
+}
+
+resource "helm_release" "minio" {
+  name            = "minio"
+  repository      = "https://charts.min.io/"
+  chart           = "minio"
+  version         = "5.4.0"
+  namespace       = "storage"
+  upgrade_install = true
+  force_update    = true
+  wait            = true
+  timeout         = 600
+
+  values = [
+    yamlencode({
+      mode         = "standalone"
+      replicas     = 1
+      drivesPerNode = 1
+      pools        = 1
+
+      rootUser     = "minioadmin"
+      rootPassword = var.minio_root_password
+
+      persistence = {
+        enabled      = true
+        size         = "100Gi"
+        storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
+        accessMode   = "ReadWriteOnce"
+      }
+
+      resources = {
+        requests = {
+          memory = "512Mi"
+        }
+      }
+
+      service = {
+        type = "ClusterIP"
+        port = "9000"
+      }
+      consoleService = {
+        type = "ClusterIP"
+        port = "9001"
+      }
+
+      # Buckets auto-created on install (all-in-one, no post-hook needed)
+      buckets = [
+        { name = "vault", policy = "none", purge = false },
+        { name = "riotpiao-models", policy = "none", purge = false },
+      ]
+
+      environment = {
+        MINIO_IDENTITY_OPENID_CONFIG_URL    = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
+        MINIO_IDENTITY_OPENID_CLIENT_ID     = "minio"
+        MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
+        MINIO_IDENTITY_OPENID_CLAIM_NAME    = "policy"
+        MINIO_IDENTITY_OPENID_SCOPES        = "openid,profile,email,minio"
+        MINIO_IDENTITY_OPENID_REDIRECT_URI  = "https://minio.riotpiao.homelab.com/oauth_callback"
+        MINIO_IDENTITY_OPENID_DISPLAY_NAME  = "Authentik"
+      }
+    })
+  ]
+}
+
+variable "create_storage_namespace" {
+  description = "Create storage namespace if it doesn't exist"
+  type        = bool
+  default     = false
+}