Story Crater BotandClaude Haiku 4.5
e7f3409d0f
Phase 0 groundwork for helmfile→ArgoCD migration: 1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx) — already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership 2. Bootstrap ESO (External Secrets Operator) as TF-managed release — required for all ExternalSecret resources in phases 1-3 — added to bootstrap-releases.tf + helm-repositories.tf 3. Create ClusterSecretStore connecting ESO to Vault (K8s auth) — enables per-namespace/per-release secret injection — vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup) 4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling Changes: - helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks - terraform/bootstrap-releases.tf: add external-secrets release - terraform/helm-repositories.tf: add external-secrets Helm repo - k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore - k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1) - docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
114 lines
3.5 KiB
Terraform
114 lines
3.5 KiB
Terraform
# MinIO - Official minio/minio chart, direct Helm deployment (no operator)
|
|
# All-in-one: single helm_release + dedicated xfs StorageClass.
|
|
# Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
|
|
# exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
|
|
# no persistence.fsType, so fsType must be set on the StorageClass.
|
|
#
|
|
# PVC is Terraform-managed directly (import-only, prevent_destroy) and
|
|
# referenced by the chart via persistence.existingClaim, so Helm never
|
|
# templates/reconciles the PVC object itself (previously caused a failed
|
|
# force-replace attempt against the bound, immutable volumeName).
|
|
|
|
resource "kubernetes_storage_class" "longhorn_xfs" {
|
|
metadata {
|
|
name = "longhorn-xfs"
|
|
}
|
|
storage_provisioner = "driver.longhorn.io"
|
|
reclaim_policy = "Delete"
|
|
allow_volume_expansion = true
|
|
volume_binding_mode = "Immediate"
|
|
|
|
parameters = {
|
|
numberOfReplicas = "2"
|
|
staleReplicaTimeout = "60"
|
|
fsType = "xfs"
|
|
dataLocality = "disabled"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_persistent_volume_claim" "minio" {
|
|
metadata {
|
|
name = "minio"
|
|
namespace = "storage"
|
|
}
|
|
spec {
|
|
access_modes = ["ReadWriteOnce"]
|
|
storage_class_name = kubernetes_storage_class.longhorn_xfs.metadata[0].name
|
|
resources {
|
|
requests = {
|
|
storage = "100Gi"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "minio" {
|
|
name = "minio"
|
|
repository = "https://charts.min.io/"
|
|
chart = "minio"
|
|
version = "5.4.0"
|
|
namespace = "storage"
|
|
upgrade_install = true
|
|
wait = true
|
|
timeout = 600
|
|
|
|
values = [
|
|
yamlencode({
|
|
mode = "standalone"
|
|
replicas = 1
|
|
drivesPerNode = 1
|
|
pools = 1
|
|
|
|
rootUser = "minioadmin"
|
|
rootPassword = var.minio_root_password
|
|
|
|
persistence = {
|
|
enabled = true
|
|
existingClaim = kubernetes_persistent_volume_claim.minio.metadata[0].name
|
|
}
|
|
|
|
resources = {
|
|
requests = {
|
|
memory = "512Mi"
|
|
}
|
|
}
|
|
|
|
service = {
|
|
type = "ClusterIP"
|
|
port = "9000"
|
|
}
|
|
consoleService = {
|
|
type = "ClusterIP"
|
|
port = "9001"
|
|
}
|
|
|
|
# Buckets auto-created on install (all-in-one, no post-hook needed)
|
|
buckets = [
|
|
{ name = "terraform-state", policy = "none", purge = false },
|
|
{ name = "vault", policy = "none", purge = false },
|
|
{ name = "riotpiao-models", policy = "none", purge = false },
|
|
{ name = "loki-chunks", policy = "none", purge = false },
|
|
{ name = "loki-ruler", policy = "none", purge = false },
|
|
{ name = "loki-admin", policy = "none", purge = false },
|
|
{ name = "loki-index", policy = "none", purge = false },
|
|
]
|
|
|
|
environment = {
|
|
MINIO_IDENTITY_OPENID_CONFIG_URL = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
|
|
MINIO_IDENTITY_OPENID_CLIENT_ID = "minio"
|
|
MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
|
|
MINIO_IDENTITY_OPENID_CLAIM_NAME = "policy"
|
|
MINIO_IDENTITY_OPENID_SCOPES = "openid,profile,email,minio"
|
|
MINIO_IDENTITY_OPENID_REDIRECT_URI = "https://minio.riotpiao.homelab.com/oauth_callback"
|
|
MINIO_IDENTITY_OPENID_DISPLAY_NAME = "Authentik"
|
|
}
|
|
})
|
|
]
|
|
}
|
|
|
|
variable "create_storage_namespace" {
|
|
description = "Create storage namespace if it doesn't exist"
|
|
type = bool
|
|
default = false
|
|
}
|