apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: minio-cluster
  namespace: storage
  labels:
    app: minio
spec:
  image: minio/minio:RELEASE.2024-06-13T20-48-48Z

  credsSecret:
    name: minio-creds

  # 3-zone distributed cluster (one server per zone)
  pools:
    - name: az-a
      servers: 1
      volumesPerServer: 1
      size: 100Gi
      storageClass: longhorn

      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values: [az-a]

      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule

      volumeClaimTemplate:
        metadata:
          name: data
        spec:
          accessModes:
            - ReadWriteOnce
          storageClassName: longhorn
          resources:
            requests:
              storage: 100Gi

    - name: az-b
      servers: 1
      volumesPerServer: 1
      size: 100Gi
      storageClass: longhorn

      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values: [az-b]

      volumeClaimTemplate:
        metadata:
          name: data
        spec:
          accessModes:
            - ReadWriteOnce
          storageClassName: longhorn
          resources:
            requests:
              storage: 100Gi

    - name: az-c
      servers: 1
      volumesPerServer: 1
      size: 100Gi
      storageClass: longhorn

      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values: [az-c]

      volumeClaimTemplate:
        metadata:
          name: data
        spec:
          accessModes:
            - ReadWriteOnce
          storageClassName: longhorn
          resources:
            requests:
              storage: 100Gi

  # Console (web UI)
  console:
    image: minio/console:v0.30.0
    replicas: 1
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 512Mi

  # Environment variables — OIDC config
  env:
    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
      value: "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
      value: "minio"
    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: minio-oidc
          key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
      value: "policy"
    - name: MINIO_IDENTITY_OPENID_SCOPES
      value: "openid,profile,email,minio"
    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
      value: "https://minio.riotpiao.homelab.com/oauth_callback"
    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
      value: "Authentik"

  # Metrics
  metrics:
    enabled: true
    port: 9000

  # No auto-TLS (using cert-manager)
  requestAutoCert: false

  # No built-in ingress
  ingress:
    enabled: false