Story Crater Bot
36aea89e47
- MinIO 3-node site replication (az-a/b/c) - S3 backend for Loki chunks (10-day retention) - OIDC integration with Authentik - envFrom for secret injection
76 lines
2.8 KiB
YAML
76 lines
2.8 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: minio-site-replication-setup
|
|
namespace: storage
|
|
spec:
|
|
# Auto-delete the Job pod 10 minutes after completion
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: mc
|
|
image: minio/mc:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
# Alias every site. Service names follow the release naming
|
|
# convention minio-<site>.storage.svc.cluster.local.
|
|
for site in $SITES; do
|
|
mc alias set "$site" "http://minio-${site}.storage.svc.cluster.local:9000" \
|
|
"$ROOT_USER" "$ROOT_PASSWORD"
|
|
done
|
|
|
|
first=$(echo $SITES | cut -d' ' -f1)
|
|
|
|
# Idempotent: skip only if every requested site is already part
|
|
# of the replication group. A partially-configured group (e.g.
|
|
# az-c newly added to SITES) falls through to `replicate add`,
|
|
# which expands an existing group in place.
|
|
# NOTE: pure-shell matching — the minio/mc image has no grep.
|
|
info=$(mc admin replicate info "$first" 2>/dev/null || true)
|
|
missing=0
|
|
for site in $SITES; do
|
|
case "$info" in
|
|
*"$site"*) ;;
|
|
*) missing=1 ;;
|
|
esac
|
|
done
|
|
if [ "$missing" -eq 0 ]; then
|
|
echo "Site replication already spans all sites ($SITES) — nothing to do"
|
|
mc admin replicate info "$first"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Configuring site replication across: $SITES"
|
|
mc admin replicate add $SITES
|
|
|
|
echo "Replication status:"
|
|
mc admin replicate info "$first"
|
|
env:
|
|
# Space-separated list of replication sites, named after the AZ
|
|
# node labels. Each site must have a Helm release minio-<site>
|
|
# (e.g. minio-az-a) so the Service DNS resolves. To add an AZ
|
|
# later: deploy minio-az-<X>, append "az-<X>" here, then delete
|
|
# and re-apply this Job.
|
|
- name: SITES
|
|
value: "az-a az-b az-c"
|
|
# MinIO site replication requires identical root credentials on
|
|
# every site, so reading one release's Secret covers all of them.
|
|
# The MinIO chart creates a Secret named after the release with
|
|
# keys rootUser and rootPassword.
|
|
- name: ROOT_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-az-a
|
|
key: rootUser
|
|
- name: ROOT_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: minio-az-a
|
|
key: rootPassword
|