Story Crater Bot
7da222e243
- MinIO 3-node site replication (az-a/b/c) - S3 backend for Loki chunks (10-day retention) - OIDC integration with Authentik - envFrom for secret injection
110 lines
5.1 KiB
Bash
Executable File
110 lines
5.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# k8s/storage/bootstrap.sh
|
|
# Deploys the MinIO multi-AZ object store into the storage namespace.
|
|
#
|
|
# Prerequisites:
|
|
# - kubectl configured (KUBECONFIG pointing to cluster-config/kubeconfig)
|
|
# - helm >= 3.x installed
|
|
# - k8s/storage/.env file containing:
|
|
# MINIO_ROOT_USER=...
|
|
# MINIO_ROOT_PASSWORD=...
|
|
# OR those variables already exported in the calling shell.
|
|
#
|
|
# Idempotent: safe to re-run — helm upgrade --install and kubectl apply are both idempotent.
|
|
# Disaster recovery order: run this before k8s/logging/bootstrap.sh (Loki depends on MinIO).
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../../cluster-config/kubeconfig}"
|
|
export KUBECONFIG
|
|
|
|
# ── Load credentials ──────────────────────────────────────────────────────────
|
|
if [[ -f "${SCRIPT_DIR}/.env" ]]; then
|
|
# shellcheck source=/dev/null
|
|
source "${SCRIPT_DIR}/.env"
|
|
fi
|
|
|
|
for var in MINIO_ROOT_USER MINIO_ROOT_PASSWORD; do
|
|
if [[ -z "${!var:-}" ]]; then
|
|
echo "ERROR: ${var} is not set. Export it or place it in k8s/storage/.env"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
# ── Namespace ─────────────────────────────────────────────────────────────────
|
|
echo "==> Creating storage namespace with privileged pod security..."
|
|
kubectl create namespace storage --dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl label namespace storage \
|
|
pod-security.kubernetes.io/enforce=privileged \
|
|
pod-security.kubernetes.io/enforce-version=latest \
|
|
--overwrite
|
|
|
|
# ── Helm repos ────────────────────────────────────────────────────────────────
|
|
echo "==> Adding Helm repositories..."
|
|
helm repo add minio https://charts.min.io
|
|
helm repo update minio
|
|
|
|
# ── PVC for az-a (adopts existing volume) ────────────────────────────────────
|
|
echo "==> Applying az-a PVC (adopts pre-existing Longhorn volume)..."
|
|
kubectl apply -f "${SCRIPT_DIR}/minio-az-a-pvc.yaml"
|
|
|
|
# ── MinIO az-a (control-plane node, zone az-a) ───────────────────────────────
|
|
echo "==> Installing MinIO az-a..."
|
|
helm upgrade --install minio-az-a minio/minio \
|
|
--namespace storage \
|
|
--values "${SCRIPT_DIR}/minio-az-a-values.yaml" \
|
|
--set rootUser="${MINIO_ROOT_USER}" \
|
|
--set rootPassword="${MINIO_ROOT_PASSWORD}" \
|
|
--wait \
|
|
--timeout 5m
|
|
|
|
echo "==> Waiting for minio-az-a Deployment to be ready..."
|
|
kubectl rollout status deployment/minio-az-a -n storage --timeout=120s
|
|
|
|
# ── MinIO az-b (worker node, zone az-b) ──────────────────────────────────────
|
|
echo "==> Installing MinIO az-b..."
|
|
helm upgrade --install minio-az-b minio/minio \
|
|
--namespace storage \
|
|
--values "${SCRIPT_DIR}/minio-az-b-values.yaml" \
|
|
--set rootUser="${MINIO_ROOT_USER}" \
|
|
--set rootPassword="${MINIO_ROOT_PASSWORD}" \
|
|
--wait \
|
|
--timeout 5m
|
|
|
|
echo "==> Waiting for minio-az-b Deployment to be ready..."
|
|
kubectl rollout status deployment/minio-az-b -n storage --timeout=120s
|
|
|
|
# ── Universal frontend service + legacy alias ─────────────────────────────────
|
|
echo "==> Applying universal frontend service and legacy ExternalName alias..."
|
|
kubectl apply -f "${SCRIPT_DIR}/minio-service.yaml"
|
|
kubectl apply -f "${SCRIPT_DIR}/minio-legacy-alias.yaml"
|
|
|
|
# ── Site replication ──────────────────────────────────────────────────────────
|
|
echo "==> Running site replication setup job..."
|
|
# Delete any leftover completed job first (kubectl apply on Jobs is not idempotent)
|
|
kubectl delete job minio-site-replication-setup -n storage --ignore-not-found
|
|
kubectl apply -f "${SCRIPT_DIR}/minio-replication-job.yaml"
|
|
|
|
echo "==> Waiting for replication job to complete..."
|
|
kubectl wait --for=condition=complete job/minio-site-replication-setup \
|
|
-n storage --timeout=120s
|
|
|
|
echo "==> Replication job output:"
|
|
kubectl logs -n storage \
|
|
-l job-name=minio-site-replication-setup \
|
|
--tail=20
|
|
|
|
# ── Done ──────────────────────────────────────────────────────────────────────
|
|
echo ""
|
|
echo "==> MinIO multi-AZ stack is up."
|
|
echo ""
|
|
echo "MinIO console (S3 browser):"
|
|
echo " kubectl port-forward -n storage svc/minio 9001:9001"
|
|
echo " http://localhost:9001 (${MINIO_ROOT_USER} / <your MINIO_ROOT_PASSWORD>)"
|
|
echo ""
|
|
echo "MinIO S3 endpoint for apps (active-active frontend):"
|
|
echo " http://minio.storage.svc.cluster.local:9000"
|
|
echo ""
|
|
echo "Verify site replication:"
|
|
echo " kubectl logs -n storage -l job-name=minio-site-replication-setup"
|