minio.yaml

blocks:
  - name: deploy_minio_webui_domain_blk
    content:
      apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: "myminio-ui-ingress"
        namespace: minio
        annotations:
          cert-manager.io/cluster-issuer: cluster-issuer
          kubernetes.io/tls-acme: "true"
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
          external-dns.alpha.kubernetes.io/hostname: "{{ $cndi.get_prompt_response(minio_webui_domain) }}"
          $cndi.comment(nginx-ingress-annotation): Increase the maximum body size to 50TiB
          $cndi.comment(nginx-ingress-annotation-cont): to align with Minio max file size
          nginx.ingress.kubernetes.io/proxy-body-size: 50000g
      spec:
        tls:
          - hosts:
              - "{{ $cndi.get_prompt_response(minio_webui_domain) }}"
            secretName: cluster-issuer-private-key-minio-ui
        rules:
          - host: "{{ $cndi.get_prompt_response(minio_webui_domain) }}"
            http:
              paths:
                - path: /
                  pathType: Prefix
                  backend:
                    service:
                      name: "myminio-console"
                      port:
                        name: https-console
prompts:
  - $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/cluster/core-prompts.yaml):
      {}
  - $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/{{ $cndi.get_prompt_response(deployment_target_provider) }}/core-prompts.yaml):
      {}

  - name: server_domain_name
    default: myminiotenant.example.com
    message: "What hostname should the MinIO tenant server be accessible at"
    type: Input
    validators:
      - hostname # FQDN

  - name: servers
    default: 4
    message: "Specify the number of tenant servers to deploy:"
    type: Number

  - name: volumes_per_server
    default: 1
    message: "Specify the number of volumes per server:"
    type: Number

  - name: deploy_minio_webui_domain
    default: true
    message: >-
      Do you want to expose your minio console ui to the web?
    type: Confirm

  - name: minio_webui_domain
    default: myminioconsole.example.com
    message: "What hostname should the MinIO console ui be accessible at"
    type: Input
    validators:
      - hostname # FQDN
      - min_length: 3
    condition:
      - "{{ $cndi.get_prompt_response(deploy_minio_webui_domain) }}"
      - ==
      - true

  - name: access_key
    default: "{{ $cndi.get_random_string(12) }}"
    message: 'Enter the "Username/Accesskey" for the MinIO tenant user:'
    type: Secret
    validators:
      - min_length: 3

  - name: secret_key
    default: "{{ $cndi.get_random_string(18) }}"
    message: 'Enter the "Password/SecretKey" for your MinIO tenant user:'
    type: Secret
    validators:
      - min_length: 8

  - name: bucket_name
    default: myminiobucket
    message: "Enter the name of the bucket to create in your MinIO tenant account:"
    type: Input

outputs:
  cndi_config:
    cndi_version: v2
    project_name: "{{ $cndi.get_prompt_response(project_name) }}"
    provider: "{{ $cndi.get_prompt_response(deployment_target_provider) }}"
    distribution: "{{ $cndi.get_prompt_response(deployment_target_distribution) }}"
    infrastructure:
      cndi:
        $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/cluster/observability-config.yaml):
          condition:
            - "{{ $cndi.get_prompt_response(deploy_grafana_ingress) }}"
            - ==
            - true

        $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/cluster/argocd-config.yaml):
          condition:
            - "{{ $cndi.get_prompt_response(deploy_argocd_ingress) }}"
            - ==
            - true

        cert_manager:
          email: "{{ $cndi.get_prompt_response(cert_manager_email) }}"

        external_dns:
          $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/external-dns/config/{{ $cndi.get_prompt_response(dns_provider) }}.yaml):
            condition:
              - "{{ $cndi.get_prompt_response(enable_external_dns) }}"
              - ==
              - true

        nodes:
          $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/{{ $cndi.get_prompt_response(deployment_target_provider) }}/basic-node-pool.yaml):
            {}

    cluster_manifests:
      minio-server-ingress:
        apiVersion: networking.k8s.io/v1
        kind: Ingress
        metadata:
          name: minio-server-ingress
          namespace: minio
          annotations:
            cert-manager.io/cluster-issuer: cluster-issuer
            kubernetes.io/tls-acme: "true"
            nginx.ingress.kubernetes.io/backend-protocol: HTTPS
            external-dns.alpha.kubernetes.io/hostname: "{{ $cndi.get_prompt_response(server_domain_name) }}"
            $cndi.comment(nginx-ingress-annotation-2): Increase the maximum body size to 50TiB
            $cndi.comment(nginx-ingress-annotation-2-cont): to align with Minio max file size
            nginx.ingress.kubernetes.io/proxy-body-size: 50000g
        spec:
          tls:
            - hosts:
                - "{{ $cndi.get_prompt_response(server_domain_name) }}"
              secretName: cluster-issuer-private-key-minio
          rules:
            - host: "{{ $cndi.get_prompt_response(server_domain_name) }}"
              http:
                paths:
                  - path: "/"
                    pathType: Prefix
                    backend:
                      service:
                        name: minio
                        port:
                          name: https-minio
      minio-tenant-root-creds-secret:
        apiVersion: v1
        kind: Secret
        metadata:
          name: minio-tenant-root-creds-secret
          namespace: minio
          annotations:
            sealedsecrets.bitnami.com/cluster-wide: "true"
          labels:
            argocd.argoproj.io/secret-type: cluster
            app.kubernetes.io/instance: tenant
        type: Opaque
        stringData:
          config.env: $cndi_on_ow.seal_secret_from_env_var(MINIO_TENANT_ROOT_CREDENTIALS)

      minio-tenant-account:
        apiVersion: minio.min.io/v2
        kind: Tenant
        metadata:
          annotations:
            argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
          name: "myminio"
          namespace: minio
          labels:
            app: minio
        spec:
          features:
            bucketDNS: false
          users:
            - name: admin-user
          buckets:
            - name: "{{ $cndi.get_prompt_response(bucket_name) }}"
          mountPath: /data
          configuration:
            name: minio-tenant-root-creds-secret
          pools:
            - servers: "{{ $cndi.get_prompt_response(servers) }}"
              name: pool-0
              volumesPerServer: "{{ $cndi.get_prompt_response(volumes_per_server) }}"
              volumeClaimTemplate:
                apiVersion: v1
                kind: persistentvolumeclaims
                metadata: {}
                spec:
                  accessModes:
                    - ReadWriteOnce
                  resources:
                    requests:
                      storage: 5Gi
                  storageClassName: rwo

      admin-user-secret:
        apiVersion: v1
        kind: Secret
        metadata:
          name: admin-user
          namespace: minio
        type: Opaque
        stringData:
          CONSOLE_ACCESS_KEY: $cndi_on_ow.seal_secret_from_env_var(MINIO_TENANT_ACCESS_KEY)
          CONSOLE_SECRET_KEY: $cndi_on_ow.seal_secret_from_env_var(MINIO_TENANT_SECRET_KEY)

      minio-webui-ingress:
        $cndi.get_block(deploy_minio_webui_domain_blk):
          condition:
            - "{{ $cndi.get_prompt_response(deploy_minio_webui_domain) }}"
            - ==
            - true

      external-dns-secret:
        $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/external-dns/secret/{{ $cndi.get_prompt_response(dns_provider) }}.yaml):
          condition:
            - "{{ $cndi.get_prompt_response(enable_external_dns) }}"
            - ==
            - true
      airbyte-ns:
        apiVersion: v1
        kind: Namespace
        metadata:
          name: minio

    applications:
      minio:
        chart: operator
        destinationNamespace: minio
        repoURL: https://operator.min.io/
        targetRevision: 6.0.3
  env:
    $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/git-credentials-{{ $cndi.get_prompt_response(git_credentials_mode) }}-env.yaml):
      {}
    $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/{{ $cndi.get_prompt_response(deployment_target_provider) }}/env.yaml):
      {}
    $cndi.get_block(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/cluster/env.yaml):
      {}

    $cndi.comment(minio-heading): Minio Connection Parameters
    MINIO_TENANT_ACCESS_KEY: "{{ $cndi.get_prompt_response(access_key) }}"
    MINIO_TENANT_SECRET_KEY: "{{ $cndi.get_prompt_response(secret_key) }}"
    MINIO_TENANT_ROOT_CREDENTIALS: |
      'export MINIO_ROOT_USER="{{ $cndi.get_random_string(18) }}"
      export MINIO_ROOT_PASSWORD="{{ $cndi.get_random_string(24) }}"'
    MINIO_TENANT_SERVER_DOMAIN_NAME: "{{ $cndi.get_prompt_response(server_domain_name) }}"
    MINIO_TENANT_NAME: "myminio"
    MINIO_TENANT_BUCKET_NAME: "{{ $cndi.get_prompt_response(bucket_name) }}"
    MINIO_CLIENT_COMMAND: mc alias set myminio https://{{ $cndi.get_prompt_response(server_domain_name) }} {{ $cndi.get_prompt_response(access_key) }} {{ $cndi.get_prompt_response(secret_key) }}
  readme:
    project_name: "# {{ $cndi.get_prompt_response(project_name) }}"
    $cndi.get_string(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/common/cluster/core-readme.md):
      {}
    $cndi.get_string(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/{{ $cndi.get_prompt_response(deployment_target_provider) }}/core.md):
      {}
    $cndi.get_string(https://raw.githubusercontent.com/polyseam/cndi/main/blocks/{{ $cndi.get_prompt_response(deployment_target_provider) }}/{{ $cndi.get_prompt_response(deployment_target_distribution) }}.md):
      {}

    minio: |
      ## Minio Deployment Guide

      This template deploys a Standalone production ready
      [minio operator and tenant](https://github.com/minio/operator/tree/master)

      MinIO is a high-performance, distributed object storage system designed to support cloud-native applications with S3-compatible storage for unstructured, semi-structured and structured data.
      Some benefits of combining MinIO include:

      High Performance: MinIO writes as fast as they come in. MinIO is used to build high performance infrastructure for machine learning, analytics and application data workloads.
      Scalability: MinIO handles large amounts of data and scales horizontally across multiple nodes, This allows organizations to store and process massive amounts of data in real-time, making it suitable for big data and high-velocity data streaming use cases.
      Durability: MinIO provides durable storage, allowing organizations to retain data for long periods of time, such as for historical analysis, compliance requirements, or data recovery purposes.
      Fault Tolerance: MinIO erasure codes data across multiple nodes, providing fault tolerance and ensuring data durability.
      Easy Integration: MinIO is easily integrated with like aws s3, a built-in framework for connecting with external systems. This makes it straightforward to stream data to MinIO for storage, and vice versa for data retrieval.

      ## Testing Your Minio Connection

      ### Using MinIO Console

      When you first open the MinIO console web interface, you'll be prompted to enter your access and secret keys. The credentials are in the ENV file:
      Username: <MINIO_TENANT_ACCESS_KEY>
      Password: <MINIO_TENANT_SECRET_KEY>

      Once logged in, you will see the MinIO dashboard, which provides an easy-to-use interface for managing buckets and objects.
      You can create new buckets, upload files, and manage your stored data directly through this interface.

      ### Using MinIO `mc` Command Line Tool

      To test the connection you can install the [MinIO CLient](https://min.io/docs/minio/linux/reference/minio-mc.html).

      # Set up MinIO alias
      mc alias set myminio  https://<MINIO_TENANT_SERVER_DOMAIN_NAME> <MINIO_TENANT_ACCESS_KEY> <MINIO_TENANT_SECRET_KEY>

      # Create a new bucket if it doesn't exist
      mc mb myminio/myminiobucket || echo "Bucket already exists";

      # Create a file to upload
      echo "Hello, MinIO!" > /tmp/hello.txt;

      # Copy the file to the MinIO bucket
      mc cp /tmp/hello.txt myminio/myminiobucket;

      # List objects in the bucket to verify the upload
      mc ls myminio/myminiobucket;


      You can find the MINIO_TENANT_ACCESS_KEY MINIO_TENANT_SECRET_KEY and MINIO_TENANT_SERVER_DOMAIN_NAME in the .env file.