diff --git a/k8s/infrastructure/minio/minio-secrets.enc.yaml b/k8s/infrastructure/minio/minio-secrets.enc.yaml index db3c190..a907849 100644 --- a/k8s/infrastructure/minio/minio-secrets.enc.yaml +++ b/k8s/infrastructure/minio/minio-secrets.enc.yaml @@ -1,73 +1,72 @@ -apiVersion: ENC[AES256_GCM,data:w/A=,iv:Qum0Jux4oTEBSsbhDhFJHjoI9SsIAYpQazHaGCpNi4Y=,tag:9QGbAc8+zx1kpHdsmvY2YQ==,type:str] -kind: ENC[AES256_GCM,data:gNunoeDN,iv:baVsCtIdMzvIxiDYUWJZofazYmy9IxJ7Qy7iq0423LU=,tag:yFhxqH6pjZcRg8wYu+Euig==,type:str] +apiVersion: ENC[AES256_GCM,data:nd0=,iv:fORqNsg82i9+5WRQkHi698q/qHI4A1JP+YEkOvMxEGw=,tag:bLdfd21vJn6Mn2k/ghx1iA==,type:str] +kind: ENC[AES256_GCM,data:aPTyakwz,iv:0Fviiz5ngsaBD5IRn30p6Z93cELcuLNCWILJJQSn19M=,tag:0n0f69t4ZC5WULd9VBI9sg==,type:str] metadata: - name: ENC[AES256_GCM,data:PEmF8pnwETVjnys=,iv:qhljxXFqi2YInSuh8umcMzexekEombvc+P7vjdis4us=,tag:Z0P3hvrrCqACd1X2kyWuJg==,type:str] - namespace: ENC[AES256_GCM,data:+xu5BsH0rQ==,iv:QXGrT2y8YRlPloD3vtIEWi6KKEulapx0qDReKBcx94s=,tag:lJeuU8ze4S0nCvD6HDO8vQ==,type:str] -type: ENC[AES256_GCM,data:SGp0jv5g,iv:0cGTcnKMpo9szxciiq3lVmjKu9PGEBei4DIRg5ykCSk=,tag:zVNwJrGzjwFiEJ8YsJl4OA==,type:str] + name: ENC[AES256_GCM,data:UQ0lTL18hb7bZR4=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:JYu3EMyW7Pc4HTCmU8IiTw==,type:str] + namespace: ENC[AES256_GCM,data:H49h6xTVAQ==,iv:EgTi3jFfn+EYYxMTC1GCQmt1fuGGtVSD3fhytp+CiaM=,tag:ynf4iSonvnnaO5/Ujno3+A==,type:str] +type: ENC[AES256_GCM,data:xDlXeb2q,iv:0pe80oQG0ZIerOLvqbiorJ76JlCPu6wIjt4lQfbsXjU=,tag:rmaLgRUr/ERPzIXeUD9qMA==,type:str] stringData: - accesskey: ENC[AES256_GCM,data:RDGA1yzgfLp4Qg==,iv:6ahifHVN0+oLcPK+wU9zQ6mzCfYletVa6OrLMgGjvZU=,tag:aTjrX9GTOWhQ1JAdD7mkdw==,type:str] - secretkey: ENC[AES256_GCM,data:1TBLP5i7RcHBqpSRrQwYRS+R5eZhEx2NmM8Pe5/ffg4PmEWW/O4hHirpcyg=,iv:uUCaDPzBRsbDJjJKiaT1Cl+LAjaRTtih1QQNbMB2UkU=,tag:UIp5CsdPec1NoJ5Mr1p07Q==,type:str] + config.env: ENC[AES256_GCM,data:rM2sfC9apy4Bnlw609d+BXAenZzUcBxceQmyzlbrvgasp37JfS6hIAWOf5Qq62ZF+/fN7nXSB5oEeajAIV3YJoP8wKlqm3765zOkUVhFkX2YmhJH4CkoJa6XzX9CowCQtTW9h+7F5PwaGnLptQ==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:zu45S2b29SM9JjqxsKQHow==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1 - U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq - aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL - V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM - rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr + NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV + V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK + Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm + vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== -----END AGE ENCRYPTED FILE----- recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:27:04Z" - mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str] + lastmodified: "2026-07-20T19:41:57Z" + mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] unencrypted_suffix: _unencrypted version: 3.13.2 --- -apiVersion: ENC[AES256_GCM,data:nT4=,iv:oDoOIsSdLse/e5NWZfB77VDCKZg7H1ryo2G1yO/kMSQ=,tag:mh0742mY6JkziEDjVvJraQ==,type:str] -kind: ENC[AES256_GCM,data:/b9jpUAE,iv:t9ePbTrB312I/DbwwU2+TbPdadu017NRCf86tB3xgo8=,tag:bQ4kkgIdK+ok+Q8Ib5RQWQ==,type:str] +apiVersion: ENC[AES256_GCM,data:Utg=,iv:SqcUMt/REXm9qIppTVP8PQ6tnVrgt2gc5aghD7S8KHI=,tag:zeSno+VCPn9EXDE1Uxs8Hg==,type:str] +kind: ENC[AES256_GCM,data:nDUp5Fyy,iv:RVtkV8l4JvqOSUR/MlZHZxnR75+fAAR8gKPNbpOLWVk=,tag:AoNBqT3MVudiA56sIIqpnQ==,type:str] metadata: - name: ENC[AES256_GCM,data:njhz0CfjRVGOsA==,iv:SaHtjjPxAW+RWZ3++5ki9coI042/ZfDVbzvBhRjf9Qs=,tag:6/P18CD8nsMSLfdSKS3gwA==,type:str] - namespace: ENC[AES256_GCM,data:2uvto8XrRQ==,iv:kFe9jRZQPxh2e4xYeGG1qbJ1wv1oIGiwHqDb26EF7ZQ=,tag:YtfAVMk03Nutfqcz7yLj/Q==,type:str] -type: ENC[AES256_GCM,data:UcCLVcHy,iv:QbcI8GveNxBPirq6WvbCfm+ToTsjFCYsLKgd7q4/6Ns=,tag:HyhZMa8++GR56Kr66SGukw==,type:str] + name: ENC[AES256_GCM,data:74hhzAFMvD+DuQ==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:mnnkksSy69Gtg4LyYYnjmg==,type:str] + namespace: ENC[AES256_GCM,data:z8dPkzIQkg==,iv:zoH4ZWOtD3tF6pkAuQDrL2rSfuRp+9Nu8IJq2q0eqsY=,tag:/39AaFYlXKxKkCuZpeHZlg==,type:str] +type: ENC[AES256_GCM,data:J7ALXn/x,iv:GUfgjXF1/z0jGCFdz5/ARVRQUBwrEAdpzfATiFNPVLs=,tag:HZem0E53fAykijNrthbs8Q==,type:str] stringData: - MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:AfQjsyC5sVF7CbUZd04lRsMGWoUASagUjcQr+KbhMfvfwjKXMxSu9Zpt2kDxTaIwm+CaUnvWf01G1n4oj5wPPA==,iv:QmZDkftfSs2h+ktlHcDNQJJzuVtUi5MnKaYAD+7ZzeA=,tag:VZgouvb5sLighY73k1ssFg==,type:str] + MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:w3SZTsxn59UfoS4rej78RToiQP3jzMOwUmNwjEFoPjkZAhHpKYX7Y4tYv5znt9h1cd2jGrorBVLf9YgIOihJxw==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:mL3ayxC3PuvbgQosazgTow==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1 - U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq - aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL - V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM - rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr + NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV + V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK + Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm + vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== -----END AGE ENCRYPTED FILE----- recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:27:04Z" - mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str] + lastmodified: "2026-07-20T19:41:57Z" + mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] unencrypted_suffix: _unencrypted version: 3.13.2 --- -apiVersion: ENC[AES256_GCM,data:Z/g=,iv:EbbztYw9O2eWwDxlFFEaBgmAnIhN9mmwA8GPzZLZF6I=,tag:2Xe1qSCcaCLtC/CYgDT21Q==,type:str] -kind: ENC[AES256_GCM,data:DkLVktg5,iv:e5g6/fBulvT1/1Jjd+8UWOsVCk1mWntGvSXLJxzf1Lo=,tag:x8XB6vxsezq/8hkqGUjMBA==,type:str] +apiVersion: ENC[AES256_GCM,data:Mv4=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:J4W7uyf3iYImPh2OSVWvNA==,type:str] +kind: ENC[AES256_GCM,data:VPEKGVDy,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:xqIUhSu4RSxameNPoFZVNQ==,type:str] metadata: - name: ENC[AES256_GCM,data:6CsuJOz36cL1qqTdm/Ry3gU=,iv:WzCfjwMQMonViXgOvr8s0ekp/49vuhOcv6xH/diV8i0=,tag:EHMnvtfC2zB5hWkgkVOHaw==,type:str] - namespace: ENC[AES256_GCM,data:rYh2ReE2Hw==,iv:j1kYlDhZYGcjn/CXMSq0ZBtht/jPLb/Bzle2NCWbe1Y=,tag:u7MiEnxVFKeycEfS/MLeSw==,type:str] -type: ENC[AES256_GCM,data:8oyW6AP2,iv:qEjwjABAu7AJz/4h17JnwH6VYPU07onKfUparanC0Zs=,tag:HrH2IJHxnktY8wvWNWNMHQ==,type:str] + name: ENC[AES256_GCM,data:bckq1pAY9UIMm3FUyGgafvQ=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:wvrBClQahE2OeVzeiubOEg==,type:str] + namespace: ENC[AES256_GCM,data:5GotV/mD9g==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:fCupPaa2X/ztuoHbtr/HEQ==,type:str] +type: ENC[AES256_GCM,data:q8D3YEZZ,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:lxOx4u4LGcXCyK32BCD1XQ==,type:str] stringData: - CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:VtXwL7ngWkb3mDucpRtigqE=,iv:+r7DQLbjVMU82Ig8nlOwIgFEA2wE3KpMVtXIzpjE/o4=,tag:p3/7UOOCvH9qnOPN+sTCmw==,type:str] - CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:CG09bCWQP8zP++t8iYn3jIietAikzLOJhsYSfb1kq+s=,iv:svztBK1rZky5YQjWc4q2YzHQNJO5u8rhSsZHbGLnhnw=,tag:m0lGFXshydA596KAqMHbzg==,type:str] + CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:XJCgReZf/FVli+lfA9ynF+s=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:Ts1P68sbBrYAS9gdI8XaHw==,type:str] + CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:WQKvfXroupl4R2oUuRXDSgLthsd/ZaEedsy8lAHAu40=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:kyxRviddcYUc0DcPEphKIg==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1 - U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq - aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL - V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM - rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr + NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV + V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK + Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm + vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== -----END AGE ENCRYPTED FILE----- recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:27:04Z" - mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str] + lastmodified: "2026-07-20T19:41:57Z" + mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] unencrypted_suffix: _unencrypted version: 3.13.2 diff --git a/k8s/infrastructure/minio/minio-tenant.yaml b/k8s/infrastructure/minio/minio-tenant.yaml index 0261156..611ade6 100644 --- a/k8s/infrastructure/minio/minio-tenant.yaml +++ b/k8s/infrastructure/minio/minio-tenant.yaml @@ -11,11 +11,14 @@ metadata: prometheus.io/port: "9000" prometheus.io/scrape: "true" spec: - image: minio/minio:RELEASE.2024-06-13T20-48-48Z + image: minio/minio:RELEASE.2025-07-23T15-54-02Z - # Root credentials (rootUser/rootPassword). Created out-of-band — see - # BOOTSTRAP.md / SOPS. Operator reads CONSOLE_ACCESS_KEY style from here. - credsSecret: + # Root credentials. v5 pods read `configuration` — a Secret whose `config.env` + # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band + # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a + # cosmetic "empty tenant credentials" warning (it greps for legacy + # access_key/secret_key keys) — MinIO itself authenticates fine; ignore it. + configuration: name: minio-creds # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ────── @@ -69,8 +72,10 @@ spec: users: - name: minio-user-ollama - # Expose ServiceMonitor for the kube-prometheus-stack. - prometheusOperator: true + # Metrics are exposed at /minio/v2/metrics; scrape via a hand-rolled + # ServiceMonitor in the monitoring stack rather than operator auto-wiring + # (prometheusOperator:true makes the operator hunt for Prometheus in ns + # 'default' and fail the reconcile). # Public hostnames the tenant serves (S3 + console via the cluster ingress). features: