fix(minio): correct operator chart source + rewrite Tenant to v5 schema + config.env creds — tenant now boots

k8s/infrastructure/minio/minio-tenant.yaml

@@ -5,19 +5,30 @@ metadata:
   namespace: storage
   labels:
     app: minio
+  annotations:
+    # Let the operator own bucket/user provisioning declaratively.
+    prometheus.io/path: /minio/v2/metrics/cluster
+    prometheus.io/port: "9000"
+    prometheus.io/scrape: "true"
 spec:
-  image: minio/minio:RELEASE.2024-06-13T20-48-48Z
+  image: minio/minio:RELEASE.2025-07-23T15-54-02Z
 
-  credsSecret:
+  # Root credentials. v5 pods read `configuration` — a Secret whose `config.env`
+  # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band
+  # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a
+  # cosmetic "empty tenant credentials" warning (it greps for legacy
+  # access_key/secret_key keys) — MinIO itself authenticates fine; ignore it.
+  configuration:
     name: minio-creds
 
-  # 3-zone distributed cluster (one server per zone)
+  # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ──────
+  # Per the 3-CP topology only talos-cp-1 is schedulable and holds Longhorn, so
+  # MinIO is a single-server tenant. 4 volumes give erasure-coded durability
+  # (MinIO's minimum for parity) on that one node.
   pools:
     - name: az-a
       servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
+      volumesPerServer: 4
 
       affinity:
         nodeAffinity:
@@ -33,31 +44,13 @@ spec:
           operator: Exists
           effect: NoSchedule
 
-      volumeClaimTemplate:
-        metadata:
-          name: data
-        spec:
-          accessModes:
-            - ReadWriteOnce
-          storageClassName: longhorn
-          resources:
-            requests:
-              storage: 100Gi
-
-    - name: az-b
-      servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
-
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: topology.kubernetes.io/zone
-                    operator: In
-                    values: [az-b]
+      resources:
+        requests:
+          cpu: 250m
+          memory: 512Mi
+        limits:
+          cpu: "1"
+          memory: 1Gi
 
       volumeClaimTemplate:
         metadata:
@@ -68,47 +61,30 @@ spec:
           storageClassName: longhorn
           resources:
             requests:
-              storage: 100Gi
+              storage: 25Gi
 
-    - name: az-c
-      servers: 1
-      volumesPerServer: 1
-      size: 100Gi
-      storageClass: longhorn
+  # ── Declarative buckets (operator creates on first boot) ────────────────────
+  buckets:
+    - name: riotpiao-models
 
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: topology.kubernetes.io/zone
-                    operator: In
-                    values: [az-c]
+  # ── Declarative users (each references a Secret of the same name holding
+  #    CONSOLE_ACCESS_KEY / CONSOLE_SECRET_KEY) ─────────────────────────────
+  users:
+    - name: minio-user-ollama
 
-      volumeClaimTemplate:
-        metadata:
-          name: data
-        spec:
-          accessModes:
-            - ReadWriteOnce
-          storageClassName: longhorn
-          resources:
-            requests:
-              storage: 100Gi
+  # Metrics are exposed at /minio/v2/metrics; scrape via a hand-rolled
+  # ServiceMonitor in the monitoring stack rather than operator auto-wiring
+  # (prometheusOperator:true makes the operator hunt for Prometheus in ns
+  # 'default' and fail the reconcile).
 
-  # Console (web UI)
-  console:
-    image: minio/console:v0.30.0
-    replicas: 1
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        cpu: 500m
-        memory: 512Mi
+  # Public hostnames the tenant serves (S3 + console via the cluster ingress).
+  features:
+    domains:
+      minio:
+        - https://minio.riotpiao.com
+      console: https://minio-console.riotpiao.com
 
-  # Environment variables — OIDC config
+  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
@@ -128,14 +104,5 @@ spec:
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
       value: "Authentik"
 
-  # Metrics
-  metrics:
-    enabled: true
-    port: 9000
-
-  # No auto-TLS (using cert-manager)
+  # cert-manager handles TLS; no operator auto-cert.
   requestAutoCert: false
-
-  # No built-in ingress
-  ingress:
-    enabled: false