91 lines
2.6 KiB
Terraform
91 lines
2.6 KiB
Terraform
# MinIO - Official minio/minio chart, direct Helm deployment (no operator)
|
|
# All-in-one: single helm_release + dedicated xfs StorageClass.
|
|
# Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
|
|
# exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
|
|
# no persistence.fsType, so fsType must be set on the StorageClass.
|
|
|
|
resource "kubernetes_storage_class" "longhorn_xfs" {
|
|
metadata {
|
|
name = "longhorn-xfs"
|
|
}
|
|
storage_provisioner = "driver.longhorn.io"
|
|
reclaim_policy = "Delete"
|
|
allow_volume_expansion = true
|
|
volume_binding_mode = "Immediate"
|
|
|
|
parameters = {
|
|
numberOfReplicas = "2"
|
|
staleReplicaTimeout = "60"
|
|
fsType = "xfs"
|
|
dataLocality = "disabled"
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "minio" {
|
|
name = "minio"
|
|
repository = "https://charts.min.io/"
|
|
chart = "minio"
|
|
version = "5.4.0"
|
|
namespace = "storage"
|
|
upgrade_install = true
|
|
force_update = true
|
|
wait = true
|
|
timeout = 600
|
|
|
|
values = [
|
|
yamlencode({
|
|
mode = "standalone"
|
|
replicas = 1
|
|
drivesPerNode = 1
|
|
pools = 1
|
|
|
|
rootUser = "minioadmin"
|
|
rootPassword = var.minio_root_password
|
|
|
|
persistence = {
|
|
enabled = true
|
|
size = "100Gi"
|
|
storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
|
|
accessMode = "ReadWriteOnce"
|
|
}
|
|
|
|
resources = {
|
|
requests = {
|
|
memory = "512Mi"
|
|
}
|
|
}
|
|
|
|
service = {
|
|
type = "ClusterIP"
|
|
port = "9000"
|
|
}
|
|
consoleService = {
|
|
type = "ClusterIP"
|
|
port = "9001"
|
|
}
|
|
|
|
# Buckets auto-created on install (all-in-one, no post-hook needed)
|
|
buckets = [
|
|
{ name = "vault", policy = "none", purge = false },
|
|
{ name = "riotpiao-models", policy = "none", purge = false },
|
|
]
|
|
|
|
environment = {
|
|
MINIO_IDENTITY_OPENID_CONFIG_URL = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
|
|
MINIO_IDENTITY_OPENID_CLIENT_ID = "minio"
|
|
MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
|
|
MINIO_IDENTITY_OPENID_CLAIM_NAME = "policy"
|
|
MINIO_IDENTITY_OPENID_SCOPES = "openid,profile,email,minio"
|
|
MINIO_IDENTITY_OPENID_REDIRECT_URI = "https://minio.riotpiao.homelab.com/oauth_callback"
|
|
MINIO_IDENTITY_OPENID_DISPLAY_NAME = "Authentik"
|
|
}
|
|
})
|
|
]
|
|
}
|
|
|
|
variable "create_storage_namespace" {
|
|
description = "Create storage namespace if it doesn't exist"
|
|
type = bool
|
|
default = false
|
|
}
|