Deploy MinIO

services/ni/deploy.sh

@@ -10,7 +10,6 @@ NI_CERT_CERT=$2
 
 
 kubectl apply -f $(dirname $0)/website
-kubectl apply -f $(dirname $0)/nijobs
 kubectl apply -f $(dirname $0)/nitsig
 kubectl apply -f $(dirname $0)/plausible
 
@@ -24,6 +23,8 @@ if [[ -z "$NI_CERT_CERT" ]]; then
     exit 1
 fi
 
-kubectl create secret tls --namespace=nijobs website-cert --key=$NI_CERT_KEY --cert=$NI_CERT_CERT
+kubectl delete secret --namespace=nitsig website-cert
+kubectl delete secret --namespace=ni-website website-cert
+
 kubectl create secret tls --namespace=nitsig website-cert --key=$NI_CERT_KEY --cert=$NI_CERT_CERT
 kubectl create secret tls --namespace=ni-website website-cert --key=$NI_CERT_KEY --cert=$NI_CERT_CERT

services/pulumi/crds.yaml

@@ -13,6 +13,8 @@ repositories:
     url: https://charts.longhorn.io
   - name: traefik
     url: https://traefik.github.io/charts
+  - name: minio-operator
+    url: https://operator.min.io
 
 manifests:
   # cert-manager
@@ -53,3 +55,8 @@ manifests:
   - type: helm
     chart: traefik/traefik
     version: 28.3.0
+
+  # minio
+  - type: template
+    chart: minio-operator/operator
+    version: 6.0.0

services/pulumi/niployments/.gitignore

@@ -0,0 +1 @@
+rendered-debug-yaml/

services/pulumi/niployments/Pulumi.prod.yaml

@@ -1,6 +1,8 @@
-encryptionsalt: v1:upriG3hjats=:v1:Mjju6ZYDjjKKyVPn:Bn6nuCMHoUCltZWaXycxDl5bvv7ndA==
+encryptionsalt: v1:vcKJMHA+4iI=:v1:e3jUh+xx0WgDWY6G:q2pOOhKgl7SGqFxV8uvsb1Kk7Ak9oA==
 config:
+  niployments:minio/root-secret:
+    secure: v1:kvZP8Y8P467RUkhA:x26ulATfs7XIw0T4NH4VUCtcKmRLew==
   niployments:mongodb/admin-password:
-    secure: v1:GXCb2z0V4Az3053O:y6EgjlKVYr6BWebVazmAmdC/YCI=
+    secure: v1:+r7V2XJ515b5e9G4:tNcpo4Lqkz5nnplay+3ev3xoAvYDgQ==
   niployments:mongodb/nimentas-password:
-    secure: v1:HxF47P+9RXfi4nfc:47vWUGoYJgjmqxaWwT2M8SSCgI0=
+    secure: v1:ud1QrQI7peJMh0OC:I2QeTvr+r9kiFtqWjMk75C7Aimk/ow==

services/pulumi/niployments/index.ts

@@ -1,4 +1,6 @@
 import "./services/ementas/index.js";
+import "./resources/minio/tenant.js";
+
 import { CommitSignal } from "./utils/pending.js";
 
 CommitSignal.globalParent.resolve();

services/pulumi/niployments/resources/minio/charts.ts

@@ -0,0 +1,19 @@
+import * as k8s from "@pulumi/kubernetes";
+
+
+export const namespace = new k8s.core.v1.Namespace("minio-operator-namespace", {
+    metadata: {
+        name: "minio-operator"
+    }
+})
+
+export const chart = new k8s.helm.v4.Chart(
+    "minio-operator", 
+    {
+        chart: "operator",
+        namespace: namespace.metadata.name,
+        version: "6.0.0",
+        repositoryOpts: {
+            repo: "https://operator.min.io",
+        },
+    })

services/pulumi/niployments/resources/minio/tenant.ts

@@ -0,0 +1,60 @@
+/* eslint-disable @typescript-eslint/no-base-to-string */
+/* eslint-disable @typescript-eslint/restrict-template-expressions */
+import { minio } from "@pulumi/crds";
+import { chart, namespace } from "./charts.js";
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+
+
+const config = new pulumi.Config();
+
+export const secret = new k8s.core.v1.Secret("minio-tenant-root-secret", {
+    metadata: {
+        namespace: namespace.metadata.name,
+        name: "minio-tenant-root-secret"
+    },
+    stringData: {
+        "config.env": 
+        `
+        export MINIO_ROOT_USER=root
+        export MINIO_ROOT_PASSWORD=${config.requireSecret("minio/root-secret")}
+        `
+    }
+})
+
+
+export const minioTenant = new minio.v2.Tenant("minio-tenant", {
+    metadata: {
+        namespace: namespace.metadata.name,
+        name: "minio-tenant"
+    },
+    spec: {
+        pools: [{
+            name: "main-pool",
+            servers: 1,
+            volumesPerServer: 1,
+            volumeClaimTemplate: {
+                apiVersion: "v1",
+                kind: "PersistentVolumeClaim",
+                metadata: {
+                    namespace: namespace.metadata.name
+                },
+                spec: {
+                    resources: {
+                        requests: {
+                            storage: "20Gi"
+                        }
+                    },
+                    storageClassName: "longhorn-strict-local-retain",
+                    accessModes: ["ReadWriteOnce"]
+                }
+            }
+        }],
+        credsSecret: {
+            name: secret.metadata.name
+        }
+    }
+}, {dependsOn: [
+    chart
+]})