fix(minio): use configuration secret (config.env) for root creds, valid image tag — tenant now boots and authenticates

Switch Tenant from credsSecret to configuration field (v5 pods read config.env
shell exports); pin image to RELEASE.2025-07-23 (the old 2024-06 tag was pulled
from Docker Hub, ErrImagePull); drop prometheusOperator:true (made operator fail
reconcile hunting Prometheus in ns default). MinIO now serves S3, 4/4 drives OK,
root auth works. Operator's cosmetic 'empty tenant credentials' health-log is
harmless (documented inline).

k8s/infrastructure/minio/minio-secrets.enc.yaml

@@ -1,73 +1,72 @@
-apiVersion: ENC[AES256_GCM,data:w/A=,iv:Qum0Jux4oTEBSsbhDhFJHjoI9SsIAYpQazHaGCpNi4Y=,tag:9QGbAc8+zx1kpHdsmvY2YQ==,type:str]
-kind: ENC[AES256_GCM,data:gNunoeDN,iv:baVsCtIdMzvIxiDYUWJZofazYmy9IxJ7Qy7iq0423LU=,tag:yFhxqH6pjZcRg8wYu+Euig==,type:str]
+apiVersion: ENC[AES256_GCM,data:nd0=,iv:fORqNsg82i9+5WRQkHi698q/qHI4A1JP+YEkOvMxEGw=,tag:bLdfd21vJn6Mn2k/ghx1iA==,type:str]
+kind: ENC[AES256_GCM,data:aPTyakwz,iv:0Fviiz5ngsaBD5IRn30p6Z93cELcuLNCWILJJQSn19M=,tag:0n0f69t4ZC5WULd9VBI9sg==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:PEmF8pnwETVjnys=,iv:qhljxXFqi2YInSuh8umcMzexekEombvc+P7vjdis4us=,tag:Z0P3hvrrCqACd1X2kyWuJg==,type:str]
-    namespace: ENC[AES256_GCM,data:+xu5BsH0rQ==,iv:QXGrT2y8YRlPloD3vtIEWi6KKEulapx0qDReKBcx94s=,tag:lJeuU8ze4S0nCvD6HDO8vQ==,type:str]
-type: ENC[AES256_GCM,data:SGp0jv5g,iv:0cGTcnKMpo9szxciiq3lVmjKu9PGEBei4DIRg5ykCSk=,tag:zVNwJrGzjwFiEJ8YsJl4OA==,type:str]
+    name: ENC[AES256_GCM,data:UQ0lTL18hb7bZR4=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:JYu3EMyW7Pc4HTCmU8IiTw==,type:str]
+    namespace: ENC[AES256_GCM,data:H49h6xTVAQ==,iv:EgTi3jFfn+EYYxMTC1GCQmt1fuGGtVSD3fhytp+CiaM=,tag:ynf4iSonvnnaO5/Ujno3+A==,type:str]
+type: ENC[AES256_GCM,data:xDlXeb2q,iv:0pe80oQG0ZIerOLvqbiorJ76JlCPu6wIjt4lQfbsXjU=,tag:rmaLgRUr/ERPzIXeUD9qMA==,type:str]
 stringData:
-    accesskey: ENC[AES256_GCM,data:RDGA1yzgfLp4Qg==,iv:6ahifHVN0+oLcPK+wU9zQ6mzCfYletVa6OrLMgGjvZU=,tag:aTjrX9GTOWhQ1JAdD7mkdw==,type:str]
-    secretkey: ENC[AES256_GCM,data:1TBLP5i7RcHBqpSRrQwYRS+R5eZhEx2NmM8Pe5/ffg4PmEWW/O4hHirpcyg=,iv:uUCaDPzBRsbDJjJKiaT1Cl+LAjaRTtih1QQNbMB2UkU=,tag:UIp5CsdPec1NoJ5Mr1p07Q==,type:str]
+    config.env: ENC[AES256_GCM,data:rM2sfC9apy4Bnlw609d+BXAenZzUcBxceQmyzlbrvgasp37JfS6hIAWOf5Qq62ZF+/fN7nXSB5oEeajAIV3YJoP8wKlqm3765zOkUVhFkX2YmhJH4CkoJa6XzX9CowCQtTW9h+7F5PwaGnLptQ==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:zu45S2b29SM9JjqxsKQHow==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1
-            U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq
-            aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL
-            V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM
-            rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr
+            NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV
+            V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK
+            Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm
+            vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-20T19:27:04Z"
-    mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str]
+    lastmodified: "2026-07-20T19:41:57Z"
+    mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:nT4=,iv:oDoOIsSdLse/e5NWZfB77VDCKZg7H1ryo2G1yO/kMSQ=,tag:mh0742mY6JkziEDjVvJraQ==,type:str]
-kind: ENC[AES256_GCM,data:/b9jpUAE,iv:t9ePbTrB312I/DbwwU2+TbPdadu017NRCf86tB3xgo8=,tag:bQ4kkgIdK+ok+Q8Ib5RQWQ==,type:str]
+apiVersion: ENC[AES256_GCM,data:Utg=,iv:SqcUMt/REXm9qIppTVP8PQ6tnVrgt2gc5aghD7S8KHI=,tag:zeSno+VCPn9EXDE1Uxs8Hg==,type:str]
+kind: ENC[AES256_GCM,data:nDUp5Fyy,iv:RVtkV8l4JvqOSUR/MlZHZxnR75+fAAR8gKPNbpOLWVk=,tag:AoNBqT3MVudiA56sIIqpnQ==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:njhz0CfjRVGOsA==,iv:SaHtjjPxAW+RWZ3++5ki9coI042/ZfDVbzvBhRjf9Qs=,tag:6/P18CD8nsMSLfdSKS3gwA==,type:str]
-    namespace: ENC[AES256_GCM,data:2uvto8XrRQ==,iv:kFe9jRZQPxh2e4xYeGG1qbJ1wv1oIGiwHqDb26EF7ZQ=,tag:YtfAVMk03Nutfqcz7yLj/Q==,type:str]
-type: ENC[AES256_GCM,data:UcCLVcHy,iv:QbcI8GveNxBPirq6WvbCfm+ToTsjFCYsLKgd7q4/6Ns=,tag:HyhZMa8++GR56Kr66SGukw==,type:str]
+    name: ENC[AES256_GCM,data:74hhzAFMvD+DuQ==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:mnnkksSy69Gtg4LyYYnjmg==,type:str]
+    namespace: ENC[AES256_GCM,data:z8dPkzIQkg==,iv:zoH4ZWOtD3tF6pkAuQDrL2rSfuRp+9Nu8IJq2q0eqsY=,tag:/39AaFYlXKxKkCuZpeHZlg==,type:str]
+type: ENC[AES256_GCM,data:J7ALXn/x,iv:GUfgjXF1/z0jGCFdz5/ARVRQUBwrEAdpzfATiFNPVLs=,tag:HZem0E53fAykijNrthbs8Q==,type:str]
 stringData:
-    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:AfQjsyC5sVF7CbUZd04lRsMGWoUASagUjcQr+KbhMfvfwjKXMxSu9Zpt2kDxTaIwm+CaUnvWf01G1n4oj5wPPA==,iv:QmZDkftfSs2h+ktlHcDNQJJzuVtUi5MnKaYAD+7ZzeA=,tag:VZgouvb5sLighY73k1ssFg==,type:str]
+    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:w3SZTsxn59UfoS4rej78RToiQP3jzMOwUmNwjEFoPjkZAhHpKYX7Y4tYv5znt9h1cd2jGrorBVLf9YgIOihJxw==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:mL3ayxC3PuvbgQosazgTow==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1
-            U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq
-            aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL
-            V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM
-            rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr
+            NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV
+            V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK
+            Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm
+            vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-20T19:27:04Z"
-    mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str]
+    lastmodified: "2026-07-20T19:41:57Z"
+    mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:Z/g=,iv:EbbztYw9O2eWwDxlFFEaBgmAnIhN9mmwA8GPzZLZF6I=,tag:2Xe1qSCcaCLtC/CYgDT21Q==,type:str]
-kind: ENC[AES256_GCM,data:DkLVktg5,iv:e5g6/fBulvT1/1Jjd+8UWOsVCk1mWntGvSXLJxzf1Lo=,tag:x8XB6vxsezq/8hkqGUjMBA==,type:str]
+apiVersion: ENC[AES256_GCM,data:Mv4=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:J4W7uyf3iYImPh2OSVWvNA==,type:str]
+kind: ENC[AES256_GCM,data:VPEKGVDy,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:xqIUhSu4RSxameNPoFZVNQ==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:6CsuJOz36cL1qqTdm/Ry3gU=,iv:WzCfjwMQMonViXgOvr8s0ekp/49vuhOcv6xH/diV8i0=,tag:EHMnvtfC2zB5hWkgkVOHaw==,type:str]
-    namespace: ENC[AES256_GCM,data:rYh2ReE2Hw==,iv:j1kYlDhZYGcjn/CXMSq0ZBtht/jPLb/Bzle2NCWbe1Y=,tag:u7MiEnxVFKeycEfS/MLeSw==,type:str]
-type: ENC[AES256_GCM,data:8oyW6AP2,iv:qEjwjABAu7AJz/4h17JnwH6VYPU07onKfUparanC0Zs=,tag:HrH2IJHxnktY8wvWNWNMHQ==,type:str]
+    name: ENC[AES256_GCM,data:bckq1pAY9UIMm3FUyGgafvQ=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:wvrBClQahE2OeVzeiubOEg==,type:str]
+    namespace: ENC[AES256_GCM,data:5GotV/mD9g==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:fCupPaa2X/ztuoHbtr/HEQ==,type:str]
+type: ENC[AES256_GCM,data:q8D3YEZZ,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:lxOx4u4LGcXCyK32BCD1XQ==,type:str]
 stringData:
-    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:VtXwL7ngWkb3mDucpRtigqE=,iv:+r7DQLbjVMU82Ig8nlOwIgFEA2wE3KpMVtXIzpjE/o4=,tag:p3/7UOOCvH9qnOPN+sTCmw==,type:str]
-    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:CG09bCWQP8zP++t8iYn3jIietAikzLOJhsYSfb1kq+s=,iv:svztBK1rZky5YQjWc4q2YzHQNJO5u8rhSsZHbGLnhnw=,tag:m0lGFXshydA596KAqMHbzg==,type:str]
+    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:XJCgReZf/FVli+lfA9ynF+s=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:Ts1P68sbBrYAS9gdI8XaHw==,type:str]
+    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:WQKvfXroupl4R2oUuRXDSgLthsd/ZaEedsy8lAHAu40=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:kyxRviddcYUc0DcPEphKIg==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1Y4QmxCMlgxeHlWQ3M1
-            U2ZJd20vQVRISzc2eFVwamplSi8vOEVxWGw4CjFVc2twMllGUURKaFl4Y2ZqTjRq
-            aFVMbHpuNWR0VHpQMlNyUkM5dFFnS1kKLS0tIFhRU09TM0xZTG0rR1dOM0IzQ3NL
-            V0loSURhSHh2alVPdWNCMFFqNUpPK1UKLZF4LxAfFjj55v4GXki3NVa4d+uGjCoM
-            rx4bv8VBsrgCXUewv97R2CK2UYTn5BwzIP3XEFQ6GYh7aW58ilU5Ww==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr
+            NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV
+            V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK
+            Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm
+            vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-20T19:27:04Z"
-    mac: ENC[AES256_GCM,data:LLAp9hGlb/OvPRsTHoCZvYh7VMOUPY6Bv3FUJrM0CE0+E2TRR2Y4QwfDrHhWIW/z7ODgeSGScFBXvkMjVnuFgjXW3HHvfLDrW58BxaBOlPkOxliur8DTJ+P+ow9LGUwPAM4rAoeD05/fAQeZiRLFtEzMcoqBQBGEMXyAtUKE6kU=,iv:TWtlzUoqAZCORgRFwcPCn6XfV/m7WcB4AcOMMn0iA/w=,tag:EoABMArHUUTiYoTja6CUwQ==,type:str]
+    lastmodified: "2026-07-20T19:41:57Z"
+    mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

k8s/infrastructure/minio/minio-tenant.yaml

@@ -11,11 +11,14 @@ metadata:
     prometheus.io/port: "9000"
     prometheus.io/scrape: "true"
 spec:
-  image: minio/minio:RELEASE.2024-06-13T20-48-48Z
+  image: minio/minio:RELEASE.2025-07-23T15-54-02Z
 
-  # Root credentials (rootUser/rootPassword). Created out-of-band — see
-  # BOOTSTRAP.md / SOPS. Operator reads CONSOLE_ACCESS_KEY style from here.
-  credsSecret:
+  # Root credentials. v5 pods read `configuration` — a Secret whose `config.env`
+  # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band
+  # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a
+  # cosmetic "empty tenant credentials" warning (it greps for legacy
+  # access_key/secret_key keys) — MinIO itself authenticates fine; ignore it.
+  configuration:
     name: minio-creds
 
   # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ──────
@@ -69,8 +72,10 @@ spec:
   users:
     - name: minio-user-ollama
 
-  # Expose ServiceMonitor for the kube-prometheus-stack.
-  prometheusOperator: true
+  # Metrics are exposed at /minio/v2/metrics; scrape via a hand-rolled
+  # ServiceMonitor in the monitoring stack rather than operator auto-wiring
+  # (prometheusOperator:true makes the operator hunt for Prometheus in ns
+  # 'default' and fail the reconcile).
 
   # Public hostnames the tenant serves (S3 + console via the cluster ingress).
   features: