mirror of
https://github.com/kerberos-io/deployment.git
synced 2026-08-23 15:18:32 +00:00
remove minio, use microk8s instead, bucket creation on deployment
This commit is contained in:
Cedric Verstraeten
@@ -1,13 +1,13 @@
|
||||
#apiVersion: v1
|
||||
#kind: Namespace
|
||||
#metadata:
|
||||
# name: minio-tenant
|
||||
#---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: minio-tenant
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: storage-configuration
|
||||
# namespace: minio-tenant
|
||||
namespace: minio-tenant
|
||||
stringData:
|
||||
config.env: |-
|
||||
export MINIO_ROOT_USER="minio"
|
||||
@@ -29,77 +29,190 @@ type: Opaque
|
||||
apiVersion: minio.min.io/v2
|
||||
kind: Tenant
|
||||
metadata:
|
||||
name: myminio
|
||||
namespace: minio-tenant
|
||||
## Optionally pass labels to be applied to the statefulset pods
|
||||
labels:
|
||||
app: minio
|
||||
## Optionally pass annotations to be applied to the statefulset pods
|
||||
annotations:
|
||||
prometheus.io/path: /minio/v2/metrics/cluster
|
||||
prometheus.io/port: "9000"
|
||||
prometheus.io/scrape: "true"
|
||||
labels:
|
||||
app: minio
|
||||
name: myminio
|
||||
# namespace: minio-tenant
|
||||
|
||||
## If a scheduler is specified here, Tenant pods will be dispatched by specified scheduler.
|
||||
## If not specified, the Tenant pods will be dispatched by default scheduler.
|
||||
# scheduler:
|
||||
# name: my-custom-scheduler
|
||||
|
||||
spec:
|
||||
certConfig: {}
|
||||
features:
|
||||
## Enable S3 specific features such as Bucket DNS which would allow `buckets` to be
|
||||
## accessible as DNS entries of form `<bucketname>.minio.namespace.svc.cluster.local`
|
||||
## This feature is turned off by default
|
||||
bucketDNS: false
|
||||
## Specify a list of domains used to access MinIO and Console
|
||||
domains: { }
|
||||
## Enable access via SFTP
|
||||
## This feature is turned off by default
|
||||
# enableSFTP: false
|
||||
## Create users in the Tenant using this field. Make sure to create secrets per user added here.
|
||||
## Secret should follow the format used in `minio-creds-secret`.
|
||||
users:
|
||||
- name: storage-user
|
||||
## Create buckets using the console user
|
||||
buckets:
|
||||
- name: "mybucket"
|
||||
## This field is used only when "requestAutoCert" is set to true. Use this field to set CommonName
|
||||
## for the auto-generated certificate. Internal DNS name for the pod will be used if CommonName is
|
||||
## not provided. DNS name format is *.minio.default.svc.cluster.local
|
||||
certConfig: { }
|
||||
## PodManagement policy for MinIO Tenant Pods. Can be "OrderedReady" or "Parallel"
|
||||
## Refer https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
|
||||
## for details.
|
||||
podManagementPolicy: Parallel
|
||||
## Secret with credentials and configurations to be used by MinIO Tenant.
|
||||
configuration:
|
||||
name: storage-configuration
|
||||
env: []
|
||||
externalCaCertSecret: []
|
||||
externalCertSecret: []
|
||||
externalClientCertSecrets: []
|
||||
features:
|
||||
bucketDNS: false
|
||||
domains: {}
|
||||
image: quay.io/minio/minio:RELEASE.2024-08-03T04-33-23Z
|
||||
imagePullSecret: {}
|
||||
## Add environment variables to be set in MinIO container (https://github.com/minio/minio/tree/master/docs/config)
|
||||
env: [ ]
|
||||
## serviceMetadata allows passing additional labels and annotations to MinIO and Console specific
|
||||
## services created by the operator.
|
||||
serviceMetadata:
|
||||
minioServiceLabels: { }
|
||||
minioServiceAnnotations: { }
|
||||
consoleServiceLabels: { }
|
||||
consoleServiceAnnotations: { }
|
||||
## PriorityClassName indicates the Pod priority and hence importance of a Pod relative to other Pods.
|
||||
## This is applied to MinIO pods only.
|
||||
## Refer Kubernetes documentation for details https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass/
|
||||
priorityClassName: ""
|
||||
## Use this field to provide one or more external CA certificates. This is used by MinIO
|
||||
## to verify TLS connections with other applications.
|
||||
## Certificate secret files will be mounted under /tmp/certs/CAs folder, supported types:
|
||||
## Opaque | kubernetes.io/tls | cert-manager.io/v1alpha2 | cert-manager.io/v1
|
||||
##
|
||||
## ie:
|
||||
##
|
||||
## externalCaCertSecret:
|
||||
## - name: ca-certificate-1
|
||||
## type: Opaque
|
||||
## - name: ca-certificate-2
|
||||
## type: Opaque
|
||||
## - name: ca-certificate-3
|
||||
## type: Opaque
|
||||
##
|
||||
## Create secrets as explained here:
|
||||
## https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
externalCaCertSecret: [ ]
|
||||
## Use this field to provide one or more Secrets with external certificates. This can be used to configure
|
||||
## TLS for MinIO Tenant pods.
|
||||
## Certificate secret files will be mounted under /tmp/certs folder, supported types:
|
||||
## Opaque | kubernetes.io/tls | cert-manager.io/v1alpha2 | cert-manager.io/v1
|
||||
##
|
||||
## ie:
|
||||
##
|
||||
## externalCertSecret:
|
||||
## - name: domain-certificate-1
|
||||
## type: kubernetes.io/tls
|
||||
## - name: domain-certificate-2
|
||||
## type: kubernetes.io/tls
|
||||
## - name:domain-certificate-3
|
||||
## type: kubernetes.io/tls
|
||||
##
|
||||
## Create secrets as explained here:
|
||||
## https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
externalCertSecret: [ ]
|
||||
|
||||
## Create secrets as explained here:
|
||||
## https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
externalClientCertSecrets: [ ]
|
||||
## Registry location and Tag to download MinIO Server image
|
||||
image: quay.io/minio/minio:RELEASE.2024-11-07T00-52-20Z
|
||||
imagePullSecret: { }
|
||||
## Mount path where PV will be mounted inside container(s).
|
||||
mountPath: /export
|
||||
podManagementPolicy: Parallel
|
||||
## Sub path inside Mount path where MinIO stores data.
|
||||
## WARNING:
|
||||
## We recommend you to keep the same mountPath and the same subPath once the
|
||||
## Tenant has been deployed over your different PVs.
|
||||
## This is because if you change these values once Tenant is deployed, then
|
||||
## you will end up with multiple paths for different buckets. So please, be
|
||||
## very careful to keep same value for the life of the Tenant.
|
||||
subPath: ""
|
||||
## Service account to be used for all the MinIO Pods
|
||||
serviceAccountName: ""
|
||||
## Specification for MinIO Pool(s) in this Tenant.
|
||||
pools:
|
||||
- affinity:
|
||||
nodeAffinity: {}
|
||||
podAffinity: {}
|
||||
podAntiAffinity: {}
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
## Servers specifies the number of MinIO Tenant Pods / Servers in this pool.
|
||||
## For standalone mode, supply 1. For distributed mode, supply 4 or more.
|
||||
## Note that the operator does not support upgrading from standalone to distributed mode.
|
||||
- servers: 1
|
||||
## custom name for the pool
|
||||
name: pool-0
|
||||
nodeSelector: {}
|
||||
resources: {}
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
servers: 1
|
||||
tolerations: []
|
||||
topologySpreadConstraints: []
|
||||
## Specify one or more Pod Topology Spread Constraints to apply to pods deployed in the MinIO pool.
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints
|
||||
topologySpreadConstraints: [ ]
|
||||
## volumesPerServer specifies the number of volumes attached per MinIO Tenant Pod / Server.
|
||||
volumesPerServer: 4
|
||||
## nodeSelector parameters for MinIO Pods. It specifies a map of key-value pairs. For the pod to be
|
||||
## eligible to run on a node, the node must have each of the
|
||||
## indicated key-value pairs as labels.
|
||||
## Read more here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
nodeSelector: { }
|
||||
## Used to specify a toleration for a pod
|
||||
tolerations: [ ]
|
||||
## Affinity settings for MinIO pods. Read more about affinity
|
||||
## here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity.
|
||||
affinity:
|
||||
nodeAffinity: { }
|
||||
podAffinity: { }
|
||||
podAntiAffinity: { }
|
||||
## Configure resource requests and limits for MinIO containers
|
||||
resources: { }
|
||||
## This VolumeClaimTemplate is used across all the volumes provisioned for MinIO Tenant in this
|
||||
## Pool.
|
||||
volumeClaimTemplate:
|
||||
apiVersion: v1
|
||||
kind: persistentvolumeclaims
|
||||
metadata: {}
|
||||
metadata: { }
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Ti
|
||||
storageClassName: openebs-hostpath
|
||||
status: {}
|
||||
volumesPerServer: 4
|
||||
priorityClassName: ""
|
||||
storageClassName: "ssd-hostpath"
|
||||
status: { }
|
||||
## Configure Pod's security context
|
||||
## We recommend to skip the recursive permission change by using
|
||||
## fsGroupChangePolicy as OnRootMismatch because it can be pretty
|
||||
## expensive for larger volumes with lots of small files.
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: "OnRootMismatch"
|
||||
## Configure container security context
|
||||
containerSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
## Enable automatic Kubernetes based certificate generation and signing as explained in
|
||||
## https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster
|
||||
requestAutoCert: false
|
||||
serviceAccountName: ""
|
||||
serviceMetadata:
|
||||
consoleServiceAnnotations: {}
|
||||
consoleServiceLabels: {}
|
||||
minioServiceAnnotations: {}
|
||||
minioServiceLabels: {}
|
||||
subPath: ""
|
||||
users:
|
||||
- name: storage-user
|
||||
# The minimum number of days to expiry before an alert for an expiring certificate is fired.
|
||||
# In the below example, if a given certificate will expire in 7 days then expiration events will only be triggered 1 day before expiry
|
||||
# certExpiryAlertThreshold: 1
|
||||
## Prometheus Operator's Service Monitor for MinIO Tenant Pods.
|
||||
# prometheusOperator:
|
||||
# labels:
|
||||
# app: minio-sm
|
||||
## Audit Logs will be deprecated soon, commenting out for now!.
|
||||
@@ -47,9 +47,4 @@ helmCharts:
|
||||
# For some reason it doesn't work with a namespace
|
||||
#namespace: vernemq
|
||||
repo: https://vernemq.github.io/docker-vernemq
|
||||
valuesFile: ../../base/vernemq/vernemq-values.yaml
|
||||
- name: minio-operator
|
||||
releaseName: minio-operator
|
||||
# For some reason it doesn't work with a namespace
|
||||
#namespace: minio
|
||||
repo: https://operator.min.io
|
||||
valuesFile: ../../base/vernemq/vernemq-values.yaml
|
||||
Reference in New Issue
Block a user